Boss Of The SOC V1 Blue Team Lab

High Level Details:

• Attacker 1: 40.80.148.42

• Attacker 2: 23.22.63.114

• CMS: Joomla

• Site: imnotreallybatman.com

• Site IP: 192.168.250.70

• devname=gotham-fortigate

• we8105desk 192.168.250.100 (Bob Smith)

Q1 - This is a simple question to get you familiar with submitting answers. What is the name of the company that makes the software that you are using for this competition? Just a six-letter word with no punctuation.

This is a simple one to start things off.

Answer: Splunk

Q2 - Web Defacement: What content management system is imreallynotbatman.com likely using? (Please do not include punctuation such as . , ! ? in your answer. We are looking for alpha characters only.)

For this question, I first thought about the protocol that comes with CMS which is of course over HTTP/s. I thin filtered for results related to imreallynotbatman and http as seen in the query below.

imreallynotbatman sourcetype="stream:http"

We can see the CMS in the first search result, in the src_content below.

You might be wondering how you may determine this has you not known joomla was a CMS. The href tag in src_content is a reference pointer to CMS content.

Q3 - Web Defacement: What is the likely IP address of someone from the Po1s0n1vy group scanning imreallynotbatman.com for web application vulnerabilities?

Starting off our query with our website name, we are looking for indicators of scanning on the website. There are a few common patterns you will see when scanning a website, this includes a large volume of GET requests. UDP protocols, and a large number of overall packets.

While we could narrow down based on the above, it is best practice in Splunk to visualize our data. Our sourcetype is of course http since this is a web application being scanned. Visualizing data volume will be our next step. While this lab has relatively few machines talking to our webserver, it could be the case were standard production operations are sending more traffic than an attacker performing web application scanning. For this reason, we will want to measure not only the amount of data from each host to our target, but the amount of data sent back. Finally we evaluate this and sort within a table as seen below.

The query used is below.

sourcetype=stream:http

| stats count dc(uri_path) as distinct_paths sum(bytes_in) as total_bytes_in sum(bytes_out) as total_bytes_out by src_ip, dest_ip

| eval total_bytes=total_bytes_in+total_bytes_out

| sort -count

| table src_ip, dest_ip, count, distinct_paths, total_bytes_in, total_bytes_out, total_bytes

• Count: Keeps the count of events.

• Distinct Paths: Adds a distinct count of uri_path to see how many unique URLs are accessed.

• Total Bytes In/Out: Sums up the bytes_in and bytes_out to get a total amount of data transferred.

• Total Bytes: Calculates the total data transferred (sum of bytes in and bytes out).

• Sort: Sorts the results by count in descending order.

• Table: Displays the results in a table format with the selected fields.

The final answer is 40.80.148.42 as seen in the above screenshot with the largest total of bytes in and out.

Q4 Web Defacement: What company created the web vulnerability scanner used by Po1s0n1vy? Type the company name. (For example, "Microsoft" or "Oracle")

For this question, I wanted to focus on looking at user agent strings, as it is quite common for vulnerability scanners to identify themselves in the user agent strings, when performing web application vulnerability scanning. The query was quite similar to the previous one.

index=* AND 40.80.148.42

| stats count by http_user_agent

| sort -count

| table http_user_agent, count

Q5 Web Defacement: What IP address is likely attempting a brute force password attack against imreallynotbatman.com?

For this question I want to focus on the hosts that are making large amount of GET requests. Stats will help us see the top IP address making GET requests, and formatting this into a table we can see the first 2 IP addresses are tied to our attacker and our web server which we learned from earlier questions. The 3rd IP made the next largest amount of requests and is indeed our culprit. This can of course be confirmed by diving deep into the GET requests made by this IP and you will see the user names and 404 server responses.

index=* AND "http.http_method"=GET

| stats count by src_ip

| sort -count

| table src_ip, count,

Q6 Web Defacement: What was the first brute force password used?

