Investigating with Splunk

Walkthrough summary

Investigating with Splunk TryHackMe walkthrough with 9 answered prompts and lab methodology notes.

Sample prompts covered

• How many events were collected and Ingested in the index main?
  Open the walkthrough page to inspect the full answer and command flow.
• On one of the infected hosts, the adversary was successful in creating a backdoor user. What is the new username?
  Open the walkthrough page to inspect the full answer and command flow.
• On the same host, a registry key was also updated regarding the new backdoor user. What is the full path of that registry key?
  Open the walkthrough page to inspect the full answer and command flow.
• Examine the logs and identify the user that the adversary was trying to impersonate.
  Open the walkthrough page to inspect the full answer and command flow.
• What is the command used to add a backdoor user from a remote computer?
  Open the walkthrough page to inspect the full answer and command flow.