SOC LEVEL 1
  • Path 1
    • Cyber Defense Framework
      • Security Analyst Intro
      • Pyramid of Pain
      • Cyber Kill Chain
      • Unified Kill Chain
      • Diamond Model
      • MITRE
  • PATH 2
    • Cyber Threat Intelligence
      • Intro to Cyber Threat Intel
      • Threat Intelligence Tools
      • Yara
      • OpenCTI
      • MISP
  • PATH 3
    • Network Security and Traffic Analysis
      • Traffic Analysis Essentials
      • Snort
      • Snort Challenge - The Basics
      • Snort Challenge - Live Attacks
      • NetworkMiner
      • Zeek
      • Zeek Exercises
      • Brim
      • Wireshark: The Basics
      • Wireshark: Packet Operations
      • Wireshark: Traffic Analysis
  • PATH 4
    • Endpoint Security Monitoring
      • Intro to Endpoint Security
      • Core Windows Processes
      • Sysinternals
      • Windows Event Logs
      • Sysmon
      • Osquery: The basics
      • Wazuh
  • PATH 5
    • Security Information and Event Management
      • Introduction to SIEM
      • Investigating with ELK 101
      • ItsyBitsy
      • Splunk: Basics
      • Incident Handling with Splunk
      • Investigating with Splunk
      • Benign
  • PATH 6
    • Digital Forensics and Incident Response
      • DFIR: An Introduction
      • Windows Forensics 1
      • Windows Forensics 2
      • Linux Forensics
      • Autopsy
      • Redline
      • Kape
      • Volatility
      • Velociraptor
      • TheHive Project
      • Intro to Malware Analysis
  • PATH 7
    • Phishing
      • Phishing Analysis Fundamentals
      • Phishing Emails in Action
      • Phishing Analysis Tools
      • Phishing Prevention
      • The Greenholt Phish
Powered by GitBook
On this page
  • Introduction
  • About the Network Information
  • Identify and Investigate an Infected Host
  1. PATH 5
  2. Security Information and Event Management

Benign

Investigate host-centric logs on a compromised host to find suspicious process execution.

PreviousInvestigating with SplunkNextDigital Forensics and Incident Response

Last updated 1 year ago

Introduction

One of the client’s IDS indicated a potentially suspicious process execution indicating one of the hosts from the HR department was compromised. Some tools related to network information gathering / scheduled tasks were executed which confirmed the suspicion. Due to limited resources, only the process execution logs with Event ID: 4688 could be pulled and ingested into Splunk with the index win_eventlogs for further investigation.

About the Network Information

IT department
HR department
Marketing department

James

Haroon

Bell

Moin

Chris

Amelia

Katrina

Diana

Deepak

Identify and Investigate an Infected Host

How many logs are ingested from the month of March, 2022?

Imposter Alert: There seems to be an imposter account observed in the logs, what is the name of that user?

Using the "rare" SPL command to target the usernames, there is one obvious unwanted user:

Which user from the HR department was observed to be running scheduled tasks?

Searching for "schtasks" will index 87 events:

From here, querying the usernames involved in these tasks should narrow down the search to the user from the HR department.

Which user from the HR department executed a system process (LOLBIN) to download a payload from a file-sharing host.

To bypass the security controls, which system process (lolbin) was used to download a payload from the internet?

certutil.exe

What was the date that this binary was executed by the infected host? format (YYYY-MM-DD)

2022-03-04

Which third-party site was accessed to download the malicious payload?

controlc.com

What is the name of the file that was saved on the host machine from the C2 server during the post-exploitation phase?

benign.exe

The suspicious file downloaded from the C2 server contained malicious content with the pattern THM{..........}; what is that pattern?

Inside the Splunk history, the following qery could be found:

What is the URL that the infected host connected to?

https://controlc.com/548ab556

13,959
Amel1a
sctasks
Chris.fort
haroon
THM{KJ&*H^B0}
https://textbin.net/osk7oyduzi