Advanced APT Hunting with Splunk

Thank you for attending Advanced APT Hunting with Splunk. We hope you found it helpful.
Below are reference materials and links that were found throughout the workshop.

Depending on how many of the hunts you performed, some of these links may be more
relevant than others. For grouping purposes, links are grouped by hunt.

While the BOTSv2 data set and app that we used is not yet available, if you are interested in
hunting and investigating a Splunk BOTS data set, you have a few options. Below are links to
blogs and the data sets where you can learn more about downloading your own copy or using
our sandbox.

BOTS version 1 data set

Blog: https://www.splunk.com/blog/2018/05/10/boss-of-the-soc-scoring-server-questions-and-
answers-and-dataset-open-sourced-and-ready-for-download.html
Data Set: http://explore.splunk.com/BOTS_1_0_datasets
Companion investigating app: https://splunkbase.splunk.com/app/3985/

Sandbox with the Data Set

Blog: https://www.splunk.com/blog/2018/05/03/introducing-the-security-datasets-
project.html
Sandbox Site: http://live.splunk.com/splunk-security-dataset-project

Apps used during the workshop

Enterprise Security: https://splunkbase.splunk.com/app/263/
SA-Investigator: https://splunkbase.splunk.com/app/3749/
Sankey Visualization: https://splunkbase.splunk.com/app/3112/
URL Toolbox: https://splunkbase.splunk.com/app/2734/

If you want to learn more about some of the techniques that we touched on, check out the
Hunting with Splunk! Blog Series:
https://www.splunk.com/blog/2017/07/06/hunting-with-splunk-the-basics.html

Hunt 0
Quick search to get a list of all sourcetypes in a specific index and when they were first seen and
last seen

| metadata type=sourcetypes index=botsv2

| eval firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S")
| eval lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S")
| eval recentTime=strftime(recentTime,"%Y-%m-%d %H:%M:%S")
| sort - totalCount

Last Updated: December 2018 1

PowerShell Hunt
PowerShell: https://docs.microsoft.com/en-
us/powershell/scripting/overview?view=powershell-6

PowerShell Empire: https://www.powershellempire.com/

Github site for PowerShell Empire: https://github.com/EmpireProject/Empire

Web Application Vulnerability Scanner: https://w3af.org

PowerShell.exe Command-Line Help: https://docs.microsoft.com/en-

us/powershell/scripting/core-powershell/console/powershell.exe-command-line-
help?view=powershell-6

CyberChef: https://gchq.github.io/CyberChef

List of FTP commands for the Microsoft command-line FTP client:

http://www.nsftools.com/tips/MSFTP.htm

WHOAMI utility in Windows 7/8/10 and its use, syntax, commands:

https://www.thewindowsclub.com/whoami-windows

Wevtutil Command Reference: https://docs.microsoft.com/en-us/windows-

server/administration/windows-commands/wevtutil

Quickly Turn ON/OFF Windows Firewall Using Command Line:

http://techgenix.com/quicklyturnonoffwindowsfirewallusingcommandline/

Command-line build with csc.exe: https://docs.microsoft.com/en-us/dotnet/csharp/language-

reference/compiler-options/command-line-building-with-csc-exe

NET.exe Share
https://ss64.com/nt/net-share.html

MITRE ATT&CK Techniques Referenced

PowerShell - https://attack.mitre.org/wiki/Technique/T1086
Commonly Used Port - https://attack.mitre.org/techniques/T1043/
Data Encoding - https://attack.mitre.org/techniques/T1132/
Exfiltration Over Alternative Protocol - https://attack.mitre.org/techniques/T1048/
System Owner/User Discovery - https://attack.mitre.org/techniques/T1033/
Disabling Security Tools - https://attack.mitre.org/techniques/T1089/
Scheduled Task - https://attack.mitre.org/techniques/T1053/
Data from Network Shared Drive - https://attack.mitre.org/techniques/T1039/

Last Updated: December 2018 2

Data Exfiltration – FTP
File Info on specific file extensions: https://fileinfo.com/extension/

MITRE ATT&CK Techniques Referenced

Exfiltration Over Alternative Protocol - https://attack.mitre.org/techniques/T1048/
Commonly Used Port - https://attack.mitre.org/techniques/T1043/
Remote File Copy - https://attack.mitre.org/techniques/T1105/
PowerShell - https://attack.mitre.org/wiki/Technique/T1086
Scripting - https://attack.mitre.org/techniques/T1064/

Data Exfiltration – DNS

Whois: http://whois.domaintools.com/hildegardsfarm.com

RiskIQ Community Edition: https://community.riskiq.com/login

MITRE Techniques Referenced

Exfiltration Over Alternative Protocol - https://attack.mitre.org/techniques/T1048/
Commonly Used Port - https://attack.mitre.org/techniques/T1043/

Adversary Infrastructure
Censys.IO: http://Censys.io

Robtex: https://www.robtex.com/ip-lookup/45.77.65.211

MITRE ATT&CK Technique Referenced

Acquire and/or use 3rd party infrastructure services -
https://attack.mitre.org/techniques/T1329/

Spearphising Attachment
MIME Types: https://developer.mozilla.org/en-
US/docs/Web/HTTP/Basics_of_HTTP/MIME_types

Whois: https://whois.domaintools.com/

CyberChef: https://gchq.github.io/CyberChef

VirusTotal: https://www.virustotal.com/#/home/search

MITRE ATT&CK Techniques Referenced

Acquire and/or use 3rd party software services -
https://attack.mitre.org/techniques/T1330/

