< Back to Write-Ups Investigate with Splunk Banner

Room Summary

The TryHackMe room "Investigating With Splunk" introduces learners to the fundamentals of using Splunk, a leading SIEM platform for security monitoring and incident analysis. Participants gain hands-on experience with log analysis, search query creation using Splunk's Search Processing Language (SPL), and event correlation to uncover suspicious activity.

The room focuses on practical investigation workflows, filtering large datasets, and interpreting system and network logs to identify potential threats. Tools include Splunk Enterprise and its Search & Reporting app, allowing learners to build analytical skills in visualization, data correlation, and real-world SOC investigation techniques.

Question 1: How many events were collected and Ingested in the index main?

We use the query below and adjust the time range appropriately to retrieve the answer for this question:

[Splunk Query]
index=main
Splunk query results showing events in index main
Splunk query results showing total events in index main

Question 2: On one of the infected hosts, the adversary was successful in creating a backdoor user. What is the new username?

According to Microsoft Documentation, the event ID for this type of event is 4720, so we will use the query below to filter for such event:

[Splunk Query]
index=main EventID=4720

Immediately, we got 1 event which fits such filter:

Splunk query results showing user creation event ID 4720
Event ID 4720 showing backdoor user creation

Question 3: On the same host, a registry key was also updated regarding the new backdoor user. What is the full path of that registry key?

After a quick Google Search, we found that Event ID 12/13/14 are all related to Windows registry changes/creations. And after some experimenting with the query, this is the one that gives us the correct answer:

[Splunk Query]
index=main A1berto EventID=13
Splunk query results showing registry key modification for backdoor user
Event ID 13 showing registry key modification for A1berto user

Question 4: Examine the logs and identify the user that the adversary was trying to impersonate.

We can probably guess the answer to this, but let's make sure to do our due diligence.

By selecting the "User" field in the "Interesting fields" pane, we can see one of the most active users is Cybertees\Alberto. The question doesn't need the domain, only the username: Alberto.

Splunk interesting fields showing user Alberto as most active
Interesting fields pane showing Alberto as the most active user

Question 5: What is the command used to add a backdoor user from a remote computer?

For this question, we will utilize the event ID=1, which indicate a new process has been created, the query we use for this is:

[Splunk Query]
index="main" EventID="1"

This gives us 25 result, and among those 25 results, only 1 of them seems interesting. By clicking on the "CommandLine" field, we can see a list of commands, including the one for which we're looking:

Splunk query results showing process creation events with CommandLine field
Event ID 1 showing CommandLine field with backdoor user creation command

Question 6: How many times was the login attempt from the backdoor user observed during the investigation?

This query will return the answer:

[Splunk Query]
index=main User="A1berto"
Splunk query results showing login attempts from backdoor user A1berto
Login attempts from backdoor user A1berto

Question 7: What is the name of the infected host on which suspicious Powershell commands were executed?

This query will give us the answer:

[Splunk Query]
index=main A1berto powershell
Splunk query results showing suspicious PowerShell commands executed by A1berto
Suspicious PowerShell commands executed by backdoor user A1berto

Question 8: PowerShell logging is enabled on this device. How many events were logged for the malicious PowerShell execution?

Based on Splunk Documentation, the event ID for PowerShell Login is 4103 and 4104, however we got no hit for 4104 so 4103 it is.

[Splunk Query]
index=main EventID=4103
Splunk query results showing PowerShell logging events with EventID 4103
PowerShell logging events with EventID 4103

Question 9: An encoded Powershell script from the infected host initiated a web request. What is the full URL?

Initially, this question was tricky for me, but I remember seeing this command during the earlier search for the previous question:

Encoded PowerShell script showing base64 encoded command
Encoded PowerShell script with base64 encoded command

Using CyberChef loaded with both "From Base64" and "Decode Text" recipes, load in the encoded data:

CyberChef interface with From Base64 and Decode Text recipes
CyberChef setup with decoding recipes

Now grab that Base64 code highlighted in yellow and throw it into the pot:

CyberChef decoding the base64 encoded PowerShell command
CyberChef decoding the base64 encoded command

Then we just need to add the sub directory to the address, then we will get the full answer, which is hxxp://10.10.10.5/news.php

Final decoded URL showing the full web request destination
Final decoded URL showing the complete web request destination