Security Analyst and Documentation_ Threat Hunting with Splunk.pdf
Jason T. — IT Support and Systems Monitoring
Project: Threat Hunting With Splunk
In this Project I Used to Splunk to search through Sysmon logs to gather evidence of a C2 Communication Related Incident.
I added the data to Splunk and conducted several searches to which I have included screenshots of my searches on how I found my evidence.
This involved understanding specific EventID's correlated with these Logs to find the needed artifacts for evidence collection and as well identifying the timelines of these logs to structure out how the attack was performed, how it started and Ended.
This project was great to work with and has reinforced my evidence gathering skill, and threat hunting skills and I hope you enjoy what I have to show you, if you have any suggestions feel free to share them!
https://drive.google.com/file/d/15Je6L8qskzzZlUVdPjtz17wMxOYPPZWj/view?usp=sharing
#SPLUNK #IncidentResponse #SOC #SIEM #C2 #Powershell #Sysmon #ThreatHunting
2 reactions · 0 comments
Topics: #threathunting, #siem, #incidentresponse, #powershell, #splunk, #c2, #soc, #sysmon