Last Updated: December 2018 3

 Spearphishing Attachment - https://attack.mitre.org/techniques/T1193/

User Execution
Phishing with Empire (Blog): https://enigma0x3.net/2016/03/15/phishing-with-empire/

MITRE ATT&CK Techniques

PowerShell - https://attack.mitre.org/techniques/T1086/
User Execution - https://attack.mitre.org/techniques/T1204/

Account Persistence
Windows Command Reference: https://docs.microsoft.com/en-us/windows/security/threat-
protection/auditing/event-4720

Ultimate Windows Security Event Code Reference:

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=464
8

MITRE ATT&CK Technique Referenced

Create Account - https://attack.mitre.org/techniques/T1136/

Scheduled Tasks
Schtasks.exe command reference:
https://msdn.microsoft.com/en-us/library/windows/desktop/bb736357(v=vs.85).aspx

MITRE ATT&CK Techniques Referenced

Scheduled Task - https://attack.mitre.org/techniques/T1053/
PowerShell - https://attack.mitre.org/wiki/Technique/T1086
Data Encoding - https://attack.mitre.org/techniques/T1132/

Clearing Audit Logs

Wevtutil Command Reference: https://docs.microsoft.com/en-us/windows-
server/administration/windows-commands/wevtutil

MITRE ATT&CK Techniques

Indicator Removal On Host - https://attack.mitre.org/techniques/T1070/
PowerShell - https://attack.mitre.org/wiki/Technique/T1086
Data Encoding - https://attack.mitre.org/techniques/T1132/

Reconnaissance
What is my browser: https://whatismybrowser.com

Last Updated: December 2018 4

Web browser language identification codes: https://www.metamodpro.com/browser-
language-codes

Whois: https://whois.domaintools.com/

RIPE Database Query: https://apps.db.ripe.net/db-web-ui/#/query

ExpressVPN: https://www.expressvpn.com/

MITRE ATT&CK Technique Referenced

Acquire and/or use 3rd party infrastructure services -
https://attack.mitre.org/techniques/T1329/

Acquire OSINT Data Sets and Information

MIME Types: https://developer.mozilla.org/en-
US/docs/Web/HTTP/Basics_of_HTTP/MIME_types

MITRE Technique Referenced

Acquire OSINT data sets and information - https://attack.mitre.org/techniques/T1277/

Lateral Movement
Detecting Lateral Movement through Tracking Event Logs:
http://www.jpcert.or.jp/english/pub/sr/Detecting%20Lateral%20Movement%20through%20Tr
acking%20Event%20Logs_version2.pdf

JPCERT/CC Tool Analysis Result Sheet: https://jpcertcc.github.io/ToolAnalysisResultSheet/

Hunting Lateral Movement in Windows Infrastructure:

https://www.slideshare.net/votadlos/hunting-lateral-movement-in-windows-infrastructure

PowerShell Empire Invoke-WMI: https://www.powershellempire.com/?page_id=124

MITRE ATT&CK Techniques Referenced

Windows Management Instrumentation - https://attack.mitre.org/techniques/T1047/
PowerShell - https://attack.mitre.org/techniques/T1086/
Data Encoding - https://attack.mitre.org/techniques/T1132/

Data Staging
MITRE ATT&CK Techniques Referenced
Data Staged - https://attack.mitre.org/techniques/T1074/

Last Updated: December 2018 5

 Remote File Copy - https://attack.mitre.org/techniques/T1105/
Exfiltration Over Alternative Protocol - https://attack.mitre.org/techniques/T1048/

Additional Reading and Resources

SANS - The Who, What, Where, When, Why and How of Effective Threat Hunting:
https://www.sans.org/reading-room/whitepapers/analyst/who-what-where-when-effective-
threat-hunting-36785

NIST 800-61: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Pyramid of Pain: https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

Intelligence-Driven Incident Response: Outwitting the Adversary

Scott J. Roberts and Rebekah Brown
https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary-
ebook/dp/B074ZRN5T7/ref=sr_1_fkmr0_1?ie=UTF8&qid=1545175707&sr=8-1-fkmr0

Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns

and Intrusion Kill Chains
https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-
White-Paper-Intel-Driven-Defense.pdf

The Design and Philosophy of ATT&CK

https://www.mitre.org/publications/technical-papers/mitre-attack-design-and-philosophy

The Diamond Model of Intrusion Analysis

http://www.dtic.mil/dtic/tr/fulltext/u2/a586960.pdf

Applying the Diamond Model to Star Wars (Blog)

https://threatconnect.com/blog/diamond-model-threat-intelligence-star-wars/

Threat Hunting Webshells with Splunk, James Bower (Video)

https://www.youtube.com/watch?v=FEb8KZoEyzI

Building Threat Hunting Strategies with the Diamond Model:

http://www.activeresponse.org/building-threat-hunting-strategy-with-the-diamond-model/

Documentation Links for Search Commands Used:

Eval: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval
Fields: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/fields
Metadata: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/metadata
Reverse: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/reverse
Rex: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex

Last Updated: December 2018 6

Search: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/search
Sort: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/sort
Stats: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/stats
Table: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/table
Tstats: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/tstats
Timechart: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart
Transaction:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transaction
Transpose: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/transpose

Splunk Quick Reference: https://www.splunk.com/pdfs/solution-guides/splunk-quick-

reference-guide.pdf

Splunk Search Reference:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual

Last Updated: December 2018 7