Threat-Actor-Detection-Lab
Threat Actor Detection Lab
Objective
The objective of this lab was to establish a controlled environment for simulating and detecting cyber attacks. Two virtual machines were set up, designated as host and target machines respectively. Subsequently, activities within this environment were monitored and logged to emulate real-world cyberattack scenarios. These logs were then ingested and analyzed utilizing a Security Information and Event Management (SIEM) tool, offering comprehensive telemetry for detection and analysis. Through this hands-on experience, I gained valuable insights into attack patterns, defensive strategies, and network security principles.
Skills Learned
- Proficiency in utilizing Security Information and Event Management (SIEM) tools, including practical application within controlled environments.
- Competency in analyzing and interpreting network logs to identify anomalous behavior and potential cyber threats.
- Skill in generating and recognizing attack signatures and patterns, essential for proactive threat detection and response.
- Understanding of various network protocols and associated security vulnerabilities, enabling effective defense and mitigation strategies.
- Development of critical thinking and problem-solving abilities specific to cybersecurity, honed through hands-on experience with simulated cyberattack scenarios.
Tools Used
- ๐ฆ๐ฝ๐น๐๐ป๐ธ - Security Information and Event Management (SIEM) system for log ingestion and analysis.
- ๐ฆ๐๐๐บ๐ผ๐ป - Monitor and log system activity to the Windows event log.
- ๐ก๐บ๐ฎ๐ฝ - Network scanning tool used for network exploration and host discovery.
- ๐ ๐ฒ๐๐ฎ๐๐ฝ๐น๐ผ๐ถ๐ - Platform that allows to create exploits.
Demonstration Video
Steps
- Opening 2 instances of virtual machines, one with Kali Linux and the other with Windows 10, and taking note of the IP address
- Initiating Nmap and scanning the target machine ports
- Building a malware using msfvenom
- Using msfconsole to configure a handler that can listen to the assigned port
- Setting up an HTTP server using Python to download the malware
- Executing the malware and checking if the connection is established
- Establishing a shell and running some commands in the target machine Also checking to see if Splunk is configured to ingest Sysmon logs
- Querying the malware events in Splunk from the newly created โendpointโ index
- Using the process_guid to display the command prompt actions done by the attacker and create a table
