[SOLVED] CS6261 Project 1- Splunk Project FALL26

Complete the Splunk Boss of the SOC exercise, answering as many questions as possible. While this is an individual assignment, we do encourage collaboration. Feel free to pose questions on Ed Discussion and to help your fellow students, but do not give away answers.

Background:

The purpose of this project is to build a foundation of log analysis which is a necessary skillset for executing incident response activities. System and security log analysis helps incident responders to determine what actions to take to identify, contain, eradicate, and recover from an incident.

There are many tools available for performing log analysis, but for this class we will leverage Splunk which is one of the most popular tools available.

For this exercise, we will be leveraging the Splunk Boss of the SOC exercise. This exercise will give you familiarity with logs, log analysis, and Splunk. The exercise is a series of questions within the provided Splunk environment. The provided logs must be searched to identify answers to the provided questions.

Instructions:

1. Log into the Splunk environment:
   • You must first connect to the Georgia Tech VPN: https://vpn.gatech.eduLinks to an external site.
   • Then, log into the Splunk environment: https://splunk.class.security.gatech.edu/en-US/app/SA-ctf_scoreboard/welcomeLinks to an external site.
2. Log in to Splunk using your normal Georgia Tech login/password
3. The Splunk navigation bar at the top of the application will help you move around the Splunk environment.
4. Click on the “Questions” link in the navigation bar to see what the questions are for this assignment that you will be answering.
5. Click on “Search” link in the navigation bar to be taken to the Splunk Search tool and start querying the available logs to try and answer the questions for the assignment.
   • All relevant logs for this project are located in the “botsv3” index. Add index=botsv3 to your searches and make sure to search over “All time.”
6. To change to All Time, on the far right side of the search bar, click the box that says “Last 24 hours”
7. In the dropdown that appears, click “All time” under “Other”
8. Submit answers on the “Questions” page.

1.This is a simple question to get you familiar with submitting answers. What is Georgia Tech’s top level domain name? Answer guidance: This is the part after your GT email address including the “.com”

Q200: What is the username of the user that attempted to login to the Frothly AWS account console? Answer guidance: this will be the contents of the user_name field

Q207: Symantec Endpoint Security blocked some instances of a JSCoinMiner download. What was the name of the website that contained the malware? Answer guidance: the answer should be what is between the www. and the .com (ex. google for www.google.com)

Q212 : Mail logs for Frothly are contained in the ms:o365:reporting:messagetrace sourcetype. What is the email address of the user who sent the most messages? Answer guidance: should be the full email (Example: [email protected])

Q201 For the user you found in question 200, which AWS region did the user make the most API calls too? Answer guidance: this will be the value of the awsRegion field

Q202 Splunk can keep track of the *hardware* of systems it is running on. What is the size of the CPU cache of the server named gacrux.i-09cbc261e84259b54? Answer guidance: 5 digit number

Q206 What was the IP address that uploaded the .tar.gz file into the S3 bucket while it was publicly accessible? Answer guidance: this will be the contents of the src_ip field

Q208 While the event severity is high, according to Symantec’s website, what is the severity of this specific coin miner threat? (Symantec is now owned by Broadcom)

Q209 DNS request logs can be a useful way to determine if a host is compromised. How many hosts performed DNS queries for the domain coinhive.com? Answer guidance: answer should be a number

Q210 According to VirusTotal (www.virustotal.com), is coinhive.com malicious? Answer guidance: Should be Yes or No

Q203 The user bstoll accidentally makes an S3 bucket publicly accessible. What is the event ID of the API call that enabled public access? Answer guidance: Include any special characters/punctuation.

Q204 What is the name of the S3 bucket that was made publicly accessible?

Q205: 205 What is the name of the text file that was successfully uploaded into the S3 bucket while it was publicly accessible? Answer guidance: Provide just the file name and extension, not the full path. (Example: filename.docx instead of /mylogs/web/filename.docx)

Q211 What is the short hostname of the only Frothly endpoint to show evidence of defeating the cryptocurrency threat? (Example: ahamilton instead of ahamilton.mycompany.com)

Q213 A Frothly employee accidentally commits AWS access keys to an external code repository. Shortly after, he receives an email from AWS that the account had been compromised. What is the support case ID that Amazon opens on his behalf?

Q214 AWS access keys consist of two parts: an access key ID (e.g., AKIAIOSFODNN7EXAMPLE) and a secret access key (e.g., wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). What is the AWS access key ID that was compromised?

Q215 AWS access keys consist of two parts: an access key ID (e.g., AKIAIOSFODNN7EXAMPLE) and a secret access key (e.g., wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). What is the secret access key of the key that was leaked to the external code repository?

Q216. Using the leaked key, the adversary makes an unauthorized attempt to describe an account. What is the full user agent string of the application that originated the request?

What to submit:

The Splunk Capture the Flag application will keep track of your answers. We will utilize your score in Splunk to grade the assignment. Since this is a capture the flag competition, the amount of points you earn for each question you answer will decrease the longer it takes for you to answer and also by how many hints you utilize. Please note that the basis of your grade will be calculated by number of correct answers, NOT the points you receive in Splunk. Bonus points will be awarded based on standing for a percentage of students to be determined.

Hints:

• You can see which log types are available by looking at the list of “sourcetype”s:

index="botsv3" | stats count by sourcetype

• While we have changed the questions and answers from the originals, you can find some helpful walkthroughs of the original exercise by searching Google for “Boss of the SOC version 3.”

Resources:

1. Note that the “How to Search” section in the Splunk Seach tool provides resources to help you learn Splunk
2. Splunk makes many courses available for free to students at https://workplus.splunk.com/universities
3. Many of the questions you will need to answer will require separate research on the log format and how to interpret logs for various types of systems.
4. If you enjoyed this and want to do more similar exercises, Splunk has more available at https://bots.splunk.com