{
    "id": "1b4bae46-82fe-4730-b1d5-da3503acaa35",
    "name": "Log Analysis",
    "slug": "log-analysis",
    "status": "published",
    "lab_type": "pta",
    "is_sample": false,
    "duration_in_seconds": 1800,
    "metadata": {
        "courses": [
            "1c059cf9-e0a3-4d5f-8aa9-cbfc8e5981ed",
            "7f61cf50-ad65-4cb5-93a3-3e31e1f5427a",
            "ab8b0afc-b7d8-4280-95c6-5b9e813f76e1"
        ],
        "pta_sdn": "770",
        "collections": [],
        "pta_namespace": "my.ine",
        "learning_paths": [],
        "has_published_parent": true
    },
    "session": null,
    "company": "a491bc32-c056-4946-9169-cc053387bada",
    "created": "2023-03-03T15:04:33.744509Z",
    "modified": "2025-06-30T21:22:31.730897Z",
    "is_beta": false,
    "lab_objectives": [],
    "main_learning_area": null,
    "learning_areas": [
        {
            "id": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
            "name": "Cyber Security",
            "slug": "cyber-security"
        }
    ],
    "categories": [],
    "tags": [],
    "difficulty": "novice",
    "is_web_access": false,
    "is_lab_experience": false,
    "is_featured": false,
    "cve": null,
    "severity": null,
    "year": null,
    "classification": null,
    "is_trackable": false,
    "cpe_credits": null,
    "is_skill_check": false,
    "external_url": "",
    "solution_video": null,
    "explanation_video": null,
    "description": "# Introduction\n\nIn this lab, you'll take a look at logs that have already been sent to the Splunk instance, performing analysis on them in an attempt to build actionable intelligence for next steps.  All required IPs and credentials for this lab are listed below.\n\n**Lab Information**\n\n| Server | IP |\n| --- | --- |\n| DC01 | 172.31.115.100 |\n| SERVER01 | 172.31.115.110 |\n| LINUX01 | 172.31.115.111\n\n| Location/Purpose | Username | Password |\n| --- | --- | --- |\n| Domain Admin | ine\\labadmin | K5+peE#5q+&WJ^c# |\n| Linux Server | labadmin | TTnxyAn5=jRd3R |",
    "description_html": "<h1>Introduction</h1>\n<p>In this lab, you'll take a look at logs that have already been sent to the Splunk instance, performing analysis on them in an attempt to build actionable intelligence for next steps.  All required IPs and credentials for this lab are listed below.</p>\n<p><strong>Lab Information</strong></p>\n<table>\n<thead>\n<tr>\n<th>Server</th>\n<th>IP</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>DC01</td>\n<td>172.31.115.100</td>\n</tr>\n<tr>\n<td>SERVER01</td>\n<td>172.31.115.110</td>\n</tr>\n<tr>\n<td>LINUX01</td>\n<td>172.31.115.111</td>\n</tr>\n</tbody>\n</table>\n<table>\n<thead>\n<tr>\n<th>Location/Purpose</th>\n<th>Username</th>\n<th>Password</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Domain Admin</td>\n<td>ine\\labadmin</td>\n<td>K5+peE#5q+&amp;WJ^c#</td>\n</tr>\n<tr>\n<td>Linux Server</td>\n<td>labadmin</td>\n<td>TTnxyAn5=jRd3R</td>\n</tr>\n</tbody>\n</table>",
    "tasks": "# Tasks\n\nYou have been tasked with analyzing existing logs on a Splunk platform to identify the origin of suspicious activity on a Linux server.  Your objective is to build a story regarding what has occured on the server, and use that information to plan out required next steps.\n\n1. Perform searches in Splunk to identify potential suspicious or malicious activity\n2. Based on the data found, identify any gaps in logging that may exist\n3. Plan out next steps, which should be determined by the results of the log analysis",
    "tasks_html": "<h1>Tasks</h1>\n<p>You have been tasked with analyzing existing logs on a Splunk platform to identify the origin of suspicious activity on a Linux server.  Your objective is to build a story regarding what has occured on the server, and use that information to plan out required next steps.</p>\n<ol>\n<li>Perform searches in Splunk to identify potential suspicious or malicious activity</li>\n<li>Based on the data found, identify any gaps in logging that may exist</li>\n<li>Plan out next steps, which should be determined by the results of the log analysis</li>\n</ol>",
    "published_date": "2023-10-04T15:56:43.323013Z",
    "solutions": "# Solutions\n\n**Step 1 - Start the initial search in Splunk:**  \n\nOpen up Splunk and type the following into the search bar to return all events for the Linux server:\n\n`index=* host=linux01`\n\nMake sure you set the time range to **All time**\n\n![All time](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/2.png)\n\n![Splunk search](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/1.png)\n\nWe want to narrow down the type of logs we're looking at to only *syslog* types.  On the left-hand side, click on *sourcetype* and then click *syslog* to further filter the search.\n\n![syslog](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/3.png)\n\nNext, we want to further narrow the search to only authentication/authorization logs (to begin with).  Click on *source* on the left, and then */var/log/auth.log* to filter even further.