Benign | TryHackMe — Walkthrough

Task 1: Introduction

We will investigate host-centric logs in this challenge room to find suspicious process execution. To learn more about Splunk and how to investigate the logs, look at the rooms splunk101 and splunk201.

Room Machine

Before moving forward, deploy the machine. When you deploy the machine, it will be assigned an IP. Access this room via the AttackBox, or via the VPN at MACHINE_IP. The machine will take up to 3-5 minutes to start. ll the required logs are ingested in the index win_eventlogs.

Room link for Benign .

1.1 Connect with the lab.

For this room, launch the Machine using the green icon and either start the AttackBox to connect or loadup your VPN.

Task 2: Scenario: Identify and Investigate an Infected Host

One of the client’s IDS indicated a potentially suspicious process execution indicating one of the hosts from the HR department was compromised. Some tools related to network information gathering / scheduled tasks were executed which confirmed the suspicion. Due to limited resources, we could only pull the process execution logs with Event ID: 4688 and ingested them into Splunk with the index win_eventlogs for further investigation.

About the Network Information

The network is divided into three logical segments. It will help in the investigation.

IT Department

• James
• Moin
• Katrina

HR department

• Haroon
• Chris
• Diana

Marketing department

• Bell
• Amelia
• Deepak

Questions :

2.1 How many logs are ingested from the month of March, 2022?

Nice little warm-up to make sure we’re awake. Set the date range appropriately:

Answer is in the this blurred place.

2.2 Imposter Alert: There seems to be an imposter account observed in the logs, what is the name of that user?

If we just click on the field ‘UserName’ we’ll see 10/11 results and nothing looks amiss, let’s get the extra name:

index=win_eventlogs 
| top limit=11 UserName

The answer is in the this blurred place.

2.3 Which user from the HR department was observed to be running scheduled tasks?

I found this by running the following command, there will be a better way but I’m not experienced enough in Splunk to get it and all the EventIDs are the same for this

index=win_eventlogs schtasks

From here I sorted by the “CommandLine” field which made it pretty obvious as there’s only 5 commands:

The answer is in the this blurred place.

2.4 Which user from the HR department executed a system process (LOLBIN) to download a payload from a file-sharing host.

I found this pretty easily this time by going to the CommandLine and displaying rare values:

The query for this is:

index=win_eventlogs HostName="*HR*"| rare limit=20 CommandLine

This looks a lot like what we’re looking for. We see the lolbin they used, certutil. We see a file, “benign.exe” and a c2 server it’s reaching out to:

Searching by it gives us one result:

The answer is in the this blurred place.

2.5 To bypass the security controls, which system process (lolbin) was used to download a payload from the internet?

We answered this with the previous question:

The answer is in the this blurred place.

2.6 What was the date that this binary was executed by the infected host? format (YYYY-MM-DD)

Also answered in question 2.4

The answer is in the this blurred place.

2.7 Which third-party site was accessed to download the malicious payload?

Also answered in 2.4…

The answer is in the this blurred place.

2.8 What is the name of the file that was saved on the host machine from the C2 server during the post-exploitation phase?

Noticing a pattern?

The answer is in the this blurred place.

2.9 The suspicious file downloaded from the C2 server contained malicious content with the pattern THM{……….}; what is that pattern?

Grab the flag from the site:

The answer is in the this blurred place.

2.10 What is the URL that the infected host connected to?

Again, reference question 2.4:

The answer is in the this blurred place.

Thank you for reading! I hope this guide has been helpful in understanding. I made this write-up special for TryHackMe , special thanks to https://medium.com/@jcm3 . Follow and clap to support me and him.