SPLK-5001 Threat Hunting — 30 Questions

Question 1

You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

search dest_ip=x.x.x.x | streamstats current=f window=2 global=f last(_time) as prev_time | eval diff=_time - prev_time. Beaconing is characterized by regular, periodic connections, so the key is measuring the time delta between consecutive connections to the same destination. The streamstats command with current=f and window=2 computes the difference between the current event's _time and the previous event's _time, producing inter-arrival intervals that reveal a consistent beacon pattern (e.g., every 60 seconds with low jitter). This is the standard SPL approach for validating beaconing hypotheses.

Answer

search dest_ip=x.x.x.x | rare dest_ip

Answer

search dest_ip=x.x.x.x | timechart span=1h count

Answer

search dest_ip=x.x.x.x | stats count by _time

Question 2

You are hunting for data exfiltration and want to identify large outbound file transfers. Which tool in Splunk is best suited to baseline 'normal' transfer volume per user?

Accepted Answer

Splunk Machine Learning Toolkit (MLTK). The 'pivot' interface or 'stats' command combined with 'stdev' (standard deviation) is ideal for establishing baselines to identify statistical outliers.

Answer

Splunk DB Connect

Answer

Splunk Dashboard Studio

Answer

Splunk Add-on Builder

Question 3

You are analyzing a data model using tstats. You need to identify rare process executions across your environment. Which command structure provides the most performance-optimized result?

Accepted Answer

| tstats summariesonly=t count from datamodel=Endpoint.Processes by Processes.process_name | sort count. The tstats command with summariesonly=t queries the accelerated data model summaries, which is the most performance-optimized way to aggregate process executions. Grouping by Processes.process_name and sorting by count identifies rare processes efficiently. This leverages the TSIDX acceleration rather than scanning raw events.

Answer

| inputlookup processes.csv | stats count

Answer

index=windows | rare limit=20 ProcessName

Answer

| search index=windows | stats count by ProcessName | sort -count

Question 4

An attacker has cleared the Windows Event Logs to hide their tracks. You are hunting for this activity. Which Event ID in the System log indicates that the log service was stopped or cleared?

Accepted Answer

Event ID 1102. Windows Event ID 1102 in the Security log indicates that the audit log was cleared, which is a direct indicator of an attacker covering their tracks. Although the question mentions the System log, Event ID 1102 is logged in the Security log when the audit log is cleared, and it is the canonical event for log clearing. Event ID 1102 is generated by the Windows Event Log service when the security audit log is cleared.

Answer

Event ID 4688

Answer

Event ID 7036

Answer

Event ID 4624

Question 5

You are conducting a hunt for unauthorized remote access tools. Which Splunk command is most effective for identifying processes that are running from unusual directories (e.g., AppData, Temp)?

Accepted Answer

index=windows | stats count by Image | where like(Image, "%\AppData%"). It uses `stats count by Image` to aggregate process executions by their full path, then filters with `where like(Image, "%\AppData%")` to isolate processes running from AppData directories. This directly targets the hunt hypothesis: unauthorized remote access tools often execute from user-writable paths like AppData or Temp. The `like` function supports wildcard matching, making it ideal for pattern-based filtering on file paths.

Answer

index=windows | table Image | sort Image

Answer

index=windows | search Image="*" | head 100

Answer

index=windows | rare Image

Question 6

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Accepted Answer

Windows Security Event ID 4688 (Process Creation). Option A, Windows Security Event ID 4688 (Process Creation), is correct because it records the exact process image, parent process, and command line executed on a host, letting hunters spot remote-execution artifacts such as PsExec, WMI, or schtasks spawning cmd.exe/powershell.exe from unusual parents. Option B, Windows System Event ID 7045 (Service Installation), is correct because lateral-movement tools like PsExec and Impacket's smbexec install a temporary service on the target, and 7045 captures the service name, image path, and service type for that pivot. Option E, Windows Security Event ID 4624 (Logon), is correct because its Logon Type field (e.g., 3 for network, 10 for RDP) and source workstation/IP reveal the origin of remote authentication, which is the core correlation point for tracking movement between hosts. Option C (System Event ID 104, Log Cleared) is anti-forensic evidence of cleanup rather than a record of lateral movement itself, and Option D (Security Event ID 4611, Trusted Logon) concerns a process registering as trusted for logon, which is not a standard lateral-movement indicator.

Answer

Windows System Event ID 104 (Log Cleared)

Answer

Windows Security Event ID 4611 (Trusted Logon)

Question 7

You are a threat hunter investigating potential data exfiltration over DNS. You have Splunk Enterprise Security with the Network_Traffic data model accelerated. You want to find DNS TXT queries where the query length exceeds 100 characters, which may indicate DNS tunneling. Which Splunk search correctly uses tstats to query the Network_Traffic data model?

