Scenario Case: Phishing URL Access Attempt — Firewall Blocked

Objective

Investigate a security alert involving a blocked URL, review the related activity in Splunk, determine whether the alert is a true positive, and decide whether it should be escalated to L2 SOC.

Figure 1. Initial firewall alert showing an outbound attempt from 10.20.2.17 to a blacklisted shortened URL.

Investigation & Correlation

I first reviewed the firewall alert and found that 10.20.2.17 attempted to access the shortened URL bit.ly/3sHkX3da12340. The firewall blocked the connection.

I then searched the URL in Splunk and found an earlier inbound email sent to [email protected] from [email protected]. The email claimed to be about an Amazon package delivery problem and asked the user to click the same URL.

Because the URL in the email matched the URL in the firewall alert, I determined that the two events were related.

**Classification:**True Positive

Result:

Escalate to L2 SOC

Containment observed:

Firewall blocked the connection.