Learn to use Splunk for incident handling through interactive scenarios.

Room: https://tryhackme.com/r/room/splunk201

Learning Objectives and Pre-requisites

Before going through this room, it is expected that the participants will have a basic understanding of Splunk. If not, consider going through this room, Splunk 101 (https://tryhackme.com/jr/splunk101).

  • Learn how to leverage OSINT sites during an investigation
  • How to map Attacker's activities to Cyber Kill Chain Phases
  • How to utilize effective Splunk searches to investigate logs
  • Understand the importance of host-centric and network-centric log sources
Task 1 Introduction: Incident Handling

Q: Read the above and continue to the next task.
Answer: No answer needed

Task 2 Incident Handling - Life Cycle

Q: Ccontinue to the Next task.
Answer: No answer needed

Task 3 Incident Handling: Scenario

Q: Continue with the lab
Answer: No answer needed

Task 4 Reconnaissance Phase

Q1: One suricata alert highlighted the CVE value associated with the attack attempt. What is the CVE value?
Answer: CVE-2014-6271

Q2: What is the CMS our web server is using?
Answer: joomla

Q3: What is the web scanner, the attacker used to perform the scanning attempts?
Answer: acunetix

Q4: What is the IP address of the server imreallynotbatman.com?

Task 5 Exploitation Phase

Q1: What was the URI which got multiple brute force attempts?
Answer: /joomla/administrator/index.php

Q2: Against which username was the brute force attempt made?
Answer: admin

Q3: What was the correct password for admin access to the content management system running imreallynotbatman.com?

Answer: batman

Q4: What IP address is likely attempting a brute force password attack against imreallynotbatman.com

Q5: After finding the correct password, which IP did the attacker use to log in to the admin panel?

Task 6 Installation Phase

Q1: Sysmon also collects the Hash value of the processes being created. What is the MD5 HASH of the program 3791.exe?
Answer: AAE3F5A29935E6ABCC2C2754D12A9AF0

Q2: Looking at the logs, which user executed the program 3791.exe on the server?

Q3: Search hash on the virustotal. What other name is associated with this file 3791.exe?
Answer: ab.exe

Task 7 Action on Objectives

Q1: What is the name of the file that defaced the imreallynotbatman.com website ?
Answer: poisonivy-is-coming-for-you-batman.jpeg

Q2: Fortigate Firewall ‘fortigate_utm’ detected SQL attempt from the attacker’s IP What is the name of the rule that was triggered during the SQL Injection attempt?
Answer: HTTP.URI.SQL.Injection

Task 8 Command and Control Phase

Q1: This attack used dynamic DNS to resolve to the malicious IP. What fully qualified domain name (FQDN) is associated with this attack?
Answer: prankglassinebracket.jumpingcrab.com

Task 9 Weaponization Phase

Q1: What IP address has P01s0n1vy tied to domains that are pre-staged to attack Wayne Enterprises?

Q2: Based on the data gathered from this attack and common open-source intelligence sources for domain names, what is the email address that is most likely associated with the P01s0n1vy APT group?
Answer: lillian.rose@po1s0n1vy.com

Task 10 Delivery Phase

Q1: What is the HASH of the Malware associated with the APT group?
Answer: c99131e0169171935c5ac32615ed6261

Q2: What is the name of the Malware associated with the Poison Ivy Infrastructure?
Answer: MirandaTateScreensaver.scr.exe

Task 11 Conclusion

Q4: Read the above.
Answer: No answer needed