Accepted Answer

| tstats summariesonly=t count from datamodel=Network_Traffic.DNS where DNS.message_type="TXT" by DNS.query | eval qlen=len(DNS.query) | where qlen > 100. To hunt for DNS tunneling, you must query the correct data model dataset and use the appropriate fields. The DNS child dataset in Network_Traffic contains fields like message_type and query, but not query_length. Therefore, you must calculate the query length using eval len() after the tstats command, and filter for TXT message types. This approach leverages accelerated data model summaries for efficiency while accurately identifying long DNS queries that may indicate exfiltration.

Answer

| tstats summariesonly=t count from datamodel=Network_Traffic.DNS where DNS.query_length > 100 by DNS.query | search DNS.message_type="TXT"

Answer

| tstats summariesonly=t count from datamodel=Network_Traffic.DNS where DNS.query_length > 100 by DNS.query | search DNS.query="*.txt*"

Answer

| tstats summariesonly=t count from datamodel=Network_Traffic.All_Traffic where DNS.message_type="TXT" by DNS.query | where len(DNS.query) > 100

Question 8

During a threat hunt for beaconing activity, you observe periodic outbound connections to a rare external IP every 60 seconds with small, consistent payloads. You want to quantify how regular these intervals are to distinguish automated C2 from human-driven traffic. Which Splunk command should you use to calculate the standard deviation of the time between connections?

Accepted Answer

streamstats. To detect beaconing, you need the time between consecutive connections and a measure of how consistent those intervals are. streamstats can compute the delta between events in sequence, and then stats stdev on those deltas reveals regularity. This distinguishes automated callbacks from irregular human traffic.

Answer

transaction

Answer

eventstats

Answer

stats

Question 9

You are hunting for anomalous authentication activity across your Windows environment, which ingests Security event logs. You want to find accounts that have authenticated from an unusually high number of distinct source workstations within the last 24 hours, a pattern that may indicate credential misuse or lateral movement. Which Splunk search best identifies these accounts?

Accepted Answer

index=wineventlog EventCode=4624 | stats dc(WorkstationName) as distinct_sources by Account_Name | where distinct_sources > 10 | sort - distinct_sources. The hunt aims to detect accounts authenticating from an unusually high number of distinct workstations, a sign of credential misuse. Filtering successful logons (4624) and using dc(WorkstationName) by Account_Name correctly measures unique source hosts per account. A where clause then isolates accounts exceeding a threshold, surfacing potential lateral movement or shared credential abuse that warrants further investigation.

Answer

index=wineventlog EventCode=4624 | stats sum(WorkstationName) as total_sources by Account_Name | where total_sources > 10 | sort - total_sources

Answer

index=wineventlog EventCode=4625 | stats count by Account_Name | where count > 10 | sort - count

Answer

index=wineventlog EventCode=4624 | stats values(WorkstationName) as sources by Account_Name | where mvcount(sources) > 10 | sort - mvcount(sources)

Question 10

You are building a hunt to detect DNS tunneling. You have DNS logs in Splunk with fields query, src, and answer. Which Splunk command is best for identifying hosts that generate an unusually high number of unique DNS queries with long subdomain strings?

Accepted Answer

stats dc(query) as unique_queries by src. DNS tunneling encodes data in subdomains, generating many unique queries from a single compromised host. Using stats dc(query) by src reveals hosts with abnormally high unique query counts. This is a simple and effective first-pass hunt for tunneling activity.

Answer

top limit=10 query

Answer

rare query

Answer

timechart count by query

Question 11

You are conducting a hunt for DNS tunneling, where malware encodes data in DNS queries. Your DNS logs are in the Splunk CIM DNS data model. You want to identify hosts making an unusually high number of DNS queries with long subdomain strings to a single domain within a short window. Which Splunk search using tstats best surfaces this behavior?

Accepted Answer

| tstats count from datamodel=Network_Resolution.DNS by DNS.src, DNS.query | rex field=DNS.query "\.(?<domain>[^.]+\.com)$" | eval len=len(DNS.query) | where len > 50 | stats count by DNS.src, domain | where count > 100. DNS tunneling often manifests as a host sending numerous long, encoded subdomain queries to a single domain. Using tstats on the Network_Resolution.DNS data model, extracting the base domain, filtering for long queries, and then counting per source host and domain with a threshold isolates this behavior. This approach surfaces the high-volume, single-domain pattern characteristic of tunneling.

Answer

Answer

Answer

Question 12

You are hunting for signs of data exfiltration over HTTP. You have proxy logs in Splunk with fields src_ip, dest_host, bytes_out, and http_method. Which TWO Splunk search constructs are most effective for identifying potential exfiltration? (Choose two.)

