Splunk 3

Deploy!

Start Machine

This is the 4th room in this Splunk series. This room is based on Splunk's Boss of the SOC competition, the third dataset.

You can read more about this dataset here.

It is highly recommended that you complete the Splunk 101, the BOTSv1, and the BOTSv2 Splunk rooms before attempting this room.

This room is designed with the assumption that you know the basics of Splunk and are comfortable querying various data sources.

Room Machine

Before moving forward, deploy the Splunk virtual machine.

From the AttackBox, open Firefox and navigate to the Splunk instance (http://MACHINE_IP:8000).

You may need to refresh the page until Splunk loads. This can take up to five minutes to launch.

Before you begin

Note: If you are not familiar with AWS (Amazon Web Services), you will need to perform external research to answer most of the questions.

Fret not; you'll be provided useful links to documentation to assist you along the way.

Depending on the questions, you might want to check which sources have certain fields. Below is a useful command to run to get that answer.

Command: index="botsv3" hash | stats count by sourcetype | sort -count

The above command will return all the source types that have the field 'hash' and the number of events per source type and sorted from largest to smallest.

Before you begin, get a lay of the land.

Command: | tstats count where index="botsv3" by sourcetype

Be aware when you are running a search query that you're not Event Sampling. This can throw off your results.

You can read more about this concept here.

AWS & other events

In this task, you'll focus on AWS-related events with some questions focusing on endpoint-related events.

The questions below are from the 200 series of the BOTSv3 dataset.

Question 1

You're tasked to find the IAM (Identity & Access Management) users that accessed an AWS service in Frothly's AWS environment.

Refer to the following link to get an idea of what source type you need to query and what field in the results will have the answer you're seeking.

Link: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-examples.html

Question 2

The following links are provided to help you with this question.

Links:

Make sure you exclude events related to console logins.

It might be a good idea to do a keyword search query on this one. Don't forget to surround the keyword with asterisks.

Question 3

Look at the source types available in the dataset. There might be one in particular that holds information on hardware, such as processors.

Questions 4-6

A common misconfiguration involving AWS is publically accessible S3 buckets. Read the following resource to understand ACLs and S3 buckets.

Link: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html

Question 7

You're tasked with identifying a text file uploaded to the S3 bucket. Here is a link for more information related to this topic.

Link: https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html

Since you know the name of the S3 bucket, you should easily find the answer to this question.

You will need to query a different AWS-related source type. HTTP status code might be helpful as well.

Question 8

What keywords can you start your search with to help identify what data sources can help you with this?

One of the fields within this source type clearly has the answer, but which is it?

Perhaps expanding upon your search to count on the operating systems and hosts will be helpful.

Answer the questions below

List out the IAM users that accessed an AWS service (successfully or unsuccessfully) in Frothly's AWS environment? Answer guidance: Comma separated without spaces, in alphabetical order. (Example: ajackson,mjones,tmiller)

Use aws:cloudtrail as the source type.

btoll,btun,splunk_access,web_admin

What field would you use to alert that AWS API activity has occurred without MFA (multi-factor authentication)? Answer guidance: Provide the full JSON path. (Example: iceCream.flavors.traditional)

Use aws:cloudtrail as the source type.

userIdentity.sessionContext.attributes.mfaAuthenticated

What is the processor number used on the web servers? Answer guidance: Include any special characters/punctuation. (Example: The processor number for Intel Core i7-8650U is i7-8650U.)

Use hardware as the source type for hardware information such as CPU statistics, hard drives, network interface cards, memory, and more.

E5-2676

Bud accidentally makes an S3 bucket publicly accessible. What is the event ID of the API call that enabled public access? Answer guidance: Include any special characters/punctuation.

Use aws:cloudtrail as the source type. In case you get two events, compare the total event output between the two, and focus on the event that grants rights to "all users".

ab45689d-69cd-41e7-8705-5350402cf7ac

What is Bud's username?

bstoll

What is the name of the S3 bucket that was made publicly accessible?

