SOC ALPHA 1
Difficulty: Easy
Was this helpful?
Difficulty: Easy
Was this helpful?
Scenario: You are a SOC analyst and handling the alerts within your SIEM, ELK, is part of daily duties. Answer the following questions by analysing the alerts provided in README.txt!
ELK should start within 5 minutes, if not please try to start the services manually : sudo systemctl start elasticsearch sudo systemctl start kibana sudo systemctl start logstash
Tools: ELK | LogAnalysis | Network Analysis
README.txt shows us that in order to see the logs that triggered the Alert 1 we need to filter for "*.DownloadFile*" OR "*.DownloadString*" OR "*Invoke-WebRequest*" and set the TimeFrame for 14-4-2021 10:00 to 14-4-2021 11:00 :
Looking at the same logs as in the first question, we can see the full command containing the URL we are interested in:
To see the logs that triggered the Alert 2, we need to filter for (Event_System_EventID :"11" AND Event_EventData_Image : *Windows\\Start*\\Programs\\\Startup*) and set the TimeFrame for 14-4-2021 10:00 to 14-4-2021 11:00:
To see the logs that triggered the Alert 3 we need to filter for (Event_System_EventID:("12" OR "13" OR "14") AND (Event_EventData_TargetObject:("*\SOFTWARE\Wow6432Node\Microsoft\ActiveSetup\InstalledComponents*" OR "\SOFTWARE\Microsoft\WindowsCE*Services\AutoStartOnDisconnect*" OR "\SOFTWARE\Microsoft\WindowsCEServices\AutoStartOnConnect" OR "\SYSTEM\Setup\CmdLine" OR "\Software\Microsoft\Ctf\LangBarAddin*" OR "*\Software\Microsoft\CommandProcessor\Autorun" OR "\Run"))) and set the TimeFrame for 15-4-2021 8:00 to 15-4-2021 9:00 . Sysmon Event ID 13 records the registry value modifications. Within the Event_EventData_TargetObject field, at the very end we can see the suspicious executable:
Looking at the same log as in Q4, we can find the key path in the same field (Event_EventData_TargetObject). However the answer to the question is not the full path, only the key itself:
To see the log that triggered the Alert 3 we need to filter for Event_EventData_Image:schtasks.exe AND Event_EventData_CommandLine:Create and set the TimeFrame for 20-4-2021 10:00 to 20-4-2021 15:00. In the log we can see that "SchTasks" command has been run. The name of the task is what's coming after the "/TN" (task name):
Looking at the same log as in Q6, we can find the full path of the program following the "/TR" (task run) parameter:
