{"id":714,"date":"2025-12-05T21:53:00","date_gmt":"2025-12-05T21:53:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=714"},"modified":"2025-12-05T15:53:26","modified_gmt":"2025-12-05T15:53:26","slug":"aoc2025-room-3-did-you-siem","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=714","title":{"rendered":"AoC2025 Room 3 Did you SIEM"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/splunkforloganalysis-aoc2025-x8fj2k4rqp
Created by: tryhackme, Dex01, 1337rce<\/p>\n\n\n\n

In this room we get to help the SOC team for the The Best Festival Company (TBFC) with one of the most popular SOC tools: Splunk! You will spin up your virtual environment then launch the provided hyperlink to the Splunk SIEM in your browser. It might take couple of minutes to make a full connection. Though this room has a medium difficulty, it’s very guided and they break everything down if this is the first time you are using Splunk or need a refresher(like me!).<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In order to filter out routine web traffic, such as Mozilla and Chrome, THM has us use this filter.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

With the next step instructed, we have obtained our first answer for the question, “What is the attacker IP found attacking and compromising the web server?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now that we know the IP source of the evil bunnies, it’s time to narrow down our search! THM gives us various search queries to use to look at different things.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Path traversal!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

There are various ways of coming across the answer for the 2nd question, “Which day was the peak traffic in the logs? (Format: YYYY-MM-DD)”, But when you are on any of the longer filters that THM provides, go back under Events and click date_mday > 12.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Looking at the firewall logs.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Going out of order, but with the last filter given, this is the answer to the question of “Examine the firewall logs. How many bytes were transferred to the C2 server IP from the compromised web server?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

For the question, “What is the count of Havij user_agent events found in the logs?” I combined various filters. You could also do “stats count by user_agent.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

For “How many path traversal attempts to access sensitive files on the server were observed?”, I used a previous command from earlier.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

And that’s it! Of course, with the Advent of Cyber rooms, THM has various cyber enthusiasts cover the rooms, and I definitely recommend MadHats video coverage of the room. He breaks down everything more than the room itself does, and it’s only 16 minutes: https:\/\/www.youtube.com\/watch?v=0cuAsDTfNbA. THM also links to another Splunk room(apparently over 300 minutes to finish it, so that’s a lot of Splunk content!) https:\/\/tryhackme.com\/room\/splunk201.<\/p>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/splunkforloganalysis-aoc2025-x8fj2k4rqpCreated by: tryhackme, Dex01, 1337rce In this room we get to help the SOC team for the The Best Festival Company (TBFC) with one of the most popular SOC tools: Splunk! You will spin up your virtual environment then launch the provided hyperlink to the Splunk SIEM in your browser. It might take couple of […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-714","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=714"}],"version-history":[{"count":3,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/714\/revisions"}],"predecessor-version":[{"id":729,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/714\/revisions\/729"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}