Honeypot and Splunk Scenario

I was given the task of investigating suspicious download activities that were captured by a company's honeypot, named cowrie. Download events were captured by through Splunk. There was a catch as the Splunk dashboard could not be accessed due to the improper off boarding of the lead security investigator, named John Doe.

In this scenario, I was provided access to the company's mail server in order to use the information available to gain access to the Splunk system, investigate suspicious events, and identify what had occurred.

Please continue reading to see how I managed to complete this capture the flag scenario and what I learned along the way!

• Using provided credentials and IP addresses, I was able to use telnet to access the company's POP3 server over port 110.

• After logging into the John Doe's inbox, 5 separate emails were recovered. Following the email recovery, Splunk credentials were located in an email from the database administrator to our John Doe.

• Using directed and relevant search terms within Splunk, I was able to identify five suspicious download links. Three of these links contained interesting alpha-numeric strings that required further investigation.

Search queries leading to download events

• After examining the alpha-numeric sequences, I found they were encoded in base64. The messages were decoded and informed me that I had found the flag for this exercise.

• Even though the flag had been located I felt there was more information that could be discovered about the perpetrator of these downloads. I reexamined the emails in John Doe's mail server and noticed an IP address that corresponded to the previously mentioned downloads.

• After recording the IP address, I searched the Splunk system for authentication failures that corresponded with the date and time of the downloads in question. Multiple failures were located and attributed to a user by the name of Jane Doe.

• Cross examination of date, time, and user information pointed toward and email sent for Jane Doe to John Doe from the same IP address that attempted the previous download.

• With this, the suspicious downloads were identified as was the individual who attempted the downloads.

This was an interesting exercise that allowed me to explore the utility of SIEM solutions and the critical thinking skills necessary to untangle data related to intrusion events. I learned a few lessons with this project. I learned that proper off boarding procedures are necessary to ensure seamless transition of access to IT and security systems. I also learned that proper management of login credentials is necessary to ensure proper access to systems. This exercise also showed me that proper use of honeypot schemes can inform enterprises of their inherent security flaws without endangering critical systems and networks.