\n\n![auth.log](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/4.png)\n\nLook through the logs to see if you can identify anything \"malicious\".\n\nYou should see at least one entry referencing an account named **maliciousaccount**\n\n![maliciousaccount](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/5.png)\n\nIf you expand this event, you will notice that there is no individual field that references this account name.  This would be our first identified hole in our logging that should be corrected.\n\nHowever, we can still easily filter based on this account name.  Simply click on *maliciousaccount* in the entry, and click on *Add to search*.  Alternatively, you can append *maliciousaccount* to the end of the search query, so that it would look like this:\n\n`index=* host=linux01 sourcetype=syslog source=\"/var/log/auth.log\" maliciousaccount`\n\nEither method will accomplish the same result\n\n![Add maliciousaccount to search](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/6.png)\n\nAgain, look through the log entries.  We want to identify where this account came from.  Who created it?\n\nWe can see an event where *newadmin* used the command *adduser* to create *maliciousaccount*\n\n![maliciousaccount created](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/7.png)\n\nBefore you move on, look through the rest of the log entries to identify what *maliciousaccount* may have done and where this account may have logged in from.\n\nAfter you have identified those items, let's adjust the search to see what *newadmin* has been doing, and where that account came from as well.  Edit your search to look like the following:\n\n`index=* host=linux01 sourcetype=syslog source=\"/var/log/auth.log\" newadmin`\n\nAfter this search completes, we should see several interesting entries:\n\n![newadmin creation](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/8.png)\n\n![newadmin sudo add](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/9.png)\n\n![labadmin su to newadmin](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/10.png)\n\n![maliciousaccount creation](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/11.png)\n\nThese 4 entries begin to tell a story:\n\n- The account *labadmin* created *newadmin*\n- *labadmin* gave *newadmin* sudo permissions, by adding them to the sudo group\n- *labadmin* then switched users to *newadmin*, and created the *maliciousaccount* account\n\nThis leads us to believe that the *labadmin* account has been compromised and the attacker was attempting to cover their tracks by creating chained users.\n\nIf we go back to the results for *maliciousaccount*, we can also see that this account successfully logged in to LINUX01 using SSH from 172.31.115.100, which is our domain controller!\n\n![DC login](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/12.png)\n\nAt this point, we have identified that there are several possible points of compromise:\n\n- labadmin\n- newadmin\n- maliciousaccount\n- DC01\n\n**Step 2 - Identify any other suspicious activity related to *maliciousaccount*:**\n\nNow, let's adjust our search timeframe to reflect anything within 5 minutes before and after *maliciousaccount* logged in to the server.  To do this, find that entry in the list and click on the *Time*.  Adjust the filter to show **+/- 5 minutes**\n\n![Adjust timeframe](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/13.png)\n\nSince we want to look at *any* logs around that time, let's also remove *maliciousaccount* from the search query, so it should now look like this:\n\n`index=* host=linux01 sourcetype=syslog source=\"/var/log/auth.log\"`\n\nLook through the resulting events and see if you can identify any additional useful information.  Remember, the goal here is to gather **actionable** information.\n\nWe're not seeing a lot of new information here, so let's expand our search to show us other types of logs.  Remove *source=\"/var/log/auth.log\"* from the search query.  It should now look like this:\n\n`index=* host=linux01 sourcetype=syslog`\n\nWe will naturally see a lot more unrelated data in our logs, since we have widened our search terms - this is expected and desired.  We are trying to identify any other general information that can expand or support the story we are building.\n\nIf you don't see any additional information to support your efforts, try removing the *sourcetype* from the query as well.  Let's also add in *maliciousaccount* to the query again.  We're doing this because we've expanded the types of logs we're seeing, so we want to narrow down on that specific term again.\n\nYour search query should now look like this:\n\n`index=* host=linux01 maliciousaccount`\n\nNot seeing any new information?  Let's remove *maliciousaccount* from the query then.  Remember, we're still narrowed down to logs within 5 minutes before and after the *maliciousaccount* logged in from DC01.\n\n`index=* host=linux01`\n\nWe're still not overwhelemed by the logs at this point, because of that narrowed timeframe in the search.  