Splunk 3 Walkthrough — TryHackMe Lab

Task 1: AWS & Other Events

What is this task about?

This task focuses on analyzing AWS-related events from the BOTSv3 dataset using Splunk. It involves investigating IAM user activity, cloud misconfigurations (like public S3 buckets), and identifying endpoint anomalies. The goal is to develop skills in detecting suspicious behavior and misconfigurations in a cloud environment.

Tools and Concepts Covered

• Splunk SPL (Search Processing Language)
• AWS CloudTrail logs
• S3 access logs
• Windows host monitoring logs
• Incident detection and investigation
• IAM user tracking
• Cloud misconfiguration analysis

Q1: List IAM users that accessed an AWS service

Answer: bstoll,btun,splunk_access,web_admin

Query Used:

sourcetype="aws:cloudtrail"

→ Identified active IAM users in Frothly’s AWS environment.

Q2: What field shows API activity without MFA?

Answer: userIdentity.sessionContext.attributes.mfaAuthenticated

**Query Used: **Same as Q1.

→ This JSON path shows whether MFA was used during AWS API calls.

Q3: What is the processor number used on the web servers?

Answer: E5-2676

Query Used:

sourcetype="hardware"

→ Gathered processor details from system inventory.

Q4: Event ID of the API call that enabled S3 public access

Answer: ab45689d-69cd-41e7-8705-5350402cf7ac

Query Used:

sourcetype="aws:cloudtrail" eventType=AwsApiCall eventName=PutBucketACL

→ Found two events, and selected the first one from the bottom.

Q5: What is Bud’s username?

Answer: bstoll

Query Used:

sourcetype="aws:cloudtrail" eventType=AwsApiCall eventName=PutBucketACL

→ Same query as Q4; identified the user who made the S3 bucket public.

Q6: What is the name of the public S3 bucket?

Answer: frothlywebcode

*Query Used: *Same as Q5.

→ Extracted the bucket name from the same event as Q4 and Q5.

Q7: Name of the file uploaded while the bucket was public

Answer: OPEN_BUCKET_PLEASE_FIX.txt

Query Used:

sourcetype="aws:s3:accesslogs" bucket_name=frothlywebcode *PUT*

→ Used "PUT" keyword after asking ChatGPT for help. It helped narrow down the correct event.

Q8: FQDN of the endpoint with a different Windows OS edition

Answer: BSTOLL-L.froth.ly

Query Used:

sourcetype="winhostmon" source=operatingsystem
| dedup host
| table host os

→ This revealed the inconsistent system: BSTOLL-L.froth.ly

Follow-up Query Used:

sourcetype="wineventlog" BSTOLL-L

→ Got this SPL recommendation from ChatGPT to dig deeper into the Windows logs of BSTOLL-L.

Task 4: Cryptomining Events

What is this task about?

This task focuses on detecting cryptomining activity on Frothly’s network by analyzing system performance logs and Symantec Endpoint Protection (SEP) data. It includes identifying CPU-intensive processes, infected endpoints, and security event signatures related to Monero cryptocurrency mining.

Tools and Concepts Covered

• Splunk SPL (Search Processing Language)
• Endpoint performance monitoring (perfmonmk:process)
• Symantec Endpoint Protection logs (symantec:ep:security:file)
• CIDS Signature IDs
• Event ordering in SPL
• Online threat intelligence referencing
• Cryptomining threat detection and mitigation

Q1: Name of the second process to reach 100% CPU

Answer: chrome#5

Query Used:

sourcetype="perfmonmk:process" process_cpu_used_percent=100
| table _time host process_name process_cpu_used_percent

→ I asked ChatGPT for guidance, and it suggested using perfmonmk:process as the relevant sourcetype.

→ Identified as the second CPU-intensive process linked to mining.

Q2: Short hostname of the endpoint that mined Monero

Answer: BSTOLL-L

**Query Used: **Same as Q1.

→ Used the same query to identify the host linked to mining activity.

→ This endpoint showed direct mining behavior.

Q3: First seen signature ID of the coin miner threat

Answer: 30358

Query Used:

sourcetype="symantec:ep:security:file"
| table _time CIDS_Signature_ID host

→ Used event ordering to determine the first detected signature ID.

Q4: What is the name of the attack?

Answer: JSCoinminer Download 8

**Query Used: **Same as Q3.

→ Used the same data set to correlate attack signatures.

→ Name extracted directly from SEP detection logs.

