# GoldenSpray Lab
Q1) What's the attacker IP?
```splunk-spl
event.action: Logon AND event.outcome: failure
```
```splunk-spl
event.action: Logon AND event.outcome: failure AND winlog.event_data.IpAddress: "77.91.78.115"
```
Too many failed login attempts in a small time frame.
Answer: 77.91.78.115
Q2) What country is the attack originating from?
Answer: Finland
Q3) What's the compromised account username used for initial access?
```splunk-spl
event.action: Logon AND winlog.event_data.IpAddress: "77.91.78.115"
```
Answer: SECURETECH\mwilliams
Q4) What's the name of the malicious file utilized by the attacker for persistence on ST-WIN02?
Now we know that the attacker used the mwilliams user to gain initial access.
```splunk-spl
event.code: 11 AND "ST-WIN02" AND "mwilliams"
#OR
event.code: 1 AND "ST-WIN02" AND "mwilliams"
```
Answer: OfficeUpdater.exe
Q5) What's the full path used by the attacker for storing his tools?
Answer: C:\Users\Public\Backup\_Tools\\
Q6) What's the process ID of the tool responsible for dumping credentials on ST-WIN02?
```splunk-spl
event.code: 1 AND "ST-WIN02" AND "*mimikatz.exe"
```
Answer: 3708
Q7) What's the second account username the attacker compromised and used for lateral movement?
```splunk-spl
event.action: Logon AND winlog.event_data.IpAddress: "77.91.78.115"
```
Answer: SECURETECH\jsmith
Q8)
```splunk-spl
event.code: 1 AND "*schtasks.exe"
```
Answer: FilesCheck
Q9) What's the encryption type used in the environment Kerberos tickets?
Answer: RC4-HMAC
Q10) Can you provide the full path of the output file in preparation for data exfiltration?
```splunk-spl
event.code: 11 AND winlog.event_data.Image: *powershell AND "jsmith"
```
Answer: C:\Users\Public\Documents\Archive\_8673812.zip
.png?alt=media&token=86638d6c-2b71-49e6-866d-e01e55cf6229)
.png?alt=media&token=274faba6-60af-448b-89f5-18c059e9baa3)
.png?alt=media&token=3ebc2986-e134-4d9f-acd3-cba7fc86ef5b)
.png?alt=media&token=23ca8bd9-ec30-4ff4-927f-498782d6147d)
.png?alt=media&token=fd42ab77-35ce-4cf1-ad59-43f1167a4317)
.png?alt=media&token=5c5fb7e8-c858-4e22-8843-3997b2d43287)
.png?alt=media&token=9bcf712d-c4fb-40a1-8f81-afeeb0c47777)
.png?alt=media&token=22d45d94-8407-4a04-bb04-989f36ad227a)
.png?alt=media&token=24434436-eeab-4823-abaf-135df1929b58)
.png?alt=media&token=e42ddc29-2ea9-421e-b826-6e0656884144)