However, **NOW** we're seeing some interesting information:\n\n![malware_file](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/14.png)\n\n![malware_file](https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/15.png)\n\nOur attacker made this pretty obvious didn't they?\n\nAt this point, we've put together an interesting timeline of events:\n\n1. *labadmin* (possibly compromised) created *newadmin*\n2. *labadmin* switched users to act as *newadmin*\n3. *newadmin* then created *maliciousaccount*\n4. *maliciousaccount* logged in from DC01 using SSH (DC01 possibly compromised)\n5. *maliciousaccount* created/uploaded some form of malware on LINUX01\n\nWe also have some possible next steps based on this information:\n\n- Disable *labadmin*, *newadmin*, and *maliciousaccount* accounts\n- Evaluate which of those accounts are legitimate and are needed.  Change passwords and secure as necessary.\n- If possible, take DC01 offline for further investigation.  This is only possible if there are other, redundant domain controllers.  If we can't disconnect it from the network, then **IMMEDIATE** further investigation is required.\n- Do the same with LINUX01, since it is possibly compromised with malware\n\nFeel free to investigate further to see if you can identify any other activity that may have taken place on this server.  Experiment with different search criteria, including using some wildcards in your searches (*).",
    "solutions_html": "<h1>Solutions</h1>\n<p><strong>Step 1 - Start the initial search in Splunk:</strong>  </p>\n<p>Open up Splunk and type the following into the search bar to return all events for the Linux server:</p>\n<p><code>index=* host=linux01</code></p>\n<p>Make sure you set the time range to <strong>All time</strong></p>\n<p><img alt=\"All time\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/2.png\" /></p>\n<p><img alt=\"Splunk search\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/1.png\" /></p>\n<p>We want to narrow down the type of logs we're looking at to only <em>syslog</em> types.  On the left-hand side, click on <em>sourcetype</em> and then click <em>syslog</em> to further filter the search.</p>\n<p><img alt=\"syslog\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/3.png\" /></p>\n<p>Next, we want to further narrow the search to only authentication/authorization logs (to begin with).  Click on <em>source</em> on the left, and then <em>/var/log/auth.log</em> to filter even further.</p>\n<p><img alt=\"auth.log\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/4.png\" /></p>\n<p>Look through the logs to see if you can identify anything \"malicious\".</p>\n<p>You should see at least one entry referencing an account named <strong>maliciousaccount</strong></p>\n<p><img alt=\"maliciousaccount\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/5.png\" /></p>\n<p>If you expand this event, you will notice that there is no individual field that references this account name.  This would be our first identified hole in our logging that should be corrected.</p>\n<p>However, we can still easily filter based on this account name.  Simply click on <em>maliciousaccount</em> in the entry, and click on <em>Add to search</em>.  Alternatively, you can append <em>maliciousaccount</em> to the end of the search query, so that it would look like this:</p>\n<p><code>index=* host=linux01 sourcetype=syslog source=\"/var/log/auth.log\" maliciousaccount</code></p>\n<p>Either method will accomplish the same result</p>\n<p><img alt=\"Add maliciousaccount to search\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/6.png\" /></p>\n<p>Again, look through the log entries.  We want to identify where this account came from.  Who created it?</p>\n<p>We can see an event where <em>newadmin</em> used the command <em>adduser</em> to create <em>maliciousaccount</em></p>\n<p><img alt=\"maliciousaccount created\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/7.png\" /></p>\n<p>Before you move on, look through the rest of the log entries to identify what <em>maliciousaccount</em> may have done and where this account may have logged in from.</p>\n<p>After you have identified those items, let's adjust the search to see what <em>newadmin</em> has been doing, and where that account came from as well.  Edit your search to look like the following:</p>\n<p><code>index=* host=linux01 sourcetype=syslog source=\"/var/log/auth.log\" newadmin</code></p>\n<p>After this search completes, we should see several interesting entries:</p>\n<p><img alt=\"newadmin creation\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/8.png\" /></p>\n<p><img alt=\"newadmin sudo add\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/9.png\" /></p>\n<p><img alt=\"labadmin su to newadmin\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/10.png\" /></p>\n<p><img alt=\"maliciousaccount creation\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/11.png\" /></p>\n<p>These 4 entries begin to tell a story:</p>\n<ul>\n<li>The account <em>labadmin</em> created <em>newadmin</em></li>\n<li><em>labadmin</em> gave <em>newadmin</em> sudo permissions, by adding them to the sudo group</li>\n<li><em>labadmin</em> then switched users to <em>newadmin</em>, and created the <em>maliciousaccount</em> account</li>\n</ul>\n<p>This leads us to believe that the <em>labadmin</em> account has been compromised and the attacker was attempting to cover their tracks by creating chained users.