Evidence correlation
I compared email upload events, process activity and Linux authentication logs to work out how the attack progressed.
Coursework case study · Incident analysis
BOTSv3 SOC Investigation
For this coursework, I used Splunk to investigate an attack in the Boss of the SOC v3 dataset, working across O365, Windows, Linux and Sysmon logs.
- Platform
- Splunk Enterprise
- Evidence
- O365 · Sysmon · Linux auth
- Method
- Timeline correlation · ATT&CK mapping
- Output
- 8 guided findings · remediation plan
In short
I correlated email, process and authentication logs to reconstruct the attack, found new accounts, group membership changes and port 1337 activity that pointed to persistence and command and control, and recommended changes to phishing prevention, account monitoring and network detection.
01 · Approach
How I investigated the attack.
I used SPL searches to filter suspicious events and compare related logs by time, then mapped the activity to MITRE ATT&CK.
- Scope the data. Identify the O365, Windows, Sysmon and Linux sources in the dataset.
- Filter. Use SPL searches to surface suspicious uploads, processes and logins.
- Correlate. Line related events up by time to see how the attack progressed.
- Map and report. Map the activity to ATT&CK and recommend defensive changes.
02 · Findings
What I found in the logs.
Persistence and access abuse
I found suspicious new accounts and changes to group membership, which suggested the attacker was trying to keep access.
Reconnaissance and C2 indicators
I checked activity on port 1337, traces of scanning tools and file hashes linked to suspicious programs.
03 · ATT&CK mapping
Techniques I mapped.
| Technique | Name | Tactic | Evidence |
|---|---|---|---|
| T1136.001 | Create Account: Local Account | Persistence | Suspicious new accounts |
| T1098.007 | Account Manipulation: Additional Local or Domain Groups | Persistence, Privilege Escalation | svcvnc added to the administrators group (Event 4732) |
| T1571 | Non-Standard Port | Command and Control | Activity on port 1337 |
| T1046 | Network Service Discovery | Discovery | Traces of scanning tools |
04 · Outcome
Findings and recommended fixes.
Attack timelineI put the events in order, from the first access through to account changes and scanning.
Recommended changesI recommended improvements to phishing prevention, account monitoring and network detection.