Boss of the SOC V1 - Web Defacement

Task: Today is Alice's first day at the Wayne Enterprises' Security Operations Center. Lucius sits Alice down and gives her first assignment: A memo from Gotham City Police Department (GCPD). Apparently GCPD has found evidence online (http://pastebin.com/Gw6dWjS9) that the website www.imreallynotbatman.com hosted on Wayne Enterprises' IP address space has been compromised. The group has multiple objectives... but a key aspect of their modus operandi is to deface websites in order to embarrass their victim. Lucius has asked Alice to determine if www.imreallynotbatman.com. (the personal blog of Wayne Corporations CEO) was really compromised.

Questions

Q1) What is the likely IPv4 address of someone from the Po1s0n1vy group scanning imreallynotbatman.com for web application vulnerabilities?

Let's begin by identifying the available indexes.

| eventcount summarize=false index=* | table index

Next, we will identify the available sourcetypes within the botsv1 index.

| metadata type=sourcetypes index="botsv1"

Now that we have identified the index and sourcetypes, let's proceed with retrieving the attacker's IP address responsible for scanning our website.

index="botsv1" sourcetype="stream:http" *imreallynotbatman.com*
| stats count by src_ip, dest_ip

We have identified two IP addresses that are generating an excessive number of requests to our website. Now, let's filter the logs for the IP address 40.80.148.42 to analyze its activity in detail.

index="botsv1" sourcetype="stream:http" *imreallynotbatman.com* src_ip="40.80.148.42"
| table src_ip, uri_path
| dedup uri_path

Answer: 40.80.148.42

Q2) What company created the web vulnerability scanner used by Po1s0n1vy? Type the company name.

Let's review the Suricata alerts to identify any valuable insights.

index="botsv1" sourcetype="suricata"  http.hostname="imreallynotbatman.com"
| stats count by src_ip, alert.signature

Answer: Acunetix

Q3) What content management system is imreallynotbatman.com likely using?

index="botsv1" sourcetype="stream:http"  *imreallynotbatman.com*
| table site, uri

Answer: Joomla

Q4) What is the name of the file that defaced the imreallynotbatman.com website? Please submit only the name of the file with extension?

Let's filter the logs based on the source IP address of our website.

index="botsv1" sourcetype="stream:http" src_ip="192.168.250.70" 
| table src_ip, uri

Answer: poisonivy-is-coming-for-you-batman.jpeg

Q5) This attack used dynamic DNS to resolve to the malicious IP. What fully qualified domain name (FQDN) is associated with this attack?

Now, let's utilize the sourcetype stream:dns to retrieve the Fully Qualified Domain Name (FQDN) associated with the malicious IP.

index="botsv1" sourcetype="stream:dns" 40.80.148.42

It did not return any results. Let's proceed with analyzing the attacker's second IP, which also sent a high volume of requests within a short timeframe.

index="botsv1" sourcetype="stream:dns" 23.22.63.114 
| table host_addr{}, name{}

Answer: prankglassinebracket.jumpingcrab.com

Q6) What IPv4 address has Po1s0n1vy tied to domains that are pre-staged to attack Wayne Enterprises?

Let's conduct a search on VirusTotal using the attacker's second IP address to gather any relevant intelligence.

Answer: 23.22.63.114

Q7) What IPv4 address is likely attempting a brute force password attack against imreallynotbatman.com?

index="botsv1" sourcetype="stream:http" src_ip=23.22.63.114 http_method=POST
| table src_ip, form_data

Answer: 23.22.63.114

Q8) What is the name of the executable uploaded by Po1s0n1vy? Answer guidance: Please include file extension. (For example, "notepad.exe" or "favicon.ico")

index=botsv1 sourcetype="stream:http" http_method=POST  *.exe

Answer: 3791.exe

Q9) What is the MD5 hash of the executable uploaded?

index=botsv1 sourcetype="xmlwineventlog:microsoft-windows-sysmon/operational" cmdline=*3791.exe* EventCode=1
| table Image, Hashes

Answer: AAE3F5A29935E6ABCC2C2754D12A9AF0

Q10) GCPD reported that common TTPs (Tactics, Techniques, Procedures) for the Po1s0n1vy APT group, if initial compromise fails, is to send a spear phishing email with custom malware attached to their intended target. This malware is usually connected to Po1s0n1vys initial attack infrastructure. Using research techniques, provide the SHA256 hash of this malware.

Let's conduct a search for the IP address 23.22.63.114 on VirusTotal to identify any associated files.

Let's click on the file named "MirandaTateScreensaver.scr.exe".

Answer: 9709473ab351387aab9e816eff3910b9f28a7a70202e250ed46dba8f820f34a8

Q11) What special hex code is associated with the customized malware discussed in question 11?

From the community tab:

Answer: 53 74 65 76 65 20 42 72 61 6e 74 27 73 20 42 65 61 72 64 20 69 73 20 61 20 70 6f 77 65 72 66 75 6c 20 74 68 69 6e 67 2e 20 46 69 6e 64 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 61 73 6b 20 68 69 6d 20 74 6f 20 62 75 79 20 79 6f 75 20 61 20 62 65 65 72 21 21 21

Q12) What was the first brute force password used?

index=botsv1 sourcetype="stream:http" src_ip=23.22.63.114 dest_ip=192.168.250.70 http_method=POST
| rex field=form_data "passwd=(?<Password>\w+)" 
| table _time, Password
| sort  _time

Answer: 12345678

Q13) One of the passwords in the brute force attack is James Brodsky's favorite Coldplay song. We are looking for a six character word on this one. Which is it?

index=botsv1 sourcetype="stream:http" src_ip=23.22.63.114 dest_ip=192.168.250.70 http_method=POST
| rex field=form_data "passwd=(?<Password>\w+)" 
| where len(Password) = 6
| table Password

Answer: yellow

Q14) What was the correct password for admin access to the content management system running "imreallynotbatman.com"?

index=botsv1 sourcetype="stream:http" http_method=POST
| rex field=form_data "passwd=(?<Password>\w+)" 
| stats count by Password

The only password that appears twice is "batman." Let's verify whether this was the password that granted the attacker access.

index=botsv1 sourcetype="stream:http" http_method=POST
| rex field=form_data "passwd=(?<Password>\w+)" 
| where Password="batman"
| table _time, src_ip, dest_ip, uri

The attacker initiated a brute-force attack using the IP address 23.22.63.114 to gain access to the admin account. Less than two minutes later, a successful login was recorded from a different IP address: 40.80.148.42.

Answer: batman

Q15) What was the average password length used in the password brute forcing attempt? Answer guidance: Round to closest whole integer. For example "5" not "5.23213"

index=botsv1 sourcetype="stream:http" http_method=POST
| rex field=form_data "passwd=(?<Password>\w+)" 
| eval password_length=len(Password)
| stats avg(password_length) as average_password_lenght

Answer: 6

Q16) How many seconds elapsed between the time the brute force password scan identified the correct password and the compromised login?

index=botsv1 sourcetype="stream:http" http_method=POST
| rex field=form_data "passwd=(?<Password>\w+)" 
| where Password="batman"
| transaction Password

index=botsv1 sourcetype="stream:http" http_method=POST
| rex field=form_data "passwd=(?<Password>\w+)" 
| where Password="batman"
| transaction Password
| table duration
| eval duration_time = round(duration, 2)

Answer: 92.17

Q17) How many unique passwords were attempted in the brute force attempt?

index=botsv1 sourcetype="stream:http" http_method=POST
| rex field=form_data "passwd=(?<Password>\w+)" 
| dedup Password
| stats count by Password

Answer: 412