TryHackMe Advent of Cyber 2025: Web Attack Forensics with Splunk
· 16:32 · Watch on YouTube ↗
Summary
Day demonstrates using Splunk and Sysmon in a TryHackMe Advent of Cyber 2025 lab to investigate a simulated web attack, correlate Apache logs and process events, decode Base64 payloads, and identify command execution and whoami reconnaissance.
Key points
- The lab scenario involves suspicious long HTTP requests with Base64 chunks targeting the TBFC drone scheduler web UI.
- The walkthrough searches Apache access logs for command-execution attempts and decodes a Base64 payload that the presenter interprets as “this is now mine.”
- Apache error logs show failed command attempts; the presenter says these can indicate that attacker input reached the server but failed during execution.
- Sysmon process-creation events show Apache’s httpd.exe spawning cmd.exe repeatedly, which the presenter treats as evidence of successful operating-system-level command execution.
- The investigation finds whoami commands running under the Apache service account in the Apache 2024 directory, indicating post-exploitation reconnaissance in the lab.
- A final search for PowerShell encoded-command events returns no results; the transcript does not establish that an encoded payload successfully ran.
Article Details
- Topics
- [00:37] The TBFC drone scheduler web attack forensics scenario and investigation goals
- [01:48] Using Splunk to correlate Apache logs and Sysmon telemetry
- [04:47] Searching Apache access logs for suspicious HTTP commands and decoding Base64 payloads
- [06:55] Reviewing Apache error logs for failed command-execution attempts
- [08:34] Tracing Apache-spawned processes with Sysmon
- [11:20] Identifying whoami commands as post-exploitation reconnaissance
- [14:13] Searching for PowerShell encoded commands and reviewing the results
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe lab scenario uses Base64-encoded, obfuscated command payloads that the presenter decodes during the investigation.T1033 · System Owner/User DiscoveryThe transcript identifies whoami commands run by the Apache service as reconnaissance to determine the account context.T1059.001 · PowerShellThe lab investigation searches for attempts to run PowerShell commands, including encoded commands, through suspicious web requests.T1059.003 · Windows Command ShellThe transcript describes Apache spawning cmd.exe and identifies command-shell execution as evidence of command injection in the lab.