LOG ANALYSIS — sysmon(btlo)

What is Sysmon? Sysmon (System Monitor) is a free, advanced Windows system service and device driver from Microsoft’s Sysinternals suite that provides deep, granular, and persistent monitoring of system activity.

For a SOC analyst, endpoint visibility is important. While Windows provides default logging, it is often not sufficient for detailed investigations. Default logs may not capture critical events, such as process creation which is essential for thorough investigations.

For this lab i have set up ~Splunk(docker) and sysmon logs(btlo)

1.What is the file that gave access to the attacker?

we search for event id 1 seeing what new processes are being created and then filter it by stats count by command to filter for commandline sourcetype.This shows us which process was being created. we see that updater.hta is suspicious to be sure we will see if it has any ther child processes and look for data exfiltration.

2.What is the powershell cmdlet used to download the malware file and what is the port?

To find this we will see event id 1 for process creation and search for command line “powershell” because we know that the command comes from there. we see that invole webrequest is downloading malicious files and then again we will use the previous command and see what invoke webrequest uses 6969 port.

3.What is the name of the environment variable set by the attacker?

in this we will search for commandline “exe” or “set” we see that the attacker set environment to supply.exe

4.What is the process used as a LOLBIN to execute malicious commands?

Common examples of LOLBINs include PowerShell, cmd.exe, ftp.exe, and wscript.exe, which are integral to the operating system.In this case it could be powershell.exe or ftp.exe, because all malicious activity was started with powershell command it also downloads malicious file from internet like supply.exe, but in some instances of supply.exe the parent process is ftp.exe. the correct answer according to the lab is ftp.exe

6.Looking at the dependency events around the malware, can you able to figure out the language, the malware is written

Using stats count by command for eventdata.targetfilename and see that the processes are executed in python language.

7.Malware then downloads a new file, find out the full url of the file download

By searching for eventdata.commandline we get that invoke webrequest is downloading a file using supply.exe environment that was set earlier.

8.What is the port the attacker attempts to get reverse shell?

Reverse shell mean when attacker establishes a backdoor connection from the infected system to the attacker’s Command and Control (C2) server, enabling the attacker to execute commands on the infected machine and potentially exfiltrate sensitive information. using the stats count by command data we see that its trying to create backdoor connection to 9898