TryHackMe Splunk 2 Explained Walkthrough . SOC L1 path .

In this article i will be sharing investigation process of Splunk2 . I have not done this before will be the first time to see the case , additionally i will be giving common tricks to make investigations more precisely and easier . In TryHackMe you already have the answers and methodology but i will make it easier for the new SOC analysts .

First of all we need to declare what we have and what are the EOI(Event Of Interest) for us . Below command shows you the indexes and the count of logs they have . Since it has been mentioned botsv2 is the index we won’t need it but you may need it in real time investigations .

*| eventcount summarize=false index= | stats sum(count) as event_count by index | sort -event_count**

I’m leaving the formula here to do the same for the other filters . index=main | stats count by host(it could be src_ip , dst_ip ….) | sort -count

100series questions

Question 1 Amber Turing was hoping for Frothly to be acquired by a potential competitor which fell through, but visited their website to find contact information for their executive team. What is the website domain that she visited?

So far we know : index=”botsv2" amber . It brings 500/500 events . In order to reduce the number of the logs we should add some specific filters (src_ip , dst_ip , ports ,host …. ) since it has been a request from client to server there will be 1 source IP making connection to another IP ( destination , websites ) we have to find them . Now we have more than 22 source IPs . We have to look for something common then to find the specific filter . They have already given the sourcetype=pan:traffic . Cause this source type includes:

• Source and destination IP addresses
• Port numbers
• Protocol (TCP/UDP)
• App-ID (Palo Alto’s application identification)
• Action taken (e.g., allow, deny)
• Bytes sent/received
• Session duration
• NAT info

In the first 20 logs (most recent 20 logs ) most of the sourcetype is pan .

Now we have only 1 source ip(10.0.2.101) which belongs to Amber . Amber has visited their website(sourctype=stream:http) we already have Amber’s IP we do not need to keep it in the filter anymore . As Jonathan Ham always tells : attention to the detail . Frothly (a beer company) , we are gonna look for a domain which has “beer” or something like that . index=”botsv2" 10.0.2.101 sourcetype=”stream:http” | dedup site _time | stats count by site | sort -count

Here is my filter , i’m requesting for the botsv2 logs which is associated with 10.0.2.101 IP and sourctype is HTTP(Remember Amber visited the website ) , then i’m telling splunk not to show duplicates (dedup) , show me the sites according to their log count ( stats count by site ) and sort the logs according to the count of their logs(sort -count ) .

As i said i only care about beer company .

Answer: www.berkbeer.com

Question2

Amber found the executive contact information and sent him an email. What image file displayed the executive’s contact information? Answer example: /path/image.ext

Attention to the detail IMAGE FILE (.img or .png or .jpeg)

index=”botsv2" 10.0.2.101 sourcetype=”stream:http” berkbeer.com | table _time uri_path Since we already have the website we can use it to reduce the number of logs . A uri_path indicates the specific path portion of an HTTP request, showing which resource or page was accessed on the web server . We made a table of it and saw only 12 of events and 1 related to the company . Answer: /images/ceoberk.png

Question3

What is the CEO’s name? Provide the first and last name.

We can find it with email , email? seems like a smtp protocol since we are the sender . Most of the companies put the email with the same domain as website ( support@tryhackme.com)

index=”botsv2" sourcetype=”stream:smtp” berkbeer.com Now we have 6 logs and we have to look for anomaly , let’s check the content body .

It doesn’t give us the direct answer but it shows we are close to the answer . Let’s check the response mails to see if we get anything .

Below there is an html script we can use an online html compiler to get the same result as Amber had gotten .

Answer: Martin Berk

Question4:

What is the CEO’s email address?

Just check the same logs and you will see different senders , since you know the name of the CEO it won’t be a problem for you to find it .

Answer: mber@berkbeer.com

Question5 After the initial contact with the CEO, Amber contacted another employee at this competitor. What is that employee’s email address?

Check the timleine of the first contact with the CEO and the log afterwards from another sender .

There is almost 5 minutes difference between them.

