The Detection Lab project was used to learn and practice a SIEM environment, for detecting and analyzing log files from a malware attack. This project was conducted between two virtual machines using Kali Linux for the attacking machine and Windows 10 for the target. Chosen SIEM environment is Splunk connected with Windows sysmon.
- Understanding of SIEM environment and application.
- Proficiency in analyzing network logs.
- Ability to generate and recognize attacks.
- Knowledge of network protocols and security vulnerabilities.
- Development of critical thinking and problem-solving skills in cybersecurity.
- Splunk
- Windows Sysmon
- Windows 10
- Kali Linux
- Metasploit
- NMAP
- MSFvenom
- Powershell
- Python
- Virtual Machines
Running NMAP to scan target computer reveals open ports for vulnerabilities (Ref 1). Chosen method of attack is a reverse TCP from a malicious file (Resume.pdf), hosted on a false website (port 9999) by the attacker (Ref 2, Ref 4, Ref 5). Reverse TCP is hosted on attacking computer on port 4444 (Ref 3). When connection is established, the commands "ipconfig", "netuser", "netlocalgroup" are run on the target shell (Ref 6, Ref 7). Commands generate telemetry which can be seen and analyzed on the splunk SIEM environment (Ref 8, Ref 9)
Ref 1: NMAP scan results of target computer
Ref 2: Creating malware with MSFVENOM
Ref 3: Setting up and starting Multihandler through Metasploit
Ref 4: Hosting false website using attacking computer on port 9999
Ref 5: Link to file and downloaded file on target computer
Ref 6: Successfully connection to target computer and running shell
Ref 7: Running shell commands "ipconfig", "netuser", and "netlocalgroup" on target machine's shell
Ref 8: Searching Splunk for Resume.exe and its ParentProcessGUID
Ref 9: Splunk data on shell commands run from attacking machine
