SOC Cybersecurity Threat Hunting with Splunk

install splunk enterprise on ubuntu by downloading the package, transferring to ubuntu via filezilla, logging in, installing with dpkg, starting the service, and accessing the splunk interface at port 8000.

Learn to bulk install apps and add-ons by downloading from Splunkbase, extracting .tgz files, transferring them to the Splunk apps directory with FileZilla, and restarting Splunk.

Install bots datasets in Splunk by downloading add-ons, transferring the dataset to /opt, and using splunk install app, then search index=bots version one, repeat for versions two and three.

Import attack logs into Splunk by installing the Sysmon and Windows add-ons, then upload Sysmon and Windows event logs with correct source types, verify with index=main searches.

Explore how Splunk stores, searches, and analyzes data to reveal patterns, generate reports and alerts, and detect cybersecurity attacks with SPL.

Identify indicators of compromise (IoCs) across host-based signals like registry changes, dropped files, and file hashes, and network-based signals such as IPs, domains, certificates, and the pyramid of pain.

Explore the Cyber Kill Chain and MITRE ATT&CK to map attacker stages, tactics, techniques, and procedures, and learn how detection and defense align with these frameworks.

Detect data exfiltration by identifying large uploads in Splunk. Learn to filter logs with bytes out greater than 35 MB, revealing time, bytes in/out, HTTP source, IP, and URI.

Leverage top and rare commands in Splunk to detect defense evasion and display top and rare processes from 4688 events in Windows Security eventlog (botsversion3 index).

Learn to hunt network connections with Splunk by creating hourly buckets, using bucket and stats to map source to destination IPs, and refine views with fields minus count.

Detect basic scanning with Splunk by building a use case that buckets time into hourly intervals, computes dc(destinationport) and dc(destinationip), and groups by _time and sourceip with a where filter.

Detect brute force attacks with Splunk by counting failed logins within a time frame and a threshold, and identify successful logins among failures using stats by src and time.

Analyze windows processes to detect malware using indicators such as unusual paths and parent-child relationships. Use commandlines, names, hashes, and image signature to spot potential attacks, with Splunk analysis.

Hunt for malicious windows processes in Splunk by analyzing sysmon event id 1, extracting data, and validating commandlines, parent image, and hashes (md5, sha256, IMPHash) for powershell and mshta.

Install pstree from splunkbase to enable parent and child process trees in splunk, then map parentname and processname with ids using rex and eval, and view relationships with pstree.

Filter windows event logs by commandline length to narrow search for potential malicious activity, compute the average length, and validate each commandline to distinguish obfuscated threats.

Use Splunk to hunt fake Windows processes by validating execution paths against the iswindowssystemfile lookup, normalizing filenames with eval, and filtering for systemfile true in indexsysmon eventcode 1.

Detect process injection by using a Splunk search on Sysmon event id 8, filtering by eventcode 8 and target image *.exe, excluding paths, to reveal injections like lsass.exe.

Identify and detect attacks on the LSASS process, Windows' local security authority that handles user authentication and token creation, where encrypted passwords, NT hashes, and Kerberos tickets fuel privilege escalation.

Detect remote threads into LSASS by analyzing sysmon event id 8, focusing on SourceImage and TargetImage, using Splunk search to build tables, convert times, and identify suspicious parents.

Detect lsass.exe access by filtering sysmon event id 10 in splunk, using calltrace values to surface sourceimage, targetimage, targetprocessid, and sourceprocessid, then convert times and rename fields.

Analyze lsass credential access by examining sysmon event id 10 granted access and calltrace fields to distinguish legitimate from malicious processes, using sourceimage, targetimage, and access flags in Splunk.

Explore mimikatz, an open-source tool that extracts passwords and credentials from memory to enable unauthorized access, privilege escalation, and lateral movement; learn to detect mimikatz activity with Splunk.

Hunt mimikatz by identifying loaded DLLs and images with Sysmon event id 7, then query Splunk to filter results, spotlighting PowerShell.exe as a potential mimikatz indicator.

Identify Mimikatz execution by querying the endpoint datamodel's process dataset in Splunk, using tstats, filtering important fields, and converting times to human-readable form.

Use PowerShell logs, especially event 4104's script block text, to hunt Mimikatz with Splunk by filtering script blocks, extracting strings, and building a table of events.

Explain how Kerberos v5 authenticates a client and domain controller and file server in an Active Directory domain, using as-req, tgt, tgs-req, tgs-rep, ap-req, and ap-rep.

Learn how kerberoasting enables brute-force password recovery by exploiting service tickets encrypted with a service account password in Active Directory, targeting file servers via TGS-REQ and TGS-REP.

