LetsDefend — Threat Hunting with Splunk

Make sure to upload the file on Sysmon.

What is the full path of the file that likely provided remote access?

So to find this, I filtered for the different Images.

We can immediately see one file that has 2 extensions, telling us that this is the malware.

Answer: C:\Users\LetsDefend\Downloads\application_form.pdf.exe

When was this file created on the disk?

So now is to filter for Event ID 11, since it is the “File Create” label for Sysmon.

Answer: 2024–06–06 09:24:18

What URL was the file downloaded from?

Now to filter for EventID 15, which is the capturing of a hash during a data stream. Like during when a file is downloaded from a browser.

Answer: http://13.232.55.12:8080/application_form.pdf.exe

What is the IP and port used for C2 Communication? Format (IP:PORT)

We can filter for EventID 3 for network conenctions.

Answer: 13.232.55.12:30

The trojan executed cmd and started a command prompt session. When did this activity occur?

EventID 1 for Process creations.

Answer: 2024–06–06 09:28:55

What was the second command executed by the attacker using the cmd session?

Now to copy the PID of the cmd session we had previously and try and find if any cmd session has a PPID of this PID.

Answer: tasklist

The attacker has added a new user to the system to establish persistent access. What is the username/password pair for the newly created account?

Since sysmon doesn’t really have an EventID for a new user being created lets just filter for EventID 1, and also include “net” since it usually is used when creating a new user on Windows.

Answer: jumpadmin:U7gk54skuvhs@1

The attacker downloaded a script for further post-exploitation. What is the full path to the script on the local system?

Now I just filtered for EventID 11 for any file creation from powershell or cmd.

Answer: C:\Windows\Temp\tmp.ps1

The logs also show Powershell activity. When did the attacker bypass the Powershell execution policy on the system?

Just added the word bypass to it.

Answer: 2024–06–06 09:42:08

To stop the attacker’s activity, our system administrator changed the firewall rules on the system immediately after the security team received an alert. What was the name of the rule that was added?

So what I did was I filtered for

but the thing is, it returned 71 events, so now I checked for the eventIDs that are present. It was 12 and 13.

So now 12 is for creating or deleting registry key, while 13 is for editing or adding a registry value. So we will focos on Event ID 13, since the adiminstrator “changed” a firewall rule.

The actual RuleName parameter doesn’t actually contain the rulename for the registry changes.

So looking at the Event.EventData.Details we can see the actual rule names. There is one that is called “secevent1” so I checked it.

And it was infact the rule for this task, since it is blocking the extrernal IP address that we found.

Answer: secevent1

What was the user context/permissions that enforced the policy/rule?

Answer: NT AUTHORITY\LOCAL SERVICE