# Skills Assessment

### Scenario

This skills assessment section builds upon the progress made in the `Intrusion Detection With Splunk (Real-world Scenario)` section. Our objective is to identify any missing components of the attack chain and trace the malicious process responsible for initiating the infection.

### Practical Exercises

1\) Navigate to http://\[Target IP]:8000, open the "Search & Reporting" application, and find through SPL searches against all data the process that created remote threads in rundll32.exe. Answer format: \_.exe

```
index="main" sourcetype="WinEventLog:Sysmon" EventCode=8 TargetImage=*rundll32.exe
| stats count by SourceImage, TargetImage
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Forinxi9nhP7xEoxBS7Ph%2FScreenshot(3).png?alt=media&#x26;token=327763c5-a665-4028-97eb-aee9a8425c0c" alt=""><figcaption></figcaption></figure>

Answer:  randomfile.exe

2\) Navigate to http://\[Target IP]:8000, open the "Search & Reporting" application, and find through SPL searches against all data the process that started the infection. Answer format: \_.exe

Answer:  rundll32.exe