This challenge will lead us to look at POST requests to our known webserver and we can determine the high volume of requests are going to the below URI. From here we use the rex field command to check form data for the password string, followed by some house cleaning via sort_time and then a dedup on the source IP. Finally we make a table of output and see out answer.

index=botsv1 sourcetype=stream:http dest_ip="192.168.250.70" http_method=POST uri=/joomla/Administrator/index.php

| rex field=form_data "passwd=(?<password>\w+)"

| sort _time

| dedup src_ip

| table _time src_ip password

The regex which is expressed as rex field can be broken down in the following.

• rex: This is the command used to extract fields from the data.

• field=form_data: This specifies the field from which to extract the data. In this case, it is form_data.

• "passwd=(?<password>\w+)": This is the regular expression pattern used to extract the desired data.

Let's break down the regular expression:

• passwd=: This matches the literal string passwd=.

• (?<password>\w+): This is a named capture group in the regular expression. Here’s what each part means:

• (?<password>...): This defines a named capture group called password. The part of the string that matches the pattern inside the parentheses will be extracted and stored in a new field named password.

• \w+: This matches one or more word characters (letters, digits, and underscores). The \w+ will match the actual password value following passwd= in the form_data field.

In summary, this line of the query extracts the value that follows passwd= in the form_data field and assigns it to a new field called password. For example, if form_data contains passwd=mysecretpassword, the value mysecretpassword will be extracted and stored in the password field.

4o

We can see our first password was 12345678.

Q7 Web Defacement: What is the name of the executable uploaded by Po1s0n1vy? Please include the file extension. (For example, "notepad.exe" or "favicon.ico")

This question was a chance to utilize the rare command in Splunk. In the case of a file upload it would be uncommon for the malicious file as apart of the kill chain to be repeatedly uploaded in a standard operating context. I kept this query simple looking for only POST requests. While it is possible the file was uploaded through an application over and encrypted tunnel, we have established the use of HTTP protocol to our server.

index=* AND POST

| rare limit=20 fileinfo.filename

Clicking into the 3791.exe file reveals the known attacker of 40.80.148.42. Have a look in the image below.

Q8 Web Defacement: What is the MD5 hash of the executable uploaded?

This question had me thinking about what type of operation would generate an MD5 hash within local logging. I built my query around the file name, and whether the string MD5 was present. This was not sufficient as the MD5 hash value was appearing for many parent processes that called 3791.exe as a child process. I then pivoted to signature_ID's of which only 2 were present and I filtered by the signature with only 1 count.

index=* AND 3791.exe AND md5 Image="C:\\inetpub\\wwwroot\\joomla\\3791.exe" signature_id=1

Q9 Web Defacement: What was the correct password for admin access to the content management system running "imreallynotbatman"?

This question had me thinking back to our list of initial URL's we uncovered from question 2. With the likely URL in our search query, a good next step is to look at POST requests that did not return 404 (Or whatever the invalid credential server response is). Because we are working on HTTP we do not have to worry about encryption/decryption.

Referencing our query in Question 6 we can see the answer. I did remove the dedup command append an exclusion for the original IP, since the answer was not the first IP address in the list as we already used this to answer Question 6.

index=botsv1 sourcetype=stream:http dest_ip="192.168.250.70" http_method=POST uri=/joomla/Administrator/index.php src_ip!="23.22.63.114"

| rex field=form_data "passwd=(?<password>\w+)"

| sort _time

| table _time src_ip password

Q10 Web Defacement: What is the name of the file that defaced the imreallynotbatman website? Please submit only the name of the file with the extension (For example, "notepad.exe" or "favicon.ico").

This was a tough question, and we had to work on the understanding that the attacker has logged into this host and is operating internally. While no relevant file execution in local logs was helpful. I managed to build a query looking for signs of remote file execution over http with a GET request. I then looked at byte size and filtered further, as I wanted to start with the largest get request.

Index=* AND src_ip=192.168.250.70

AND sourcetype=suricata

AND "http.http_method"=GET

AND event_type=http

AND "http.url"="*"

Q11 Web Defacement: This attack used dynamic DNS to resolve to the malicious IP. What is the fully qualified domain name (FQDN) associated with this attack? Using the query from question 12 we can see that the hostname is resolved as the above, which is our answer.