</p>\n<p>If we go back to the results for <em>maliciousaccount</em>, we can also see that this account successfully logged in to LINUX01 using SSH from 172.31.115.100, which is our domain controller!</p>\n<p><img alt=\"DC login\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/12.png\" /></p>\n<p>At this point, we have identified that there are several possible points of compromise:</p>\n<ul>\n<li>labadmin</li>\n<li>newadmin</li>\n<li>maliciousaccount</li>\n<li>DC01</li>\n</ul>\n<p><strong>Step 2 - Identify any other suspicious activity related to <em>maliciousaccount</em>:</strong></p>\n<p>Now, let's adjust our search timeframe to reflect anything within 5 minutes before and after <em>maliciousaccount</em> logged in to the server.  To do this, find that entry in the list and click on the <em>Time</em>.  Adjust the filter to show <strong>+/- 5 minutes</strong></p>\n<p><img alt=\"Adjust timeframe\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/13.png\" /></p>\n<p>Since we want to look at <em>any</em> logs around that time, let's also remove <em>maliciousaccount</em> from the search query, so it should now look like this:</p>\n<p><code>index=* host=linux01 sourcetype=syslog source=\"/var/log/auth.log\"</code></p>\n<p>Look through the resulting events and see if you can identify any additional useful information.  Remember, the goal here is to gather <strong>actionable</strong> information.</p>\n<p>We're not seeing a lot of new information here, so let's expand our search to show us other types of logs.  Remove <em>source=\"/var/log/auth.log\"</em> from the search query.  It should now look like this:</p>\n<p><code>index=* host=linux01 sourcetype=syslog</code></p>\n<p>We will naturally see a lot more unrelated data in our logs, since we have widened our search terms - this is expected and desired.  We are trying to identify any other general information that can expand or support the story we are building.</p>\n<p>If you don't see any additional information to support your efforts, try removing the <em>sourcetype</em> from the query as well.  Let's also add in <em>maliciousaccount</em> to the query again.  We're doing this because we've expanded the types of logs we're seeing, so we want to narrow down on that specific term again.</p>\n<p>Your search query should now look like this:</p>\n<p><code>index=* host=linux01 maliciousaccount</code></p>\n<p>Not seeing any new information?  Let's remove <em>maliciousaccount</em> from the query then.  Remember, we're still narrowed down to logs within 5 minutes before and after the <em>maliciousaccount</em> logged in from DC01.</p>\n<p><code>index=* host=linux01</code></p>\n<p>We're still not overwhelemed by the logs at this point, because of that narrowed timeframe in the search.  However, <strong>NOW</strong> we're seeing some interesting information:</p>\n<p><img alt=\"malware_file\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/14.png\" /></p>\n<p><img alt=\"malware_file\" src=\"https://assets.ine.com/content/labs/ptp/BrianOlliff/VOD-4529/LAB-4741/15.png\" /></p>\n<p>Our attacker made this pretty obvious didn't they?</p>\n<p>At this point, we've put together an interesting timeline of events:</p>\n<ol>\n<li><em>labadmin</em> (possibly compromised) created <em>newadmin</em></li>\n<li><em>labadmin</em> switched users to act as <em>newadmin</em></li>\n<li><em>newadmin</em> then created <em>maliciousaccount</em></li>\n<li><em>maliciousaccount</em> logged in from DC01 using SSH (DC01 possibly compromised)</li>\n<li><em>maliciousaccount</em> created/uploaded some form of malware on LINUX01</li>\n</ol>\n<p>We also have some possible next steps based on this information:</p>\n<ul>\n<li>Disable <em>labadmin</em>, <em>newadmin</em>, and <em>maliciousaccount</em> accounts</li>\n<li>Evaluate which of those accounts are legitimate and are needed.  Change passwords and secure as necessary.</li>\n<li>If possible, take DC01 offline for further investigation.  This is only possible if there are other, redundant domain controllers.  If we can't disconnect it from the network, then <strong>IMMEDIATE</strong> further investigation is required.</li>\n<li>Do the same with LINUX01, since it is possibly compromised with malware</li>\n</ul>\n<p>Feel free to investigate further to see if you can identify any other activity that may have taken place on this server.  Experiment with different search criteria, including using some wildcards in your searches (*).</p>",
    "flags": [],
    "min_points_to_pass": null,
    "access_type": "default",
    "user_status": "unstarted",
    "user_lab_status": null,
    "user_status_modified": null,
    "user_flags": [],
    "global_running_session": null
}