Benign | TryHackMe — Challenge | Writeup — Splunk-Investigation

hey all , hope you are doing well, in this write up we will cover the fifth room on the SIEM Triage for soc module in the soc level 1 path on try hack me

link for the room : https://tryhackme.com/room/benign

description : Challenge room to investigate a compromised host.

Task 1- Introduction

Lab access : click on the green start machine button to deploy your machine to start the investigation

this well start the splunk machine that we are gonna be dealing with inside the attack box

you can start the attack box by hitting (start attack box) button in the very top as shown

to enter to splunk you will need to copy the target ip address and then enter it on firefox in the attack box as shown below :

Task 2- Scenario: Identify and Investigate an Infected Host

About the Network Information

The network is divided into three logical segments. It will help in the investigation.

IT Department

• James
• Moin
• Katrina

HR department

• Haroon
• Chris
• Diana

Marketing department

• Bell
• Amelia
• Deepak

Q1- How many logs are ingested from the month of March, 2022?

nice warming up question , to get the logs you will first click on search and reporting as shown :

for the next step we need to enter index=* in the search bar , it basically means that we are selecting all the log files ingested in splunk which is only (win_eventlogs) in our situation , next we need to edit the date range to be 1st of march 2022 , you can do this by clicking on the time range in the very right of the search bar and then click the fourth option (date range) and then edit the first input to be 1st of march 2022 and click apply and we can see that there is 13959 logs appeared

ANS: 13959

Q2- Imposter Alert: There seems to be an imposter account observed in the logs, what is the name of that user?

for this one since we already know the legit usernames within our network i clicked on the username field and i found that there is one more user mimicking Amelia from the marketing department .. and here is the steps for the result we got

we clicked on top values but it can also be solved by clicking on rare values since there is only 11 values and the one we are looking for is not in the top 10 in front of us ..

ANS: Amel1a

Q3- Which user from the HR department was observed to be running scheduled tasks?

Rather than overcomplicating the search, I kept it simple — searching for the keyword schtasks across all logs. Splunk returned all relevant events tied to scheduled task activity. From there, I used the username field filter in the sidebar to identify who was behind the activity. The user from the HR department was chris.fort

ANS: chris.fort

Q4- Which user from the HR department executed a system process (LOLBIN) to download a payload from a file-sharing host.

Knowing that the question pointed to a LOLBIN being used for downloading, I started with one of the most commonly abused Windows binaries — searching simply for certutil in Splunk. The results immediately surfaced a suspicious command line entry showing certutil being used to pull a payload from a file sharing host — something far outside its legitimate purpose of certificate management.

Certutil is one of the most abused LOLBINs in the book — built into every Windows machine and trusted by the OS, yet perfectly capable of downloading and decoding malicious files.

ANS: haroon

Q5- To bypass the security controls, which system process (lolbin) was used to download a payload from the internet?

This question was already answered during the previous step — the certutil search had already exposed the full picture. The system process used to bypass security controls and download the payload was **certutil.exe**

ANS: certutil.exe

Q6- What was the date that this binary was executed by the infected host? format (YYYY-MM-DD)

Returning to the certutil search results, the time field in Splunk logged the exact timestamp of the execution.

ANS: 2022–03–04

Q7- Which third-party site was accessed to download the malicious payload?

Once again the certutil search results had the answer — the CommandLine field revealed the full command executed as shown below :

ANS: controlc.com

Q8- What is the name of the file that was saved on the host machine from the C2 server during the post-exploitation phase?t

again The CommandLine field continued to give up answers — at the end of the certutil command, the filename of the downloaded payload was clearly visible

ANS: benign.exe

Q9- The suspicious file downloaded from the C2 server contained malicious content with the pattern THM{……….}; what is that pattern?

Following the download URL recovered from the certutil command directly in the browser led me straight to the hosted file. No additional tools needed — the content was completely exposed, containing the flag

ANS: THM{KJ&*H^B0}

Q10- What is the URL that the infected host connected to?

The full URL was already captured in the CommandLine field from the original certutil search

ANS: https://controlc.com/e4d11035

Honestly this one was really enjoyable. when I first saw “Windows logs in Splunk” I thought it was going to be a nightmare to navigate, but it turned out to be way simpler than I expected. The moment I found that certutil log it was basically game over — almost everything I needed was sitting right there in one single entry. That was really satisfying .

stay tuned for the next write ups coming in line :)