Q12 Web Defacement: What IP address has Po1s0n1vy tied to domains that are pre-staged to attack Wayne Enterprises?

This question was technically answered but we can challenge ourselves to write a query to list all domains involved. This query shows us all domains tied with the original attacking domain and we can see the below attacker is tied to the pre-staged domains.

23.22.63.114

| table http.hostname, host

| dedup http.hostname

Q13 Web Defacement: Based on the data gathered from this attack and common open-source intelligence sources for domain names, what is the email address most likely associated with the Po1s0n1vy APT group?

Looking at the table from question 12, I started working through the domains.

Looking up 71.39.18.126 within Robtex https://www.robtex.com/ip-lookup/71.39.18.126. Reveals several subdomains tied to this IP. The PTR record is a reverse DNS lookup resolution for this IP address. Keep in mind an IP address can have many PTR records, leading to different domains on the same host.

Researching waynecorpinc.com was a red herring. I then realized I could try searching for the string Po1s0n1vy and sure enough it returned the domain and email associated with. https://www.whoxy.com/po1s0n1vy.com

I also missed some low hanging fruit when searching up the attackers IP on virus total. 23.22.63.114

You are immediately presented with the suspicious domains that lead back to the owner lillian.

Q14 Web Defacement: GCPD reported that common TTP (Tactics, Techniques, Procedures) for the Po1s0n1vy APT group, if initial compromise fails, is to send a spear-phishing email with custom malware attached to their intended target. This malware is usually connected to Po1s0n1vy's initial attack infrastructure. Using research techniques, provide the SHA256 hash of this malware.

This challenge took us over to threat miner, an open source data mining tool. Entering the IP address reveals several files associated with this IP address. Drilling down in the file hash reveals this is malware disguised as a screen saver.

Pass the attacker IP address 23.22.63.114 to ThreatMiner.org and you will see the below files.

Clicking into this hash value reveals the associated malicious file. Passing this hash to hybrid analysis reveals more information if you are interested in diving a little deeper.

Q15 Web Defacement: What is the special hex code associated with the customized malware discussed in the previous question? (Hint: It's not in Splunk)

This question was revealed in the community tab on virus total, when you search of the sha256 from the previous question. https://www.virustotal.com/gui/file/9709473ab351387aab9e816eff3910b9f28a7a70202e250ed46dba8f820f34a8/detection

Q16 Web Defacement: One of Po1s0n1vy's staged domains has some disjointed "unique" whois information. Concatenate the two codes together and submit them as a single answer.

I couldn't figure this one out.

Starting back with the basics, we search up the attackers IP address on virus total.

waynecorinc.com

Q17 Web Defacement: One of the passwords in the brute force attack is James Brodsky's favorite Coldplay song. Hint: we are looking for a six-character word on this one. Which is it?

This challenge was solved by taking the query from Question 6 and appending regular expression to only return strings with alphanumeric characters of length 6. We then had to create to a search case to match our results against known Coldplay songs of length 6. index=botsv1 sourcetype=stream:http dest_ip="192.168.250.70" http_method=POST uri=/joomla/Administrator/index.php

| rex field=form_data "passwd=(?<password>[a-zA-Z]{6})"

| sort _time

| search password IN (yellow, clocks)

| dedup password

| table _time src_ip password

Q18 Web Defacement: What was the average password length used in the password brute-forcing attempt? (Round to a closest whole integer. For example "5" not "5.23213")

This question was tricky and required us to improve upon our Splunk query adding logic to evaluate password length, and then incorporating the avg flag along with stats we were able to visualize this data.

index=botsv1 sourcetype=stream:http dest_ip="192.168.250.70" http_method=POST uri=/joomla/Administrator/index.php

| rex field=form_data "passwd=(?<password>\w+)"

| eval password_length = len(password)

| stats avg(password_length) as avg_password_length

| table avg_password_length

Q19Web Defacement: How many seconds elapsed between the brute force password scan identified the correct password and the compromised login? Round to 2 decimal places.

index=botsv1 sourcetype=stream:http dest_ip="192.168.250.70" http_method=POST uri=/joomla/Administrator/index.php

| rex field=form_data "passwd=(?<password>\w+)"

| search password="batman"

| transaction password

| eval timetaken=round(duration, 2)

| table timetaken

This question was really difficult and we had to incorporate the transaction command to group together the timestamps of all events containing password. We then called eval on round with a 2 decimal duration and pop it into a table.