Q5: Severity of the coin miner threat

Answer: Medium

Method Used:

→ Hint indicated an external reference was needed. I asked ChatGPT, which confirmed the severity as listed on Symantec’s official threat database.

Q6: Short hostname of the endpoint that defeated the threat

Answer: BTUN-L

**Query Used: **Same as Q3.

→ Used SEP logs to identify remediation activity.

→ Endpoint showed evidence of successfully mitigating the mining threat.

Task 5: More AWS Events

What is this task about?

This task focuses on analyzing AWS CloudTrail and email-related events. It emphasizes unauthorized access attempts, access key leakage, and tracing actions using specific identifiers such as access key IDs and user agents. The scenario revolves around a security breach following the accidental exposure of AWS credentials.

Tools and Concepts Covered

• Splunk SPL (Search Processing Language)
• AWS CloudTrail log analysis
• SMTP stream monitoring
• IAM security event tracking
• Access key and secret key exposure
• User Agent fingerprinting

Q1: IAM user access key that generated the most distinct errors

Answer: AKIAJOGCDXJ5NW5PXUPA

Query Used:

sourcetype="aws:cloudtrail" IAM errorCode!=success eventSource="iam.amazonaws.com"
| stats dc(errorMessage) by userIdentity.accessKeyId

Q2: What is the support case ID Amazon opened for the leaked key?

Answer: 5244329601

Query Used:

sourcetype="stream:smtp" AKIAJOGCDXJ5NW5PXUPA

→ This case ID was found in email logs after the credentials were detected as leaked.

Q3: What is the secret access key that was leaked?

Answer: Bx8/gTsYC98T0oWiFhpmdROqhELPtXJSR9vFPNGk

Query Used:

sourcetype="aws:cloudtrail" AKIAJOGCDXJ5NW5PXUPA

→ Found in logs where the leaked credentials were used.

Q4: Name of the resource for which an unauthorized key creation was attempted

Answer: nullweb_admin

Query Used:

sourcetype="aws:cloudtrail" AKIAJOGCDXJ5NW5PXUPA eventName=CreateAccessKey

→ This was the target resource involved in the unauthorized activity.

Q5: Full user agent string of the application used in the DescribeAccount request

Answer: ElasticWolf/5.1.6

Query Used:

sourcetype="aws:cloudtrail" AKIAJOGCDXJ5NW5PXUPA eventName=DescribeAccountAttributes

→ This identifies the client application used by the adversary.

Task 6: Pivoting Back to Endpoint Events

What is this task about?

This task focuses on correlating email activity, endpoint behavior, and security events, especially after a macro-enabled malware file was delivered, uploaded, and executed. It covers analysis across Microsoft 365 logs, Sysmon, Linux auth logs, and Windows Event Logs.

Tools and Concepts Covered

• Microsoft 365 File Upload logs
• Sysmon process execution
• Linux authentication logs
• Windows Security Event Log (EventCodes 4720, 4732, 1)
• OSQuery for network port usage
• Email stream analysis with Splunk
• Base64 decoding and malware tracing

Q1: Full user agent string that uploaded the malicious .lnk file to OneDrive

Answer: Mozilla/5.0 (X11; U; Linux i686; ko-KP; rv: 19.1br) Gecko/20130508 Fedora/1.9.1-2.5.rs3.0 NaenaraBrowser/3.5b4

Query Used:

sourcetype="ms:o365:management" "OneDrive" Operation=FileUploaded
| table _time src_ip user object UserAgent

I used “.Ink” in my search because the file appeared in logs with that casing. Splunk is case-insensitive, so it matched .lnk successfully.

Q2: Name of the macro-enabled malware attachment

Answer: Frothly-Brewery-Financial-Planning-FY2019-Draft.xlsm

Query Used:

sourcetype="stream:smtp" "attach_filename{}"="Malware Alert Text.txt"

I found a partial filename and decoded a base64 string linked to it. The filename originally appeared incomplete, but I identified it as a macro-enabled Excel file (.xlsm) through additional research.

Q3: Executable embedded in the malware

Answer: HxTsr.exe

Query Used:

sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" *xlsm*

Q4: Password of the Linux user created by “root.”