Use aws:cloudtrail as the source type.

*frothlywebcode *

What is the name of the text file that was successfully uploaded into the S3 bucket while it was publicly accessible? Answer guidance: Provide just the file name and extension, not the full path. (Example: filename.docx instead of /mylogs/web/filename.docx)

Use aws:s3:accesslogs.

OPEN_BUCKET_PLEASE_FIX.txt

What is the FQDN of the endpoint that is running a different Windows operating system edition than the others?

Start with winhostmon as the source type.

BSTOLL-L.froth.ly

Cryptomining events

Within this task, the questions are mostly focused on an endpoint browser and cryptomining events.

The questions below are from the 200 series of the BOTSv3 dataset.

Questions 1-2

Again you're tasked to retrieve processor information, but this time it involves processor utilization.

Try some keywords related to processors and look at the available source types returned.

Start a new search query with the source type and look at the available fields.

Remember, you're looking for endpoints with 100% CPU utilization. Don't forget to reverse the order of the events.

Questions 3-6

You've already provided the source type. Look at the fields you wish to display in a table format and sort the events by time (sort + _time).

Below is a link to help you with Splunk event order functions.

Link: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventorderfunctions

You'll be able to answer all the remaining questions from the events returned from this query. :)

Answer the questions below

A Frothly endpoint exhibits signs of coin mining activity. What is the name of the second process to reach 100 percent CPU processor utilization time from this activity on this endpoint? Answer guidance: Include any special characters/punctuation.

Try Event Sampling with value 1:10 to perform an initial query, in case your query results in error or gets auto-cancelled. https://docs.splunk.com/Documentation/WindowsAddOn/8.0.0/User/SourcetypesandCIMdatamodelinfo

chrome#5

What is the short hostname of the only Frothly endpoint to actually mine Monero cryptocurrency? (Example: ahamilton instead of ahamilton.mycompany.com)

Focus on the browser from question #1.

BSTOLL-L

Using Splunk's event order functions, what is the first seen signature ID of the coin miner threat according to Frothly's Symantec Endpoint Protection (SEP) data?

The WinEventLog:Application source is helpful, as is the symantec:ep:security:file source type.

30358

What is the name of the attack?

JSCoinminer Download 8

According to Symantec's website, what is the severity of this specific coin miner threat?

You'll need to refer to an online resource for this.

Medium

What is the short hostname of the only Frothly endpoint to show evidence of defeating the cryptocurrency threat? (Example: ahamilton instead of ahamilton.mycompany.com)

Inspect the event from question 3 in detail.

BTUN-L

More AWS events

You'll return your focus to AWS-related events with some questions focusing on email-related events in this task.

The questions below are from the 200 series of the BOTSv3 dataset.

Question 1

You're tasked to identify which IAM user access key generates the most distinct errors when attempting to access IAM resources.

You should have an idea of which source type you'll need to query.

The question is, which field or fields you need to expand your query?

Below are links to aid you in this task.

Link:

Don't forget to surround the keyword with asterisks.

Questions 2-3

With the right source type and keyword, this event should jump right out at you, literally. You got this. :)

Question 4

The IAM user access key from question 1 will be helpful in this query.

After the results are returned, look at the fields that are available to you. With this field, expand on the query.

A link to help you with this task is below.

Link: https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html

Question 5

The same IAM user access key, and a username, can help you here.

Use the event from the previous question to get the additional information needed, which is the username.

Answer the questions below

What IAM user access key generates the most distinct errors when attempting to access IAM resources?

Use aws:cloudtrail as the source type.

AKIAJOGCDXJ5NW5PXUPA

Bud accidentally commits AWS access keys to an external code repository. Shortly after, he receives a notification from AWS that the account had been compromised. What is the support case ID that Amazon opens on his behalf?

Use stream:smtp as the source type.

