Writeup: Splunk 101
For this box I used the on-platform interface.
Link: Splunk 101 Room on TryHackMe
Virtual machine deployed.
Answer: No answer needed
Go to the Start Menu, find Splunk, start it.
I'm ready to look at Splunk apps.
Answer: No answer needed
What is the 'Folder name' for the add-on?
After adding the plugin as described, we look at the Apps page.
Answer: TA-microsoft-sysmon
What is the Version?
Answer: 10.6.2
Upload the Splunk tutorial data on the desktop. How many events are in this source?
Note: Make sure you upload the data once only.
When uploading the data, select Automatic and, since it is on a Windows box, make sure to set Host to Regular Expression on Path and the test be \\(.*)\/.
Answer: 109,864
Use Splunk to Search for the phrase 'failed password' using tutorialdata.zip as the source.
* "failed password"
Answer: No answer needed
What is the sourcetype?
Answer: www1/secure
In the search result, look at the Patterns tab.
Answer: No answer needed
What is the last username in this tab?
Answer: myuan
Search for failed password events for this specific username. How many events are returned?
* "failed password" myuan
Answer: 16
Go to Uncoder.io
Use the Select document feature. What is the Splunk query for 'sigma: APT29'?
Answer: CommandLine="*-noni -ep bypass $$*"
Use the Github Sigma repo. What is the Splunk query for 'CACTUSTORCH Remote Thread Creation'?
Go to the GitHub repo and go to rules/windows/create_remote_thread/sysmon_cactustorch.yml.
Copy the text over to Uncoder.io, press translate to Splunk.
Answer: (SourceImage="*\\System32\\cscript.exe" OR SourceImage="*\\System32\\wscript.exe" OR SourceImage="*\\System32\\mshta.exe" OR SourceImage="*\\winword.exe" OR SourceImage="*\\excel.exe") TargetImage="*\\SysWOW64\\*" NOT StartModule="*"
Go to Dashboards -> Create new dashboard.
What is the highest EventID?
Make sure to set the search time range to All time!
Answer: 11
I have a general understanding on how to create an alert in Splunk.
Answer: No answer needed
I know the fundamentals of Splunk.
Answer: No answer needed