TryHackMe Network Security Essentials Task 7 Perimeter Logs Investigating the Breach (SIEM Method)

**Before following this walkthrough, make sure you:

• Have a TryHackMe account
• Know how to connect to a TryHackMe room (via OpenVPN or AttackBox)
• Have started the “Network Security Essentials” room**

Prerequisite: Knowledge on log analysis.

Instructions: To proceed, open the link localhost:8000 in the browser, click on the Search & Reporting tab on the left bar, and start analyzing the logs. Logs are pre-ingested into the index=”network_logs”, as shown below:

Firewall Logs: firewall_logs WAF Logs: ids_logs VPN Logs: vpn_logs

The below is our assets for our scenario. We can use that as a reference.

Question 1:

Examine the firewall logs. What external IP performed the most reconnaissance?

Answer: 203.0.113.45

Explanations: Run the following command and you will know the answer.

index="network_logs" sourcetype=firewall_logs AND action="BLOCK" 
|  stats count by src_ip 
|  sort - count

Query explanations: stats count by src_ip: Aggregates the filtered events and produces a count of how many times each Source IP appears.

sort -count: Sorts the results in descending order by the count. Source IP with the highest number appear at the top.

Question 2:

In the firewall log, Which internal host was targeted by scans?

Answer: 10.0.0.20

Explanations: Run the following command and you will know the answer.

index="network_logs" sourcetype=firewall_logs AND action="BLOCK" 
|  stats count by dst_ip 
|  sort - count

Question 3:

Which username was targeted in VPN logs?

Answer: svc_backup

Explanations: Run the following command and you will know the answer.

index="network_logs" sourcetype="vpn_logs" 
| stats count by username 
|  sort -count

Question 4:

What internal IP was assigned after successful VPN login?

Answer: 10.8.0.23

Explanations:

Since, we known the effect account was svc_backup, so we will look for logs related to that account.

index="network_logs" sourcetype="vpn_logs" AND username="svc_backup"

From the logs, we see that after many FAIL attempts, the account: svc_backup was assigned an internal IP that was mentioned in the below screenshot.

Question 5:

Which port was used for lateral SMB attempts?

Answer: 445

Explanations:

SMB default port is 445. Also, from the ids_logs we can see port 445 being used for SMB lateral movement using the following query.

index="network_logs" sourcetype="ids_logs" AND alert="ET EXPLOIT Possible MS-SMB Lateral Movement"

Question 6:

In the IDS logs, which host beaconed to the C2?

Answer: 10.0.0.60

Explanations: Run the following command and you will know the answer.

index="network_logs" sourcetype="ids_logs" AND alert="ET TROJAN Possible C2 Beaconing"

Question 7:

During the investigation, which IP was observed to be associated with C2?

Answer: 198.51.100.77

Explanations: Run the following command and you will know the answer.

index="network_logs" sourcetype="ids_logs" AND alert="ET TROJAN Possible C2 Beaconing" 
| stats count by dst_ip 
|  sort -count

From the result shows only this IP is related to the C2 event.

Question 8:

Which host showed the exfiltration attempts?

Answer: 10.0.0.51

Explanations: Run the following command and you will know the answer.

index="network_logs" sourcetype="ids_logs" AND classification="Potential Data Exfiltration" 
|  stats count by src_ip 
|  sort -count

From the result shows only this IP is related to the exfiltration attempts .

For the same task using Linux CLI method please reference to my article for Linux CLI Method.