Q20 Web Defacement: How many unique passwords were attempted in the brute force attempt?

This was a relaxing question in which we simply trimmed down our initial query.

index=botsv1 sourcetype=stream:http dest_ip="192.168.250.70" http_method=POST uri="/joomla/Administrator/index.php"

| rex field=form_data "passwd=(?<password>\w+)"

| dedup password

| table password

Q21 Ransomware: What fully qualified domain name (FQDN) makes the Cerber ransomware attempt to direct the user to at the end of its encryption phase?

index=botsv1 sourcetype=stream:dns "query_type{}"=A "query{}"!="demo-01" "query{}"!="*microsoft*" "query{}"!="*windows*"

| dedup query{}

| table query{}

| sort +query{}

Q22 Ransomware: What was the most likely IP address of we8105desk in 24AUG2016?

we8105desk

earliest="8/24/2016:10:00:00" latest="8/24/2016:23:00:00"

Q23 Ransomware: Amongst the Suricata signatures that detected the Cerber malware, which one alerted the fewest number of times? Submit ONLY the signature ID value as the answer. (No punctuation, just 7 integers.)

cerber AND alert AND 192.168.250.100

Q24 Ransomware: The VBScript found in question 25 launches 121214.tmp. What is the ParentProcessId of this initial launch?

I started off with a simple query, since we knew the file name I paired the CommandLine strings and then proceeded to review the parent images. We know that the malware was a vbscript. Wscript.exe is a windows based interpreter for VB and JSscript. 121214.tmp AND CommandLine

Pivoting into C:\Windows\SysWOW64\wscript.exe we then capture the parent process id for our answer.

Q25 Ransomware: During the initial Cerber infection a VB script is run. The entire script from this execution, pre-pended by the name of the launching .exe, can be found in a field in Splunk. What is the length in characters of the value of this field?

CommandLine host=we8105desk

| eval length=len(CommandLine)

| sort by -length

Pasting this script into notepad ++ provides us the overall length which is of course the answer. However it also set's off windows defender 🤣🤣🤣

Q26 Ransomware: The malware downloads a file that contains the Cerber ransomware crypto code. What is the name of that file?

index=* sourcetype=suricata http_method="GET" src_ip="192.168.250.100" earliest="8/24/2016:10:00:00" latest="8/24/2016:23:00:00"

| stats sum(bytes) as bytes by http.url

| table bytes, http.url

| sort -bytes

Q27 Ransomware: Now that you know the name of the ransomware's encryptor file, what obfuscation technique does it likely use?

This was one was second nature to me from participating in CTFs. Steganography is a common theme and challenge format in CTFS.

Q28 Ransomware: What is the name of the USB key inserted by Bob Smith?

index=botsv1 sourcetype=WinRegistry friendlyname

| eval usb_activity=if(match(registry_key_path, "USB"), "Connected", "Other Activity")

| stats count by registry_value_data,

Q29 Ransomware: Bob Smith's workstation (we8105desk) was connected to a file server during the ransomware outbreak. What is the IP address of the file server?

Q30 Ransomware: How many distinct PDFs did the ransomware encrypt on the remote file server?

Q31 Ransomware: The Cerber ransomware encrypts files located in Bob Smith's Windows profile. How many .txt files does it encrypt?

Q32 Ransomware: What was the first suspicious domain visited by we8105desk in 24AUG2016?

earliest="08/24/2016:00:00:00" latest="08/24/2016:23:59:59" sourcetype="stream:dns" src_ip="192.168.250.100" dest_port="*" transport=udp "query_type{}"=A

| table query{}, timestamp

| sort timestamp