Detect Kerberoasting with Splunk by Windows event ID 4769, filter noise using the service_name field and ticket options, note that 0x17 RC4 contrasts with AES 0x11/0x12, service names like srv_http1.

Detect a DCSync attack in Splunk by analyzing event 4662, access mask 0x100, and DS replication GUIDs to reveal suspicious AD access and potential exposure of NTLM hashes.

Detect overpass-the-hash attacks with Splunk by monitoring event code 4624, logon type 9, and seclogo process, then present a logon detail table with time, username, and computer.

Detect pass-the-ticket attacks with rubeus by tracing Kerberos TGTs stolen from lsass memory and TGS requests, using sysmon event id 10 and grant-access checks on winlogon.exe.

NTLM authentication works on Windows networks, including domain username, password hash, a 16-byte challenge, and a response verified by the domain controller, with Kerberos as a fallback.

Learn how pass-the-hash attacks use stolen hashes to access a system and detect them in Splunk by analyzing Windows event 4624, logon type 3 or 9, ntlm ssp, and seclogo.

Learn how to use data science and statistics with Splunk to identify outliers and abnormal logs, narrowing searches to potential attacks.

Apply standard deviation to identify outliers in data using Splunk, calculating the mean and upper and lower bounds to separate normal data from outliers.

Explore normal distribution, gaussian distribution, standard deviation, and the empirical rule, and learn how Splunk uses these concepts to narrow search ranges, address outliers, and the limits of single-method analysis.

Use the empirical rule to classify data as normal or outliers within 68, 95, and 99.7 percent ranges around the mean, aiding threat hunting with Splunk.

Detect ICMP tunnel outliers with data science and Splunk by calculating average and standard deviation of ICMP packet counts, bounding with two standard deviations, and flagging outliers.

Learn to detect anomalous windows process command lines in Splunk by calculating command line lengths from Sysmon logs, average and standard deviations, to flag outliers and filter potential malicious commands.

Detect SMB anomalies in Splunk by calculating per source and per destination connection counts, applying seven standard deviation bounds on 139 and 445 traffic to flag outliers.

Explore the Splunk machine learning toolkit app, offering clustering, regression, classification, and anomaly detection with data preparation, model evaluation, and real-time analytics for cybersecurity insights.

Use the Splunk machine learning toolkit to detect DNS tunneling by summing DNS packet bytes per src IP and dest IP and flagging numeric outliers with two standard deviations.

Import IOCs into Splunk via lookup, upload malware.csv as a lookup table, and detect malicious DNS queries by comparing Sysmon Event ID 22 data against the IOC list.

Learn to enrich Splunk logs with a malware lookup by joining the domain field to malware.csv, adding reasons and references to Sysmon event data, and displaying results in a table.

Learn how to integrate MISP with Splunk to transfer IOCs and threats using the MISP 42 app and API key for enhanced threat hunting.

Detect malicious activity by querying MISP IOCs in Splunk with mispgetioc, filtering by categories and types, and investigating related connections via Sysmon event ID 3.

Integrate Splunk with AlienVault OTX to examine IOCs using the Check OTX command, including URL, IP, domain, and hash, after configuring the SA-AlienVault app with your URL and API key.

Connect Splunk to VirusTotal with the VirusTotal malware lookup for Splunk app, configure an API key, and query domain, hash, and URL within dashboards.

Explore how ChatGPT, an AI language model based on GPT-3.5, engages in human-like conversations and helps find cybersecurity threats, with integration ideas for Splunk.

Install the OpenAI TA in Splunk, obtain the API key and organizational ID, and configure them in setup. Then use the pipe openai command to query ChatGPT.

Detect cyber-attacks with ChatGPT and Splunk by running searches that reveal openai_prompt, openai_model, and openai_response, and assess whether commands are malicious or encoded (base64) by asking multiple questions.

RITA analyzes Zeek logs and PCAPs to detect malicious activity through statistical analysis, offering beacon detection, DNS tunneling detection, long connections, user-agent viewing, and blacklist checks.

Install Rita on Ubuntu 20.04, make install.sh executable with chmod 755, run with sudo to import Zeek logs and parse into a 48-hour dataset; view beacons via Rita show dash.

Integrate rita with Splunk by executing a prepared bash script, saving csv logs, and using inputlookup to correlate Zeek data with Splunk logs for detecting targeted attacks.

Detect beaconing with RITA and Splunk by using the search and reporting app, filtering scores above 0.8, and inspecting source, destination, connections, avg bytes, total bytes, and SNI.

Detect DNS tunneling by integrating RITA with Splunk, using inputlookup and a CSV to surface domain lookups, encoded strings, and dnscat indicators of tunneling.