SPLK-5001 Cyber Landscape And Industry Frameworks — 10 Questions

Question 1

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

Accepted Answer

tstats count from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe.. The `tstats` command efficiently queries data models, and the Endpoint.Processes data model contains process execution events. Filtering for `process_name=powershell.exe` identifies PowerShell usage. To detect obfuscation, additional analysis of command-line arguments is needed, but this search provides the base events for such analysis. It is the most efficient and accurate starting point.

Answer

search sourcetype=sysmon | rename command as powershell.

Answer

| inputlookup mitre_tactics | where process=powershell.

Answer

index=main | lookup mitre_attack_id.

Question 2

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

Accepted Answer

Navigate to the 'Compliance' tab and run a report on 'Framework Coverage'.. Splunk Security Essentials (SSE) includes a Compliance tab that maps its detection content to frameworks like NIST CSF, CIS, and MITRE ATT&CK, and the Framework Coverage report shows which controls are covered and which have gaps. Running this report lets you prioritize detection development against the most critical uncovered controls. This is the intended workflow for aligning SSE content with NIST CSF.

Answer

Manually edit the 'Data Model' accelerations for NIST compliance.

Answer

Modify the 'Notable Event' aggregation policy to NIST standards.

Answer

Update the 'Threat Intelligence' index settings to include NIST tags.

Question 3

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

Accepted Answer

Utilizing the 'mitre_attack_id' field within the Threat Intelligence framework.. Splunk Enterprise Security maps notables to MITRE ATT&CK using the mitre_attack_id field, which is populated through the Threat Intelligence framework and the ES Threat Activity data model. This field carries the technique ID (e.g., T1059) that links a notable event to the correct adversary technique in the ATT&CK matrix, ensuring the Incident Review dashboard reflects actual TTPs.

Answer

Hardcoding the technique description into the 'dest_host' field.

Answer

Configuring the 'correlation_rule_id' to match the ATT&CK tactic name.

Answer

Mapping the source IP to the 'mitre_source_id' field.

Question 4

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

Accepted Answer

A KV Store collection configured via the 'Threat Intelligence Manager'.. The Splunk Enterprise Security Threat Intelligence framework uses a KV Store collection to store and manage threat intelligence data, including custom STIX/TAXII feeds. The Threat Intelligence Manager is the UI component that allows analysts to upload, configure, and maintain these feeds, which are then stored in the KV Store for correlation and enrichment. This approach enables dynamic updates and integration with the MITRE ATT&CK framework through the Threat Intelligence framework's data models and lookups.

Answer

An XML-based 'Incident Review' dashboard export.

Answer

A custom .yml file uploaded to the /etc/system/local directory.

Answer

A static .conf file in the app bin folder.

Question 5

You are configuring Splunk Enterprise Security to monitor for MITRE ATT&CK 'Persistence' techniques. Which TWO data sources provide the highest fidelity logs for detecting registry-based persistence?

Accepted Answer

Sysmon Event IDs 12 and 13.. Sysmon Event IDs 12 and 13 are correct because Event ID 12 logs registry key create/delete operations and Event ID 13 logs registry value set operations, which directly capture the registry modifications attackers use for persistence (e.g., Run keys, Services, IFEO). Windows Registry audit logs (via GPO/Sysmon) are also correct because enabling registry auditing through GPO or Sysmon provides granular, high-fidelity visibility into registry key and value changes tied to persistence mechanisms. Together these sources record the exact registry artifacts (key paths, value names, data, and process context) needed to detect and investigate registry-based persistence. Windows Security Event Logs (4688) only record process creation and lack registry modification detail, so they are insufficient alone. DNS query logs and Netflow logs capture network activity, not local registry changes, and therefore have no fidelity for registry-based persistence detection.

Answer

Windows Security Event Logs (specifically 4688).

Answer

DNS query logs.

Answer

Netflow logs.

