BOTSv3 SOC investigation
- Problem
- An attack hidden across O365, Windows, Linux and Sysmon logs in the Boss of the SOC v3 dataset.
- Approach
- Splunk searches to filter suspicious events, correlate them by time and map the activity to MITRE ATT&CK.
- Outcome
- An attack timeline from first access to account changes and scanning, with recommendations for phishing prevention, account monitoring and network detection.