5244329601

AWS access keys consist of two parts: an access key ID (e.g., AKIAIOSFODNN7EXAMPLE) and a secret access key (e.g., wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). What is the secret access key of the key that was leaked to the external code repository?

External code repo.

Bx8/gTsYC98T0oWiFhpmdROqhELPtXJSR9vFPNGk

Using the leaked key, the adversary makes an unauthorized attempt to create a key for a specific resource. What is the name of that resource? Answer guidance: One word.

Use aws:cloudtrail as the source type.

nullweb_admin

Using the leaked key, the adversary makes an unauthorized attempt to describe an account. What is the full user agent string of the application that originated the request?

Use aws:cloudtrail as the source type.

ElasticWolf/5.1.6

Pivoting back to endpoint events

In this task, you'll focus on email-related and endpoint-related events.

The questions below are from the 300 series of the BOTSv3 dataset.

Question 1

You're tasked to find the user agent that uploaded a malicious link file to OneDrive. You already know you have a source of antivirus; maybe that is a good place to start. Another starting point is Office 365. You might want to start there instead.

You know a file was uploaded, and you know its file extension. You have all you need. :)

Question 2

Now you're searching for a macro-enabled attachment. What file extensions are associated with macro-enabled documents?

You're looking for attachments, so you know you're looking for email-related events.

When using keywords, don't forget to use asterisks. I'm happy to say you should have this one too. :)

Question 3

This is picking up from the previous question. Once you discovered the attachment, you'll have the information you need to move forward with this question.

Careful of the source type that you use. Using the file extensions for macro-enabled documents will be useful here.

After the query executes, look at the fields closely, the answer might be there.

Question 4

Knowledge of Linux is needed for this. What commands are associated with creating accounts? In logs, how is the root user identified?

The answers to these questions will prove useful when constructing your search query.

You might be able to find the answer without an explicitly defined source type in your query. Search the returned events carefully.

Questions 5-6

The same principles apply to this question, but you don't know if the endpoint is Windows or Linux. Using very generic keywords might be wise here.

The amount of returned events will be fairly large. It would help if you expanded your search query by excluding source types that you are confident are not relevant to your search.

You should be able to move from here and answer the next question. :)

Question 7

The word "leet" is noted. What are numerical values associated with this phrase?

The amount of returned events might be a bit much. Another keyword might be useful to add to your search to help shrink the number of events returned. What about these numerical values are you searching for?

Question 8

Some useful bits of information for this task: Fyodor's machine name and an event code associated with network connections.

The number of returned events will be large, but the unusual binary pops right at you by inspecting the available fields.

Answer the questions below

What is the full user agent string that uploaded the malicious link file to OneDrive?

Use ms:o365:management as the source type for OneDrive activity.

Mozilla/5.0 (X11; U; Linux i686; ko-KP; rv: 19.1br) Gecko/20130508 Fedora/1.9.1-2.5.rs3.0 NaenaraBrowser/3.5b4

What was the name of the macro-enabled attachment identified as malware?

Use stream:smtp as the sourcetype and look for alerts about malicious attachments.

Frothly-Brewery-Financial-Planning-FY2019-Draft.xlsm

What is the name of the executable that was embedded in the malware? Answer guidance: Include the file extension. (Example: explorer.exe)

Use XmlWinEventLog:Microsoft-Windows-Sysmon/Operational as the source type.

HxTsr.exe

What is the password for the user that was successfully created by the user "root" on the on-premises Linux system?

Osquery is logging command executions on the Linux host hoth.

ilovedavidverve

What is the name of the user that was created after the endpoint was compromised?

Use WinEventLog:Security as the source type.

svcvnc

Based on the previous question, what groups was this user assigned to after the endpoint was compromised? Answer guidance: Comma separated without spaces, in alphabetical order.

Use WinEventLog:Security as the source type.

Administrators,User

What is the process ID of the process listening on a "leet" port?

Osquery is logging open ports found on the Linux host hoth.