Answer: ilovedavidverve

Initial Query:

(adduser OR useradd) source="/var/log/auth.log"

I researched how to search for Linux user creation events and found one related entry. Then, I searched further for the password using:

Password Query:

tomcat7 sourcetype="osquery:results"

Q5: Username created after endpoint compromise

Answer: svcvnc

Query Used:

source="wineventlog:security" EventCode="4720"

Q6: Groups the compromised user was added to

Answer: administrators,user

Query Used:

source="wineventlog:security" svcvnc EventCode=4732

Q7: Process ID listening on a “leet” port

Answer: 14356

Leet Port Research: “leet” in hacker culture = 1337.

Query Used:

1337 sourcetype="osquery:results" "columns.port"=1337

Q8: MD5 hash of the malicious file used by Fyodor’s machine

Answer: 586ef56f4d8963dd546163ac31c865d7

Initial Query:

host="fyodor-l" sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| table app
| reverse

I chose EventCode=1 because it indicates a process creation, which helped trace the executed file.

Final Refined Query:

host="fyodor-l" sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 hdoor.exe

Task 7: More Endpoint Events

What is this task about?

In this task, I focused on detecting adversarial activity on endpoint systems, specifically around unusual file transfers, malicious downloads, PowerShell script execution, and command and control (C2) communications. This involved investigating Linux and Windows logs to identify file paths, ports, user behavior, and C2 domains.

Tools and Concepts Covered

• sourcetype="stream:http" for HTTP traffic analysis
• Linux file integrity monitoring (osquery:results)
• PowerShell logs via WinEventLog:Microsoft-Windows-PowerShell/Operational
• Regex extraction for URLs
• Log correlation across SMTP, HTTP, and endpoint logs
• Base64 analysis and file system paths
• Deduplication and reversing event order for timeline analysis

Q1: What port number did the adversary use to download their attack tools?

Answer: 3333

Query Used:

sourcetype="stream:http" dest_port=3333

Explanation:

I focused on HTTP traffic since downloads usually happen over HTTP. I filtered by rare destination ports and discovered a port 3333, which showed signs of file downloads and stood out as suspicious.

Q2: Based on the information gathered for question 1, what file can be inferred to contain the attack tools?

Answer: logos.png

Query Used: Same query as Q1

Explanation:

Reviewing the downloaded files over port 3333, I noticed logos.png being transferred. Despite its extension, this file was inferred to contain the attack tools.

Q3: What are the names of the two files streamed to the /tmp directory of the on-premises Linux server by the adversary?

Answer: colonel.c,definitelydontinvestigatethisfile.sh

Query Used:

earliest=0 /tmp/*.* sourcetype!=lsof NOT phpsessionclean sourcetype="osquery:results" name=pack_fim_file_events

Followed by:

earliest=0 colonel.c OR definitelydontinvestigatethisfile.sh OR loot.txt OR blargh.tgz OR suitecrm.sql | reverse

Explanation:

Initially, I tried to solve this independently, but after spending time researching, I referred to a write-up that helped me identify these two files being streamed to the /tmp directory.

Q4: How many Frothly customer emails were exposed or revealed in the adversary’s email to Grace Hoppy?

Answer: 8

Query Used:

sourcetype="stream:smtp" *Grace Hoppy* earliest=0 sourcetype!="ms:aad:signin"

Explanation:

I searched email logs mentioning “Grace Hoppy.” In one message, the attacker boasted about data exfiltration and included a link to Pastebin that revealed 8 customer emails.

Q5: What is the path of the URL being accessed by the command and control server?

Answer: /admin/get.php

Query Used:

index=botsv3 earliest=0 source="WinEventLog:Microsoft-Windows-PowerShell/Operational" Message!="PowerShell console*" Message="*/*"
| rex field=Message "\\$t\\=[\\'\\"](?<c2_uri>[^\\'\\"]+)"
| table c2_uri
| dedup c2_uri

Explanation:

After filtering noisy PowerShell logs, I noticed the script assigned a C2 URI to a variable. I used rex to extract it and revealed /admin/get.php as the full path being accessed.

Q6: At least two Frothly endpoints contacted the adversary’s C2 infrastructure. What are their short hostnames?

Answer: ABUNGST-L,FYODOR-L

Query Used:

"/news.php" OR "/login/process.php" OR "/admin/get.php"

Explanation:

I searched for common paths used in malicious C2 traffic and found /admin/get.php. From here, I identified the endpoints that communicated with this path, which were ABUNGST-L and FYODOR-L.

Walkthrough Complete 🥳🎉

Thank you for following this walkthrough! I hope you found it clear and helpful in completing the challenge.

If you enjoyed this guide, please consider sharing it with others who might be working on the same task!