Accepted Answer

stats sum(bytes_out) as total_bytes by src_ip, dest_host | where total_bytes > 10000000. Exfiltration over HTTP often manifests as unusually large outbound transfers. Summing bytes_out per source and destination with a threshold detects bulk uploads, while comparing each transfer to the host's average highlights anomalies. Together, these constructs efficiently narrow down potential exfiltration events.

Answer

timechart span=1h sum(bytes_out) by src_ip

Answer

top limit=5 dest_host by src_ip

Answer

search http_method=POST | stats count by dest_host

Question 13

During a hunt for DNS-based data exfiltration, you want to surface hosts that resolve an unusually high number of unique subdomains under a single parent domain, which may indicate DNS tunneling. Which SPL search best produces this result from your network telemetry?

Accepted Answer

index=dns | rex field=query "\.(?<parent_domain>[^.]+\.(com|net|org))$" | stats dc(query) as subdomain_count by src_ip, parent_domain | where subdomain_count > 50. Effective DNS-tunneling hunts require two things: normalization to the parent domain so all encoded subdomains collapse into one group, and a distinct count of the full query names per source host. Only an approach that extracts the registrable domain and applies dc(query) with a threshold reveals a single host fanning out across many unique labels beneath one authoritative domain, which is the hallmark of encoded exfiltration over DNS.

Answer

index=dns | stats dc(query) as subdomain_count by src_ip, query | where subdomain_count > 50

Answer

index=dns | top limit=50 query by src_ip

Answer

index=dns | stats count by src_ip, query | sort - count | head 100

Question 14

You are hunting for PowerShell-based attacks and want to identify suspicious command-line arguments that may indicate obfuscation or malicious intent. You have process creation logs in Splunk. Which TWO command-line patterns are most indicative of potentially malicious PowerShell usage? (Choose two.)

Accepted Answer

-EncodedCommand. The -EncodedCommand and -ExecutionPolicy Bypass parameters are strongly associated with malicious PowerShell usage. -EncodedCommand hides the actual script in Base64, complicating detection, while -ExecutionPolicy Bypass allows unrestricted script execution. Both are frequently observed in attacker command lines and are high-fidelity indicators when hunting for PowerShell-based threats.

Answer

-Verbose

Answer

-WindowStyle Hidden

Answer

-NoProfile

Question 15

You are hunting for DNS tunneling used by malware to exfiltrate data. You have Splunk ES with the Network_Resolution data model populated. Which search most effectively surfaces hosts generating abnormally high volumes of unique DNS queries with long subdomain strings in a 24-hour window?

Accepted Answer

| tstats summariesonly=true count from datamodel=Network_Resolution.DNS where DNS.query=* groupby DNS.src, DNS.query | eval qlen=len(DNS.query) | where qlen > 50 | stats dc(DNS.query) as uniq by DNS.src | where uniq > 500. DNS tunneling produces many unique, unusually long subdomain queries from a single host, so the effective hunt combines accelerated data model access, a per-query length filter, and a distinct-count aggregation by source. Searching raw DNS events and ranking only by total volume or by common subdomain labels misses the uniqueness and length signals that distinguish tunneling from normal resolution.

Answer

index=dns | stats count by query | sort -count | head 20

Answer

index=dns | rex field=query "(?<subdomain>^[^.]+)" | top subdomain | where count > 100

Answer

| datamodel Network_Resolution DNS search | search query=* | stats sum(len(query)) as total by src | where total > 10000

Question 16

You are hunting for Kerberoasting activity in your Active Directory environment. You have Windows Security event logs and want to identify accounts that requested Kerberos service tickets (TGS) for multiple distinct service principal names (SPNs) within a short period, which may indicate an attacker enumerating and requesting tickets for offline cracking. Which Splunk search best detects this behavior?

Accepted Answer

index=wineventlog EventCode=4769 | stats dc(Service_Name) as distinct_spns by Account_Name | where distinct_spns > 5 | sort - distinct_spns. Kerberoasting involves requesting Kerberos service tickets (EventCode 4769) for multiple SPNs to crack them offline. Detecting an account that requests tickets for many distinct services within a short period is a strong indicator. Using dc(Service_Name) by Account_Name correctly counts unique SPNs and surfaces anomalous behavior, enabling further investigation.