14356

What is the MD5 value of the file downloaded to Fyodor's endpoint system and used to scan Frothly's network?

Sysmon provides hash values when processes are executed. Figure out what EventCode you need to look at for that.

586EF56F4D8963DD546163AC31C865D7

More endpoint events

In this task, you're focused on events that have mostly occurred on the endpoint.

The questions below are from the 300 series of the BOTSv3 dataset.

Question 1 & 2

A lot of malicious activity has occurred on Fyodor's endpoint. You can start your search with his host.

Downloads can involve various protocols: HTTP, TCP, FTP, etc. Depending on the protocol, you might need to add an operation, such as FTP & RETR.

If you go this route, the suspected port should be noticeable in the Available Fields.

There are a couple of different paths you can take for this question.

Question 3

This one might take some work. You're provided with a starting point, /tmp directory. Don't forget the asterisks, /tmp/*.*.

Review the data returned; you'll need to exclude source types to help narrow down the search.

Additionally, add a keyword to help shrink the returned results even further.

There are a few suspect files. Two of them, in particular, are the correct answer.

Question 4

An email was sent to Grace Hoppy. Honestly, you have enough here to find this answer. :)

The question lies on what source type to include or exclude in your search query.

Question 5-6

Tackling this one will require some work too. To point you in the right direction, PowerShell Logging & some decoding will help you with this one.

Once you've found the events with the attacker payloads, you'll have enough to build a search query for question #6.

Answer the questions below

What port number did the adversary use to download their attack tools?

Use XmlWinEventLog:Microsoft-Windows-Sysmon/Operational as the source type.

3333

Based on the information gathered for question 1, what file can be inferred to contain the attack tools? Answer guidance: Include the file extension.

Use stream:http as the source type.

logos.png

During the attack, two files are remotely streamed to the /tmp directory of the on-premises Linux server by the adversary. What are the names of these files? Answer guidance: Comma separated without spaces, in alphabetical order, include the file extension where applicable.

Osquery is performing FIM on certain directories on the Linux host hoth.

colonel.c,definitelydontinvestigatethisfile.sh

The Taedonggang adversary sent Grace Hoppy an email bragging about the successful exfiltration of customer data. How many Frothly customer emails were exposed or revealed?

Use stream:smtp as the source type.

8

What is the path of the URL being accessed by the command and control server? Answer guidance: Provide the full path. (Example: The full path for the URL https://imgur.com/a/mAqgt4S/lasd3.jpg is /a/mAqgt4S/lasd3.jpg)

Start with XmlWinEventLog:Microsoft-Windows-Sysmon/Operational as the source type, or review the PowerShell logging on various Frothly laptops.

/admin/get.php

At least two Frothly endpoints contact the adversary's command and control infrastructure. What are their short hostnames? Answer guidance: Comma separated without spaces, in alphabetical order.

Start with XmlWinEventLog:Microsoft-Windows-Sysmon/Operational as the source type.

ABUNGST-L,FYODOR-L

Conclusion

Within this room, you tackled a lot of the questions from the BOTSv3 data set.

Security Operations Center (SOC) is a team of IT security professionals tasked with monitoring, preventing , detecting , investigating, and responding to threats within a company’s network and systems.

Thus far, Splunk has held a Boss of the SOC competition since its inception. Read about last year's event here.

Mastering Splunk-fu takes practice, as with anything, and that was the overall objective of creating this room.

The paths hinted at in this room are not the absolute way to solve the questions.

You might discover clever ways to come to the same conclusion, and that will be awesome.

There is a lot of data in the dataset that wasn't touched on. Feel free to explore to see what else you can find.

You're encouraged to download the dataset into a local Splunk instance and give a go at the other questions within the dataset.

Answer the questions below

You leveled up your Splunk-fu thanks to the BOTSv3 dataset.

[[Tempus Fugit Durius]]

PreviousGoldenEyeNextTempus Fugit Durius

Last updated

Was this helpful?