CHALLENGE INFORMATION

AOC25 - Day-03 LogoPlatform: TryHackMe
Event: Advent of Cyber 2025
Day: 03
Title: Splunk Basics - Did you SIEM?

Description

Learn how to ingest and parse custom log data using Splunk.

Summary

First we write SPL queries to ingest web and firewall log data, pinpoint the malicious IP address, and trace the stages of reconnaissance, exploitation, and data exfiltration.

AOC25 - Day-03 Hero

Storyline

The Best Festival Company (TBFC) is preparing for a Christmas event in Wareville when a ransomware alert appears on their SOC dashboard, demanding 1,000 HopSec Coins from King Malhare of HopSec Island. Malhare’s Bandit Bunnies aim to hijack TBFC’s systems and replace Christmas with EAST-mas.

The SOC team will use Splunk to trace the ransomware entry, extract custom fields, apply SPL queries, and investigate the incident to protect the holiday celebration.

Log Analysis with Splunk

Search Queries

We use the Splunk Search Processing Language (SPL) to analyze the ingested logs.

Datasets

  • web_traffic: Events related to web connections.
  • firewall_logs: Firewall logs (allowed or blocked traffic).

Exploring the Logs

To show all ingested logs:

index=main

Initial Triage

To view all web traffic:

index=main sourcetype=web_traffic

To visualize the log timeline and chart the total event count over time:

index=main sourcetype=web_traffic | timechart span=1d count

To sort by count in reverse order:

index=main sourcetype=web_traffic | timechart span=1d count | sort by count | reverse

Anomaly Detection: Filtering Out Benign Values

We exclude common legitimate user agents to reveal suspicious activity:

index=main sourcetype=web_traffic user_agent!=*Mozilla* user_agent!=*Chrome* user_agent!=*Safari* user_agent!=*Firefox*

We then narrow down by IP address:

sourcetype=web_traffic user_agent!=*Mozilla* user_agent!=*Chrome* user_agent!=*Safari* user_agent!=*Firefox* | stats count by client_ip | sort -count | head 5

Note that we sort results in reverse order using sort -count.

Tracing the Attack Chain

We check for targeted paths:

sourcetype=web_traffic client_ip="<redacted-client-ip>" AND path IN ("/.env", "/*phpinfo*", "/.git*") | table _time, path, user_agent, status

Enumeration: Vulnerability Testing

We search for common path traversal and open redirect vulnerabilities:

sourcetype=web_traffic client_ip="<redacted-client-ip>" AND path="*..*" OR path="*redirect*"

We drill down on path traversal attempts (escaping the slash characters with ..\/..\/):

sourcetype=web_traffic client_ip="<redacted-client-ip>" AND path="*..\/..\/*" OR path="*redirect*" | stats count by path

SQL Injection Attack

We check for automated attack tools:

sourcetype=web_traffic client_ip="<redacted-client-ip>" AND user_agent IN ("*sqlmap*", "*Havij*") | table _time, path, status

Exfiltration Attempts

We look for large downloads and sensitive file downloads using tools such as curl and zgrab:

sourcetype=web_traffic client_ip="<redacted-client-ip>" AND path IN ("*backup.zip*", "*logs.tar.gz*") | table _time path, user_agent

Ransomware Staging and RCE

We search for requests for sensitive archives such as /logs.tar.gz or /config:

sourcetype=web_traffic client_ip="<redacted-client-ip>" AND path IN ("*bunnylock.bin*", "*shell.php?cmd=*") | table _time, path, user_agent, status

Correlate Outbound C2 Communication

We filter firewall logs for the attacker IP:

sourcetype=firewall_logs src_ip="10.10.1.5" AND dest_ip="<redacted-dest-ip>" AND action="ALLOWED" | table _time, action, protocol, src_ip, dest_ip, dest_port, reason

Volume of Data Exfiltrated

We calculate the sum of the bytes transferred:

sourcetype=firewall_logs src_ip="10.10.1.5" AND dest_ip="<redacted-dest-ip>" AND action="ALLOWED" | stats sum(bytes_transferred) by src_ip

Summary

  • Attacker identified by the highest volume of malicious web traffic from a single external IP.
  • Intrusion vector traced through web logs – sourcetype=web_traffic – showing a clear attack progression.
  • Reconnaissance used cURL/Wget to probe for configuration files – /.env – and test path-traversal flaws.
  • Exploitation confirmed by SQLmap user agents and payloads such as SLEEP(5).
  • Payload delivery culminated in executing cmd=./bunnylock.bin via a webshell.
  • C2 activity verified in firewall logs – sourcetype=firewall_logs: compromised server opened an outbound C2 connection to the attacker’s IP.

Questions and Answers

Question-1: What is the attacker IP found attacking and compromising the web server?

198.51.100.55

Question-2: Which day was the peak traffic in the logs? (Format: YYYY-MM-DD)

2025-10-12

Question-3: What is the count of Havij user_agent events found in the logs?

993

Question-4: How many path traversal attempts to access sensitive files on the server were observed?

658

Question-5: Examine the firewall logs. How many bytes were transferred to the C2 server IP from the compromised web server?

126167

Question-6: If you enjoyed today’s room, check out the Incident Handling With Splunk room to learn more about analyzing logs with Splunk.

No answer needed