Question 6

You are a SOC analyst at a healthcare provider that must satisfy HIPAA breach-notification timelines. During an investigation in Splunk Enterprise Security, you need to determine the elapsed time between the first suspicious authentication event and the moment the incident was classified as a confirmed breach. Which Splunk ES field should you rely on to calculate that elapsed time accurately?

Accepted Answer

The `detect_time` of the notable event compared with the timestamp recorded when the analyst set the disposition to a breach-confirming value.. HIPAA breach clocks depend on when an incident is confirmed as reportable, so the measurement must anchor on a human confirmation action. The notable event's detection timestamp marks when the system flagged activity, and the disposition change records the analyst's confirming decision. Together they produce an auditable elapsed interval. Fields tied to ticket closure, aggregation windows, or default statuses describe other lifecycle moments and cannot represent confirmation time.

Answer

The `_time` value of the notable event's initial triggering event combined with the `status` field transition to "Closed" on the investigation timeline.

Answer

The `create_time` of the investigation record and the `status` field value "New" on the notable event.

Answer

The `firstTime` and `lastTime` fields on the correlated notable event in the Incident Review dashboard.

Question 7

A security analyst is reviewing an alert generated by Splunk Enterprise Security. The alert details indicate that a user's workstation executed a suspicious PowerShell script shortly after opening a malicious document. The analyst wants to determine the next likely phase of the attack according to the Lockheed Martin Cyber Kill Chain. Which phase should the analyst focus on investigating next?

Accepted Answer

Installation. The scenario describes the execution of a PowerShell script after a user opened a malicious document, which is a classic indicator of the Installation phase in the Cyber Kill Chain. During Installation, attackers install malware or backdoors to maintain persistence. This phase follows Exploitation and precedes Command and Control. The analyst should focus on detecting installation activities, such as new services, scheduled tasks, or registry modifications, to contain the threat.

Answer

Weaponization

Answer

Actions on Objectives

Answer

Command and Control

Question 8

A Splunk ES analyst is mapping detection use cases to the Cyber Kill Chain. They want to prioritize data sources for detecting the 'Command and Control' phase. Which data source is most critical for identifying C2 communications?

Accepted Answer

Proxy logs. Proxy logs are the most critical data source for detecting Command and Control communications because they capture web traffic details such as URLs, user agents, and request patterns. C2 often uses HTTP/HTTPS to blend in, and proxy logs can reveal beaconing, unusual user agents, and connections to known malicious domains. While firewall, endpoint, and DNS logs provide valuable context, proxy logs offer the richest application-layer visibility.

Answer

DNS logs

Answer

Endpoint logs

Answer

Firewall logs

Question 9

A Splunk ES analyst is investigating an alert for suspicious PowerShell execution. The alert is mapped to MITRE ATT&CK technique T1059.001. The analyst wants to quickly determine if the PowerShell command line contains encoded commands, which are often used by attackers to obfuscate malicious scripts. Which Splunk search command should the analyst use to extract and decode the Base64-encoded command from the `CommandLine` field?

Accepted Answer

base64decode. To decode a Base64-encoded PowerShell command, the analyst should use the `base64decode` function within an `eval` command. This function is specifically designed to decode Base64 strings. The analyst would first extract the encoded portion using `rex` or similar, then apply `base64decode` to reveal the original command. This approach efficiently uncovers obfuscated malicious scripts, aiding in incident investigation.

Answer

rex

Answer

eval

Answer

urldecode

Question 10

A security analyst is mapping Splunk ES detections to the Cyber Kill Chain. The analyst has an alert for a suspicious email attachment that executed a malicious macro. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Installation. The execution of a malicious macro after delivery and user interaction represents the Installation phase of the Cyber Kill Chain, as it often results in the installation of malware or a backdoor. This phase is critical because it establishes the attacker's presence on the system. Splunk ES can detect this through endpoint logs showing process creation, file writes, or registry modifications associated with macro execution.

Answer

Command and Control

Answer

Exploitation

Answer

Delivery