{"id":969,"date":"2025-12-17T19:49:00","date_gmt":"2025-12-17T19:49:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=969"},"modified":"2025-12-17T15:50:02","modified_gmt":"2025-12-17T15:50:02","slug":"aoc-2025-day-15-web-attack-forensics-drone-alone","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=969","title":{"rendered":"AoC 2025 – Day 15 – Web Attack Forensics – Drone Alone"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/webattackforensics-aoc2025-b4t7c1d5f8
Created by: tryhackme, strategos, marouane.elgorfte360<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Per THM, “Splunk is a platform for collecting, storing, and analyzing machine data. It provides various tools for analyzing data, including search, correlation, and visualization. It is a powerful tool that organizations of all sizes can use to improve their IT operations and security posture.”

Before reading the material, go ahead and load both VMs. Once the attacker machine is loaded, launch Firefox and enter the address given to launch Splunk. Make sure you change your time range and keep an eye on it, or it will not populate results. At first, I tried 7 days, but nothing would populate, so best to keep it on “All time”.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

THM points out that these are signs of attempted command execution. We are tasked with copying and pasting the string linked to PowerShell.exe to this site: https:\/\/www.base64decode.org\/ and decoding it. Doing so reveals the message: This is now Mine! MUAHAAHAA.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We are now tasked with looking at the web server error logs with a new query. The web server is Apache. Per THM, “Apache is the most widely used web server software. Developed and maintained by the Apache Software Foundation, Apache is an open source software available for free.” With this command, make sure to change it to the Raw format from the View dropdown. Again, we see the PowerShell.exe displayed.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next, we will look at Sysmon logs. Per THM, “Sysmon refers to System Monitor, which is a Windows system service and device driver developed by Microsoft that is designed to monitor and log various events happening within a Windows system.” Change the View: tab to View: Table.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next, we will look at Sysmon logs. Per THM, “Sysmon refers to System Monitor, which is a Windows system service and device driver developed by Microsoft that is designed to monitor and log various events happening within a Windows system.” Change the View: tab to View: Table.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We make sure our final query returns with “No results found” to confirm are defenses are correctly configured.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

This was a simple room that shows the power of Splunk and query’s. I recommend watching the THM walkthrough from CYBERWOX: https:\/\/www.youtube.com\/watch?v=Gf68YnVjy7k. He breaks down the query’s and elaborates on a lot of things the room does not cover.<\/p>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/webattackforensics-aoc2025-b4t7c1d5f8Created by: tryhackme, strategos, marouane.elgorfte360 Per THM, “Splunk is a platform for collecting, storing, and analyzing machine data. It provides various tools for analyzing data, including search, correlation, and visualization. It is a powerful tool that organizations of all sizes can use to improve their IT operations and security posture.” Before reading the material, go […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-969","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/969","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=969"}],"version-history":[{"count":2,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/969\/revisions"}],"predecessor-version":[{"id":980,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/969\/revisions\/980"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=969"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}