BASIC SPLUNK 101 WALKTHROUGH TRYHACKME
Tags: Hacking, Information Security, Cybersecurity, Digital Forensics, Ctf

SIEM stands for security information and event management and provides organizations with next-generation detection, analytics and response. SIEM software combines security information management (SIM) and security event management (SEM) to provide real-time analysis of security alerts generated by applications and network hardware. SIEM software matches events against rules and analytics engines and indexes them for sub-second search to detect and analyze advanced threats using globally gathered intelligence. This gives security teams both insight into and a track record of the activities within their IT environment by providing data analysis, event correlation, aggregation, reporting and log management.

SIEM software can have a number of features and benefits, including:

Consolidation of multiple data points

Custom dashboards and alert workflow management

Integration with other products

Splunk is a software platform widely used for monitoring, searching, analyzing and visualizing the machine-generated data in real time. It performs capturing, indexing, and correlating the real time data in a searchable container and produces graphs, alerts, dashboards and visualizations

Read all the contents given to this room. Because its help you to understand the Splunk very Easley

Our first step is add the add on to the Splunk.

Q1 ) What is the ‘Folder name’ for the add-on?

ANS : TA-microsoft-sysmon

Q2 ) What is the Version?

ANS : 10.6.2

In our next step is to upload the tutorialdata.zip in the splunk.

lets get start,

step 1 : choose the Add Data option from the splunk home

step 2 : choose the upload option

step 3 : Select the tutorialdata.zip from the desktop

step 4 : click the next and add the below given data

It depend on what operating system that you are using

Splunk Enterprise for Linux or Mac OS X

a. Select Segment in path.

b. Type 1 for the segment number.

Splunk Enterprise for Windows

a. Select Regular expression on path.

b. Type \\(.*)\/ for the regex to extract the host values from the path.

step 5 : click the review

step 6 : click the submit and select the Start searching option

Q 3) Upload the Splunk tutorial data on the desktop. How many events are in this source?

ANS : 109,864

Splunk Queries

an asterisk * in the Search bar and change the timeframe to search from Last 24 hours to All time.

we can access the sysmon log event using the source query.

Eg : source=”XmlWinEventLog:Microsoft-Windows-Sysmon/Operational”

In the Query area, we can use different kinds of fields. and don’t forget that Fields are case sensitive.

Eg : source=”XmlWinEventLog:Microsoft-Windows-Sysmon/Operational” EventID=12

And also we can use keywords. But they are not case sensitive.

Eg : source=”XmlWinEventLog:Microsoft-Windows-Sysmon/Operational” googleupdate.exe

Q 4 ) What is the sourcetype?

ANS HINT : Search “failed password” in the search area and look at the source type. And open the source type and look the bottom side there we can see the value.

ANS : www1/secure

Q 5 ) What is the last username in this tab?

ANS HINT: open the pattern section and search the last event in the table

ANS : myuan

Q 6 ) Search for failed password events for this specific username. How many events are returned?

ANS HINT: search the “ failed password” query with the account username as the keyword like “failed password” myuan

ANS : 16

Q 7 ) Use the Select document feature. What is the Splunk query for ‘sigma: APT29’?

ANS HINT: Go to https://uncoder.io/ and select APT29 from the” Select Document” area. And choose Splunk from the “Translating to” area then translate it. It’s your Splunk query for searching APT29

ANS : CommandLine=”*-noni -ep bypass $$*”

Q 8 )Use the Github Sigma repo. What is the Splunk query for 'CACTUSTORCH Remote Thread Creation'?

ANS HINT : Open https://github.com/SigmaHQ/sigma -> rules ->windows->create_remote_thread->sysmon_cactustorch.yml

open and copy it then paste it to the https://uncoder.io/ and translate it to Splunk query

ANS : (EventCode=”8" (SourceImage=”*\\System32\\cscript.exe” OR SourceImage=”*\\System32\\wscript.exe” OR SourceImage=”*\\System32\\mshta.exe” OR SourceImage=”*\\winword.exe” OR SourceImage=”*\\excel.exe”) NOT StartModule=”*” TargetImage=”*\\SysWOW64\\*”)

Q 9 ) What is the highest EventID?

ANS : 11

LEARN MORE

Thanks for your support