End-to-end SOC investigation of an APT web-server compromise, reconstructed in Splunk Enterprise using the Boss of the SOC (BOTS) v1 dataset. The analysis follows a structured kill-chain methodology, uses SPL for every finding, enriches indicators against open threat-intelligence sources, and maps adversary behaviour to MITRE ATT&CK.
Summary · Attack Chain · Structure · Full Walkthrough · SPL Reference · IOCs
| Scenario | Advanced Persistent Threat (APT) — public web-server compromise & defacement |
| Victim | imreallynotbatman.com (Wayne Enterprises), web server 192.168.250.70 |
| Date of activity | 10 August 2016 |
| SIEM | Splunk Enterprise (index=botsv1) |
| Primary log sources | Suricata IDS, Splunk Stream (HTTP), Sysmon, IIS, FortiGate UTM, WinEventLog, WinRegistry |
| Role simulated | SOC Analyst / Blue Team — detection, investigation, and response |
| Frameworks | Cyber Kill Chain, MITRE ATT&CK |
| Outcome | Full attack chain reconstructed from initial access to C2, with enriched IOCs and attribution |
This project simulates real-world SOC operations: ingesting multi-source telemetry into a SIEM, writing Search Processing Language (SPL) to hunt across it, correlating events into a coherent attack timeline, enriching artifacts against threat intelligence, and producing actionable remediation guidance.
⚠️ Dataset note: BOTS v1 is a publicly released training dataset published by Splunk. All IP addresses, hostnames, hashes, and domains in this repository are part of that dataset and are safe to document. SeeDISCLAIMER.md.
ATTACKER INFRASTRUCTURE
23.22.63.114 (brute-force bot, Python-urllib/2.7)
40.80.148.42 (operator, MSIE/Trident — manual login & upload)
│
▼
┌───────────────────────────────────────────────────────────────────────┐
│ 1. RECON & INITIAL ACCESS │
│ HTTP traffic to web server 192.168.250.70 (Joomla CMS) │
│ POST brute-force vs /joomla/administrator/index.php (user=admin) │
│ → MITRE T1190, T1110 │
├───────────────────────────────────────────────────────────────────────┤
│ 2. CREDENTIAL COMPROMISE │
│ 412 failed guesses from the bot; password "batman" succeeds, │
│ then re-used manually by 40.80.148.42 to authenticate │
│ → MITRE T1110, T1078 │
├───────────────────────────────────────────────────────────────────────┤
│ 3. PAYLOAD DELIVERY & EXECUTION │
│ 3791.exe uploaded to the server; Sysmon shows │
│ cmd.exe /c "3791.exe ..." process creation │
│ → MITRE T1105, T1059 │
├───────────────────────────────────────────────────────────────────────┤
│ 4. COMMAND & CONTROL / DEFACEMENT │
│ Beacon to prankglassinebracket.jumpingcrab.com:1337 │
│ Defacement image poisonivy-is-coming-for-you-batman.jpeg │
│ FortiGate flags category "Malicious Websites" (crlevel=high) │
│ → MITRE T1071, T1041 │
├───────────────────────────────────────────────────────────────────────┤
│ 5. IOC ENRICHMENT & ATTRIBUTION │
│ Hash c99131e0...6261 → MirandaTateScreensaver.scr.exe │
│ AV verdicts: Win32/Korplug (PlugX), Backdoor.Redsip │
│ Domain Po1s0n1Vy → threat actor "Poison Ivy" │
└───────────────────────────────────────────────────────────────────────┘
Read the complete, screenshot-by-screenshot walkthrough in docs/03-attack-chain-reconstruction.md.
