Analyzing Attacker Recon to Malware Installation with Splunk

[@DayCyberwox]

🙌🏽Thanks for watching! Timestamps below:
⏰TIMESTAMPS:
00:00 Intro
00:40 Scenario
01:25 Splunk
01:43 Orienting Ourselves With The Data
04:28 Investigating Reconnaissance
13:02 The Suricata Alert
13:47 The Content Management System (CMS)
14:22 The Web Scanner
14:53 The Compromised Server
15:41 Investigating Exploitation
26:52 Extracting Credentials using Regex
28:34 Understanding The Regex
31:20 The User Agent
33:09 The URI
33:20 The Username
34:05 The Password
34:47 Unique Passwords
35:06 Splunk Uniq Command?
36:15 Dedup!
36:46 The Bruteforcing IP
37:04 The Login IP
37:34 Investigation Installation
40:00 Was The Malware Executed?
42:46 The Malware Hash
43:45 Who Executed The Malware?
44:07 VirusTotal Analysis

[@krisg900]

Do you think OSCP is good for threat hunters? I see it listed on job posts?

[@Adivasi7777]

When doing certs, do what HR nuts ask for. You will be hired.

[@krisg900]

@@Adivasi7777 I've seen some asking for oscp for threat hunters. It seems a little extreme but I've that those in posts.

[@Adivasi7777]

@@krisg900 I would say you do Splunk too bro

[@krisg900]

@@Adivasi7777 Splunk certs?

[@DayCyberwox]

OSCP’s not typically asked for in such jobs but it could give you an edge over other candidates. I don’t think you’ll go wrong with it.