Posts

I passed my Splunk Enterprise Certified Admin SPLK 1003 cert on September 11th, 2020. While I have been actively working with Splunk as part of my job, clearing the exam still requires a consistent and well-planned effort. All these points are taken from the exam blueprint: https://www.splunk.com/pdfs/training/Splunk-Test-Blueprint-Admin-v.1.1.pdf, together with either the Splunk documentation I studied for that specific part or a YouTube video I found useful. Along with these, I also bought the Udemy course The Complete Splunk Enterprise Certified Admin Course 2020 ...

No matter how tightly you restrict outbound access from your network, you probably allow DNS protocol to at least one server. Adversaries can abuse this access in your firewall to establish stealthy Command and Control (C2) channels or to exfiltrate data that is difficult to block. To understand the use of DNS for C2 tunneling, let’s take a look at Ron Bowes’s tool dnscat2, which makes it relatively easy to experiment with such attack techniques. ...

In today’s post, we will learn how to detect a public S3 bucket using Splunk. Later, we will see how we can respond to such incidents and even prevent them from happening in the first place. As you will see in the following examples, there are multiple ways to create an S3 bucket and make it public. Also, for this blog, I created some subdomains of logsec.cloud in Route53. ...

During the past week, we detected some suspicious activities across multiple AWS accounts in one of our clients’ environments. These activities seemed related to S3 bucket scanning by a bad actor. Here is one of the sample logs from the S3 access logs: 84fd7086179626a759fb59a0252a26d26dc1685e30f0ab922266b5abace8f998 <AWS-ACCOUNT-ID>-config-org-bucket [01/Jun/2020:13:27:34 +0000] 10.247.13.187 arn:aws:iam::799199334739:user/starling-ladyblackhawk-iad-prod 9WDX6MBZFQ6Z6RDR REST.HEAD.BUCKET - "HEAD / HTTP/1.1" 403 AccessDenied 243 - 9 - "-" "AWSConfig" - wFvPfIaSbdpcnNMdcTj+BNWn00r3OfqHV8sTt8gUXMzLA7O/MiWg+NPckix2TThK15V/p1JigVc= SigV4 ECDHE-RSA-AES128-SHA AuthHeader <AWS-ACCOUNT-ID>-config-org-bucket.s3.amazonaws.com TLSv1.2 The first thing that caught our attention in this log was the username starling-ladyblackhawk-iad-prod. The question to ask at this stage: is this a rogue IAM user? We do not follow such a naming convention across the organization. Second, the AWS account ID 799199334739 does not belong to us. So this is definitely not a rogue user in our environment. ...

Git is a version control system. Basically, if someone changes a file (like opens a document and writes stuff in it, changes a line of code, or so on) it records the differences between the new version and the old version, and maintains a history. This allows people to preserve differing versions, go back in time to earlier ones, review changes as they have occurred over time, and so on. ...

In this blog post, we will learn how to ingest VPC flow logs with additional metadata into Splunk. We will start by creating a VPC flow log using Terraform and pushing the logs to S3. From S3, we will ingest these logs into Splunk using SQS. Finally, we will make some changes to Splunk’s props.conf file for correct field extraction of the additional VPC flow log fields. ...