[THM] Splunk 2
BOTSv2 Dataset
The data included in this app was generated in August of 2017 by members of Splunk’s Security Specialist team - Dave Herrald, Ryan Kovar, Steve Brant, Jim Apger, John Stoner, Ken Westin, David Veuve and James Brodsky. They stood up a few lab environments connected to the Internet. Within the environment they had a few Windows endpoints instrumented with the Splunk Universal Forwarder and Splunk Stream. The forwarders were configured with best practices for Windows endpoint monitoring, including a full Microsoft Sysmon deployment and best practices for Windows Event logging. The environment included a Palo Alto Networks next-generation firewall to capture traffic and provide web proxy services, and Suricata to provide network-based IDS. 
Questions
100 series questions
Q: Amber Turing was hoping for Frothly to be acquired by a potential competitor which fell through, but visited their website to find contact information for their executive team. What is the website domain that she visited?
A: www.berkbeer.com 
Q: Amber found the executive contact information and sent him an email. What image file displayed the executive’s contact information? Answer example: /path/image.ext
A: /images/ceoberk.png
Q: What is the CEO’s name? Provide the first and last name.
A: Martin Berk
Q: What is the CEO’s email address?
A: mberk@berkbeer.com
Q: After the initial contact with the CEO, Amber contacted another employee at this competitor. What is that employee’s email address?
A: hbernhard@berkbeer.com
Q: What is the name of the file attachment that Amber sent to a contact at the competitor?
A: Saccharomyces_cerevisiae_patent.docx
Q: What is Amber’s personal email address?
A: ambersthebest@yeastiebeastie.com
200 series questions
Q: What version of TOR Browser did Amber install to obfuscate her web browsing? Answer guidance: Numeric with one or more delimiter.
A: 7.0.4
Q: What is the public IPv4 address of the server running www.brewertalk.com?
A: 52.42.208.228
Q: Provide the IP address of the system used to run a web vulnerability scan against www.brewertalk.com.
A: 45.77.65.211
Q: The IP address from Q#2 is also being used by a likely different piece of software to attack a URI path. What is the URI path? Answer guidance: Include the leading forward slash in your answer. Do not include the query string or other parts of the URI. Answer example: /phpinfo.php
A: /member.php
Q: What SQL function is being abused on the URI path from the previous question?
A: updatexml
Q: What was the value of the cookie that Kevin’s browser transmitted to the malicious URL as part of an XSS attack? Answer guidance: All digits. Not the cookie name or symbols like an equal sign.
A: 1502408189
Q: What brewertalk.com username was maliciously created by a spear phishing attack?
A: kIagerfield
300 series questions
Q: Mallory’s critical PowerPoint presentation on her MacBook gets encrypted by ransomware on August 18. What is the name of this file after it was encrypted?
A: Frothly_marketing_campaign_Q317.pptx.crypt
Q: There is a Games of Thrones movie file that was encrypted as well. What season and episode is it?
A: S07E02
Q: Kevin Lagerfield used a USB drive to move malware onto kutekitten, Mallory’s personal MacBook. She ran the malware, which obfuscates itself during execution. Provide the vendor name of the USB drive Kevin likely used. Answer Guidance: Use time correlation to identify the USB drive.
A: Alcor Micro Corp.
Q: What programming language is at least part of the malware from the question above written in?
A: Perl
Q: When was this malware first seen in the wild? Answer Guidance: YYYY-MM-DD
A: 2017-01-17
Q: The malware infecting kutekitten uses dynamic DNS destinations to communicate with two C&C servers shortly after installation. What is the fully-qualified domain name (FQDN) of the first (alphabetically) of these destinations?
A: eidk.duckdns.org
Q: From the question above, what is the fully-qualified domain name (FQDN) of the second (alphabetically) contacted C&C server?
A: eidk.hopto.org
400 series questions
Q: A Federal law enforcement agency reports that Taedonggang often spear phishes its victims with zip files that have to be opened with a password. What is the name of the attachment sent to Frothly by a malicious Taedonggang actor?
A: invoice.zip
Q: What is the password to open the zip file?
A: 912345678
Q: The Taedonggang APT group encrypts most of their traffic with SSL. What is the “SSL Issuer” that they use for the majority of their traffic? Answer guidance: Copy the field exactly, including spaces.
A: C = US
Q: What unusual file (for an American company) does winsys32.dll cause to be downloaded into the Frothly environment?
A: 나는_데이비드를_사랑한다.hwp
Q: What is the first and last name of the poor innocent sap who was implicated in the metadata of the file that executed PowerShell Empire on the first victim’s workstation? Answer example: John Smith
A: Ryan Kovar
Q: Within the document, what kind of points is mentioned if you found the text?
A: CyberEastEgg
Q: To maintain persistence in the Frothly network, Taedonggang APT configured several Scheduled Tasks to beacon back to their C2 server. What single webpage is most contacted by these Scheduled Tasks? Answer example: index.php or images.html
A: process.php