Answer

index=wineventlog EventCode=4769 | stats sum(Service_Name) as total_spns by Account_Name | where total_spns > 5 | sort - total_spns

Answer

index=wineventlog EventCode=4768 | stats count by Account_Name | where count > 5 | sort - count

Answer

index=wineventlog EventCode=4769 | stats values(Service_Name) as spns by Account_Name | where mvcount(spns) > 5 | sort - mvcount(spns)

Question 17

You are hunting for Kerberoasting activity in a Windows environment where Splunk ingests Security event logs and has the Authentication data model populated. Which TWO detection approaches best surface this behavior? (Choose two.)

Accepted Answer

Search for EventCode 4769 with a failure code of 0x0 requested by a non-service account, then use the Authentication data model to rank accounts by count of unique service names per hour.. Kerberoasting depends on requesting RC4-encrypted service tickets for accounts with registered SPNs. Detection therefore focuses on EventCode 4769 with encryption type 0x17, excluding krbtgt, and on behavioral baselines such as the number of distinct SPNs requested per account. Correlating through the Authentication data model standardizes fields and makes the enumeration burst visible across the environment.

Answer

Search for EventCode 4768 followed immediately by EventCode 4769 from the same host, and alert when the interval exceeds 30 minutes.

Answer

Search for EventCode 4624 with Logon Type 3 and filter for accounts authenticating from unusual source workstations during off-hours.

Answer

Search for EventCode 4769 where the Ticket Options field indicates a renewal or the ticket lifetime is abnormally long, and correlate with privileged account usage.

Question 18

A hunter wants to detect suspicious scheduled task creation on endpoints, using Splunk data from Windows Security Event Code 4698. The hunt should return the task name, the account that created it, and the command the task will run. Which search structure best achieves this?

Accepted Answer

index=wineventlog EventCode=4698 | rex field=Message "TaskName=(?<task_name>[^\s]+)" | table _time, ComputerName, SubjectUserName, task_name, Message. Security Event Code 4698 captures scheduled task creation, but the most useful details, including the task name and the action it will perform, are embedded in the event message rather than exposed as separate fields. Extracting the task name with rex and presenting it with the computer, creating account, and raw message lets an analyst quickly assess whether the task is suspicious.

Answer

index=wineventlog EventCode=4697 | table _time, ComputerName, SubjectUserName, Message

Answer

index=wineventlog EventCode=4698 | dedup ComputerName | table _time, ComputerName, SubjectUserName

Answer

index=wineventlog EventCode=4698 | stats count by ComputerName, SubjectUserName | sort - count

Question 19

A threat hunter suspects an attacker is using scheduled tasks for persistence. After collecting Windows Task Scheduler operational logs into Splunk, which search best identifies newly created tasks that execute from user-writable directories?

Accepted Answer

index=wineventlog source="*TaskScheduler*" EventCode=200 OR EventCode=201 | rex field=Message "Action: (?<action_path>[^\s]+)" | search action_path="*\Users\*" OR action_path="*\AppData\*" | table _time, Computer, TaskName, action_path. Task Scheduler operational events 200 and 201 capture the actual action path when a task runs, and the message field includes the executable location. Extracting that path and filtering for user-writable directories like Users or AppData isolates tasks executing from locations where attackers stage payloads, which is the persistence signal the hunt targets.

Answer

index=wineventlog source="*TaskScheduler*" EventCode=106 | search TaskContent="*\Users\*" OR TaskContent="*\AppData\*" | table _time, Computer, TaskName, TaskContent

Answer

index=wineventlog EventCode=4698 | stats count by TaskName | where count > 1

Answer

index=wineventlog source="*TaskScheduler*" | stats dc(TaskName) as tasks by Computer | where tasks > 20

Question 20

You are hunting for adversaries abusing the Windows Remote Registry service for remote discovery and persistence. Splunk ingests Sysmon Event ID 1 (Process Create) and Windows Security Event ID 4657 (registry value modified). Which TWO Splunk search strategies most directly surface this abuse in your environment? (Choose two.)

Accepted Answer

Search Sysmon Event ID 1 for process_image ending in reg.exe where command_line contains 'save' or 'export' combined with a remote hostname or UNC path.. Remote Registry abuse leaves two complementary traces: process creation showing reg.exe acting against a remote hive path, and registry modification events naming RemoteRegistry objects under the acting account. Combining the process-level command line with the registry-level audit event gives both the tool used and the account performing the change, which is essential for scoping the intrusion. Neither event alone tells the full story, so pairing them produces a defensible hunt finding.

Answer

Search Sysmon Event ID 3 for network connections to tcp/445 and filter for processes with image paths under C:\Windows\System32\spoolsv.exe.

Answer

Search Windows Security Event ID 4624 for Logon Type 3 and filter for the RemoteRegistry service account to identify remote registry access.

Answer

Search Sysmon Event ID 1 for process_image ending in svchost.exe with command_line containing '-k netsvcs' to detect the RemoteRegistry service being enabled.