Answer: hbernard@berkbeer.com

Question6 What is the name of the file attachment that Amber sent to a contact at the competitor?

Just keep filter the same and look for the emails that Amber has sent and check attach_filename in filter .

Answer: Saccharomyces_cerevisiae_patent.docx

Question7

What is Amber’s personal email address?

We have declared Amber has been chatting with Bernard . So change the filter to Bernard’s name and look for the logs and check the timelines . index=”botsv2" sourcetype=”stream:smtp” hbernhard@berkbeer.com In 1 of the emails Bernard has sent there is a text message asking for Amber’s personal email . The next email from Amber will be our answer.

8/29/17 11:08:20.962 AM From hbernhard@berkbeer.com

Make sure to check content .

IT has been encoded so we are gonna decode it from UTF-8 to base64 .

Answer: ambersthebest@yeastiebeastie.com

200 series Questions Question1

What version of TOR Browser did Amber install to obfuscate her web browsing? Answer guidance: Numeric with one or more delimiter. They have already given the basic filter : index=”botsv2" amber tor which shrinks logs to 325 means we are close to answer . So i first checked http stream and http_user_agent but i could not find any satisfying result so decided to make the filter more simpler . index=”botsv2" tor amber install : i’m just trying to get the pieces from the question and i got 125 logs which similiar and every log has install and the number . It shows 7.0.4 at every log but to make sure we will sort it according to time and in descending order to see the first event 1st (| sort -_time desc). Final filter: index=”botsv2" tor amber install | sort -_time desc Answer: 7.0.4

Question2 What is the public IPv4 address of the server running www.brewertalk.com?

We have the index , website and the sourcetype will be http . then we will be checking src_ip and dest_ip to see the public IPs .

If you wanna just find the flag then you can brute-force it but if you are making investigation you should eliminate the IPs according to your networking knowledge . The best way to do that is DNS , it is a website and it is asking for the Public IP . We can just change http with dns index=”botsv2" www.brewertalk.com sourcetype=”stream:dns” src_ip and dest_ip are internal now but we need the Public IP . Here is another filter host_addr (indicates the IP of a machine ) since there is only 1 of them we won’t be using any keyword to reduce logs.

Answer : 52.42.208.228

Question3 Provide the IP address of the system used to run a web vulnerability scan against www.brewertalk.com.

Attention to the detail it is a web vulnerability scan . It will have the most logs and http will be the sourcetype . Let’s go back to the filter i offfered for CTF players to use brute-force on it . Check the source IP cause it is a scan . index=”botsv2" www.brewertalk.com sourcetype=”stream:http”

Answer: 45.77.65.211

Question4 The IP address from Q#2 is also being used by a likely different piece of software to attack a URI path. What is the URI path? Answer guidance: Include the leading forward slash in your answer. Do not include the query string or other parts of the URI. Answer example: /phpinfo.php The IP in the 2nd question is 52.42.208.228 and we have the index . In the question 2 we found the internal IP of the server ( the dest IP with the most log was the internal IP of the server cause there has been a web scan 172.31.4.249 ) . Well they literally have made social engineering by telling Q2’s IP address cause i tried the filter with it but didn’t even get a single log, he may have miswrite it . Since the scan had been with 45.77.65.211 i changed IP to it . index=”botsv2" src_ip=”45.77.65.211" dest_ip=172.31.4.249 Check the uri path

A .php is a script extension and most likely a way to use in an attack . It is an observation that member.php is used in attack cause others used at least 4 times less than that . Answer: member.php

Question5 What SQL function is being abused on the URI path from the previous question?

Keep the filter the same and add SQL . index=”botsv2" src_ip=”45.77.65.211" dest_ip=172.31.4.249 uri_path=”/member.php” SQL | table _time form_data Form Data contains the key-value pairs submitted by the user through an HTML form. Think of it as user output . I have a little bit SQL knowledge i thought the answer is selection cause i saw it in every log but made some search and saw SELECT is NOT a function . The other common thing in the log is updatexml , you can send a few logs to GPT and get answer easier . Answer: updatexml