From six signals to an automatic block

Context

This concerns a WordPress web application in a shared hosting environment protected by Aegis. The client and exact domain are anonymized — every figure, technique and timeline in this study comes directly from the incident record (WORM ledger), without embellishment.

The attack was not one “loud” event but a series of seemingly unrelated signals scattered across the WAF, SIEM and network layer. Individually, each is easily lost in the noise. The value of a SOC is precisely in joining them into one story — and reacting to it while the attack is still underway.

What happened

In just under ten minutes, the same source (31.45.239.xxx) went through five phases in turn:

• 1 · Web application scanning T1595 · Active Scanning

  An automated scanner maps the site structure, looking for known paths and exposed files. The first, quiet signal — not an attack in itself, but the prelude.

• 2 · Admin interface probe T1190 · Exploit Public-Facing App

  Targeted requests to /wp-admin and login paths — the attacker checks whether the interface is open.

• 3 · WordPress exploit attempt (WAF) T1190

  The WAF catches an attempt to exploit a known WordPress vulnerability — the payload is blocked at the application layer, but the attacker does not give up.

• 4 · Login flood (credential stuffing) T1110.003 · Password Spraying

  A series of POST requests to the login — an attempt to break the password with a large number of combinations in a short time.

• 5 · L7 exhaustion (slowloris) T1499 · Endpoint DoS

  When the direct breach fails, the attacker switches to resource exhaustion — slowly holding connections open to choke the server.

How Aegis responded

Each of these phases raised its own alert — six in total, from three different defense layers (WAF, authentication SIEM, network detection). The decisive moment was not any single detection, but correlation:

• The Aegis correlation engine recognized that all six alerts share the same source IP and line up in an attack sequence — from reconnaissance toward an active breach.
• The combination of techniques crossed the confidence threshold: this is no longer “a scanner wandering the internet” but a targeted, multi-stage attack on a specific target.
• Aegis automatically issued an order to block the source at the perimeter — without waiting for an analyst.

Evidence trail

The automatic response is not the end of the story — every decision leaves a trail that can be audited:

• The six source alerts and their correlation are recorded in the immutable (WORM) incident record.
• Each of the 188 malicious requests is tied to a technique and a timestamp.
• The block itself — who issued it (automation), on what basis and when — is part of the same evidence package.

That is the difference between “the system blocked something” and “we can show exactly what happened, why and in what order” — whether for an internal audit or NIS2 records.