| # | Question | Finding | Evidence |
|---|---|---|---|
| 1 | What are the primary attacker IPs? | 40.80.148.42 (operator) and 23.22.63.114 (brute-force bot) |
04, 05 |
| 2 | What application was targeted? | Joomla admin panel at 192.168.250.70 → /joomla/administrator/index.php |
10 |
| 3 | How was access gained? | Credential brute-force (POST), admin account |
11 |
| 4 | What password worked? | batman, submitted by 40.80.148.42 |
12 |
| 5 | What tool ran the brute-force? | Python-urllib/2.7 from 23.22.63.114 |
13 |
| 6 | What malware was delivered? | 3791.exe uploaded from 40.80.148.42 |
14 |
| 7 | How was it executed? | cmd.exe /c "3791.exe ..." (Sysmon EventCode 1) |
17 |
| 8 | What was the C2 / defacement? | prankglassinebracket.jumpingcrab.com:1337, poisonivy-is-coming-for-you-batman.jpeg |
18, 19 |
| 9 | Malware family & hash? | MD5 c99131e0169171935c5ac32615ed6261 → Win32/Korplug (PlugX) |
20, 21 |
| 10 | Who is behind it? | Threat actor Poison Ivy (Po1s0n1Vy) |
23 |
| Sourcetype | Role in the investigation | Approx. events |
|---|---|---|
suricata |
Network IDS alerts & flow metadata | 29,119 |
stream:http |
Full HTTP request/response capture (Splunk Stream) | 21,547 |
fgt_utm |
FortiGate UTM / web-filter logs | 12,778 |
iis |
IIS web-server access logs | 11,851 |
WinEventLog:Microsoft-Windows-Sysmon/Operational |
Endpoint process & network telemetry | 270,597 |
WinEventLog:Security |
Windows authentication & audit events | 87,430 |
WinRegistry |
Registry change monitoring | 74,720 |
8 hosts · 36 sources · 23 sourcetypes. Full breakdown in docs/01-lab-environment-and-data-sources.md.
| Tactic | Technique | ID | Observed as |
|---|---|---|---|
| Initial Access | Exploit Public-Facing Application | T1190 | Attack against internet-facing Joomla server |
| Credential Access | Brute Force: Password Guessing | T1110.001 | 400+ POST login attempts, admin account |
| Initial Access / Persistence | Valid Accounts | T1078 | Re-use of compromised admin credential |
| Command & Scripting Interpreter | Windows Command Shell | T1059.003 | cmd.exe /c "3791.exe ..." |
| Ingress Tool Transfer | — | T1105 | Upload of 3791.exe to the web server |
| Command & Control | Application Layer Protocol | T1071 | HTTP C2 beacon on port 1337 |
| Exfiltration | Exfiltration Over C2 Channel | T1041 | Outbound to attacker-controlled domain |
Full mapping with detection logic in docs/06-mitre-attack-mapping.md.
.
├── README.md # This file — executive overview
├── DISCLAIMER.md # Legal / ethical use notice
├── LICENSE # MIT
├── docs/
│ ├── 01-lab-environment-and-data-sources.md
│ ├── 02-methodology.md
│ ├── 03-attack-chain-reconstruction.md # Full walkthrough w/ screenshots
│ ├── 04-spl-query-reference.md # Every SPL query, explained
│ ├── 05-indicators-of-compromise.md # Human-readable IOC report
│ ├── 06-mitre-attack-mapping.md
│ └── 07-remediation-and-recommendations.md
├── spl/
│ └── investigation-queries.spl # All runnable SPL in one file
├── iocs/
│ ├── indicators.csv # Machine-readable IOCs
│ └── indicators.json # Structured IOC export
└── assets/
└── screenshots/ # 24 annotated evidence captures
- Deploy Splunk Enterprise (free trial / dev licence) on a host or VM.
- Download the BOTS v1 dataset and install it as the
botsv1index:- Dataset: https://github.com/splunk/botsv1
- Open Search & Reporting and set the time range to All time (events are from August 2016).
- Work through
spl/investigation-queries.splin order, or follow the narrative in docs/03.
No Splunk add-ons beyond the BOTS v1 package are required to reproduce the queries in this repository.
SIEM Operations · SPL / Threat Hunting · Log Correlation · Network Traffic Analysis ·
Endpoint Forensics (Sysmon) · IOC Enrichment · Threat Intelligence · MITRE ATT&CK Mapping ·
Incident Response · Blue Team / SOC Analysis · Security Reporting
SIEM: Splunk Enterprise · SPL Telemetry: Suricata IDS · Splunk Stream · Sysmon · IIS · FortiGate UTM · Windows Event Logs Threat Intel: VirusTotal · ThreatMiner · AbuseIPDB · Robtex · DomainTools (WHOIS) Frameworks: MITRE ATT&CK · Cyber Kill Chain
Released under the MIT License. The BOTS v1 dataset is published separately by Splunk under its own terms.