PS ECLIPSE
https://tryhackme.com/room/posheclipse
One of the most popular SIEM tools in businesses is Splunk. It provides centralized analytics and log management. Security researchers can analyze malware using Splunk’s log data collection. Organizations may manage and investigate cyber threats like ransomware with the aid of SIEM software like Splunk, which functions as a threat intelligence tool.
This document examines the problems in a Tryhackme room called “PS eclipse” to explain the procedures for analyzing events compiled by Splunk.
1. You need to download open VPN connect and install it in your work station. That will give you access to the room when you start the machine.
2. Go to tryhackme public room and search for PS ECLIPSE
3. Start the machine and copy the IP ADDRESS
4. Paste the IP ADDRESS on a web page, and a Splunk site will open (sometimes, it gives an error message due to a high level of traffic, but you keep trying) remember also that if your VPN is not on, it will not connect.
5. At the Splunk site, click “search and reporting”.
6. At search, input “*”, select “all time”, and click search.
7. Now we have all the information injected into Splunk, lets go ahead and solve the questions in the tryhackme room “PS ECLIPSE”
1. A suspicious binary was downloaded to the endpoint. What was the name of the binary?
Checking the source port means with the number of counts will show you that there is activity between the internet and the source system. Clicking on port 443 with the number of highest counts, then selecting the destination IP will show you all the machines it has been contacting. Select the image and the executable file will show.
2. What is the address the binary was downloaded from? Add http:// to your answer & defang the URL?
After finding out that the power shell was used download the file, open PowerShell then go to the command line, and you will see the base 64 strings.
Copy the strings and paste on cybershef, decode the text from base 64 to UTF 16-LE(1200).
Question 3
What Windows executable was used to download the suspicious binary? Enter full path.
From the PowerShell, look for the parent image. That will bring the show you the path.
Get Henry Mba’s stories in your inbox
Join Medium for free to get updates from this writer.
Question 4
What command was executed to configure the suspicious binary to run with elevated privileges?
Look for any instances where the suspicious file or the system privileges have changed.
Question 5
What permissions will the suspicious binary run as? What was the command to run the binary with elevated privileges?
The command should be [NT AUTHORITY\SYSTEM;”C:\Windows\system32\schtasks.exe” /Create /TN OUTSTANDING_GUTTER.exe /TR]
Question 6
The suspicious binary connected to a remote server. What address did it connect to? Add http:// to your answer & defang the URL.
Under the name of the binary, you query so that the remote serve address will show.
Then you go ahead and defang the query name.
Question 7
A PowerShell script was downloaded to the same location as the suspicious binary. What was the name of the file?
Question 8
The malicious script was flagged as malicious. What do you think was the actual name of the malicious script?
With the help of the command “powershell| rare limit=20 TargetFilename”, it shows that blacksun was repeated so many times. It reveals what an attacker hides the real name of the scripts run by powershell.
Question 9
A ransomware note was saved to disk, which can serve as an IOC. What is the full path to which the ransom note was saved?
From the search box, type .txt to locate events that have file extension of .txt
Then check the Target file name.
Question 10
The script saved an image file to disk to replace the user’s desktop wallpaper, which can also serve as an IOC. What is the full path of the image?
From the search, look for the file with a .jpg extension. Blacksun appears with the jpg extension.
