SPLK-5001 Threat Hunting — 15 Questions

Question 1

You are hunting for data exfiltration and want to identify large outbound file transfers. Which tool in Splunk is best suited to baseline 'normal' transfer volume per user?

Accepted Answer

Splunk Machine Learning Toolkit (MLTK). The 'pivot' interface or 'stats' command combined with 'stdev' (standard deviation) is ideal for establishing baselines to identify statistical outliers.

Answer

Splunk DB Connect

Answer

Splunk Dashboard Studio

Answer

Splunk Add-on Builder

Question 2

You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?

Accepted Answer

search dest_ip=x.x.x.x | streamstats current=f window=2 global=f last(_time) as prev_time | eval diff=_time - prev_time. The streamstats command allows for calculating intervals between events, which is critical for identifying beaconing patterns in network traffic.

Answer

search dest_ip=x.x.x.x | rare dest_ip

Answer

search dest_ip=x.x.x.x | timechart span=1h count

Answer

search dest_ip=x.x.x.x | stats count by _time

Question 3

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

Accepted Answer

index=windows EventCode=4688 | stats count by ParentProcessName, ProcessName. Identifying abnormal parent-child relationships is a core hunting technique. Using tstats to aggregate process parent-child pairs is efficient.

Answer

index=windows EventCode=4697 | table User, ServiceName

Answer

index=windows EventCode=4624 | table Logon_Type, User

Answer

index=windows EventCode=7045 | stats count by ServiceName

Question 4

You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?

Accepted Answer

EventCode 10. Sysmon Event ID 10 captures ProcessAccess, which is the standard event logged when a process like a credential dumper accesses the memory of lsass.exe.

Answer

EventCode 1

Answer

EventCode 11

Answer

EventCode 3

Question 5

You are analyzing a data model using tstats. You need to identify rare process executions across your environment. Which command structure provides the most performance-optimized result?

Accepted Answer

| tstats summariesonly=t count from datamodel=Endpoint.Processes by Processes.process_name | sort count. Using tstats with the 'summariesonly=true' parameter leverages accelerated data models, providing significantly faster results for large datasets.

Answer

| inputlookup processes.csv | stats count

Answer

index=windows | rare limit=20 ProcessName

Answer

| search index=windows | stats count by ProcessName | sort -count

Question 6

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

Accepted Answer

Hunt Procedure and Query Logic. A documented 'Procedure' or 'Steps' section ensures that the methodology is clear and can be executed consistently by others.

Answer

Threat Intelligence Source List

Answer

Executive Summary

Answer

Hardware Requirements

Question 7

Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?

Accepted Answer

Search Macro. Splunk 'Reports' allow for saved searches, but 'Lookup Definitions' or 'Macros' are used for reusability. Macros are the standard way to parameterize queries.

Answer

Saved Search

Answer

Data Model Acceleration

Answer

Event Type

Question 8

An attacker has cleared the Windows Event Logs to hide their tracks. You are hunting for this activity. Which Event ID in the System log indicates that the log service was stopped or cleared?

Accepted Answer

Event ID 1102. Event ID 1102 is the specific Windows event logged when the Security audit log is cleared.

Answer

Event ID 4688

Answer

Event ID 7036

Answer

Event ID 4624

Question 9

Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?

Accepted Answer

Hypothesis Generation. The 'Hypothesis Generation' phase involves determining what to hunt for based on threat intelligence or environmental observations.

Answer

Data Preparation

Answer

Reporting

Answer

Hunt Execution

Question 10

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

Accepted Answer

eval decoded=base64_decode(field). The 'base64_decode' function in SPL is designed to handle this specific transformation.

Answer

rex field=field "(?<decoded>.*)"

Answer

transform base64 field

Answer

eval decoded=decode(field, "base64")

Question 11

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

Accepted Answer

dest. The CIM 'Network Traffic' data model standardizes the destination IP field as 'dest' to ensure cross-source compatibility.

Answer

dst_ip

Answer

remote_address

Answer

target_ip

Question 12

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

Accepted Answer

Event ID 1. Event ID 1 (Process Creation) provides the full command line, including arguments, which is essential for detecting LotL techniques.

Answer

Event ID 7

Answer

Event ID 2

Answer

Event ID 5

Question 13

You are conducting a hunt for unauthorized remote access tools. Which Splunk command is most effective for identifying processes that are running from unusual directories (e.g., AppData, Temp)?

Accepted Answer

index=windows | stats count by Image | where like(Image, "%\AppData%"). Filtering by 'Image' and using 'where' to identify paths containing 'AppData' or 'Temp' is a standard way to find suspicious persistence.

Answer

index=windows | table Image | sort Image

Answer

index=windows | search Image="*" | head 100

Answer

index=windows | rare Image

Question 14

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

Accepted Answer

To align with attacker dwell time. The lookback period ensures the hunter scans enough historical data to cover the likely dwell time of an attacker.

Answer

To increase the search speed

Answer

To clear the cache

Answer

To reduce the number of false positives

Question 15

Which TWO actions should be performed during the 'Data Preparation' phase of a threat hunt to ensure accurate results?

Accepted Answer

Mapping data sources to the Splunk Common Information Model (CIM). Ensuring data is mapped to the CIM and that the required fields are available are essential for reliable hunting.

Answer

Applying machine learning models

Answer

Creating new user accounts

Answer

Drafting the final incident report