Reconstruction and Detection of Gambling Web Defacement Attack Using Wazuh and Velociraptor

Cyberattacks in Indonesia have been on the rise, particularly in the government sector, which has experienced numerous gambling web defacement attacks. Many incidents have been found on websites using third-party cloud services. These attacks often exploit vulnerabilities in public-facing applications, such as brute force attacks and file uploads. This research successfully reconstructed gambling web defacement attacks hosted on AWS and GCP, based on the MITRE ATT&CK framework. The research also implemented detection using Wazuh, integrated with Telegram for notifications, and used Velociraptor for isolating and collecting artifacts. The reconstruction and testing results demonstrated that Wazuh could detect attacks in real-time with an average response time of 1.2 seconds per alert, sending notifications via Telegram. However, network isolation testing using Velociraptor found that the isolation process was successful on AWS servers but unsuccessful on GCP servers, indicating a need for further analysis to determine the cause.