SPLK-5001 Threat Hunting Practice Test 1 — 15 Questions

Question 1

You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

search dest_ip=x.x.x.x | streamstats current=f window=2 global=f last(_time) as prev_time | eval diff=_time - prev_time. Beaconing is characterized by regular, periodic connections, so the key is measuring the time delta between consecutive connections to the same destination. The streamstats command with current=f and window=2 computes the difference between the current event's _time and the previous event's _time, producing inter-arrival intervals that reveal a consistent beacon pattern (e.g., every 60 seconds with low jitter). This is the standard SPL approach for validating beaconing hypotheses.

Answer

search dest_ip=x.x.x.x | rare dest_ip

Answer

search dest_ip=x.x.x.x | timechart span=1h count

Answer

search dest_ip=x.x.x.x | stats count by _time

Question 2

You are hunting for data exfiltration and want to identify large outbound file transfers. Which tool in Splunk is best suited to baseline 'normal' transfer volume per user?

Accepted Answer

Splunk Machine Learning Toolkit (MLTK). The 'pivot' interface or 'stats' command combined with 'stdev' (standard deviation) is ideal for establishing baselines to identify statistical outliers.

Answer

Splunk DB Connect

Answer

Splunk Dashboard Studio

Answer

Splunk Add-on Builder

Question 3

You are analyzing a data model using tstats. You need to identify rare process executions across your environment. Which command structure provides the most performance-optimized result?

Accepted Answer

| tstats summariesonly=t count from datamodel=Endpoint.Processes by Processes.process_name | sort count. The tstats command with summariesonly=t queries the accelerated data model summaries, which is the most performance-optimized way to aggregate process executions. Grouping by Processes.process_name and sorting by count identifies rare processes efficiently. This leverages the TSIDX acceleration rather than scanning raw events.

Answer

| inputlookup processes.csv | stats count

Answer

index=windows | rare limit=20 ProcessName

Answer

| search index=windows | stats count by ProcessName | sort -count

Question 4

An attacker has cleared the Windows Event Logs to hide their tracks. You are hunting for this activity. Which Event ID in the System log indicates that the log service was stopped or cleared?

Accepted Answer

Event ID 1102. Windows Event ID 1102 in the Security log indicates that the audit log was cleared, which is a direct indicator of an attacker covering their tracks. Although the question mentions the System log, Event ID 1102 is logged in the Security log when the audit log is cleared, and it is the canonical event for log clearing. Event ID 1102 is generated by the Windows Event Log service when the security audit log is cleared.

Answer

Event ID 4688

Answer

Event ID 7036

Answer

Event ID 4624

Question 5

You are conducting a hunt for unauthorized remote access tools. Which Splunk command is most effective for identifying processes that are running from unusual directories (e.g., AppData, Temp)?

Accepted Answer

index=windows | stats count by Image | where like(Image, "%\AppData%"). It uses `stats count by Image` to aggregate process executions by their full path, then filters with `where like(Image, "%\AppData%")` to isolate processes running from AppData directories. This directly targets the hunt hypothesis: unauthorized remote access tools often execute from user-writable paths like AppData or Temp. The `like` function supports wildcard matching, making it ideal for pattern-based filtering on file paths.

Answer

index=windows | table Image | sort Image

Answer

index=windows | search Image="*" | head 100

Answer

index=windows | rare Image

Question 6

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Accepted Answer

Windows Security Event ID 4688 (Process Creation). Option A, Windows Security Event ID 4688 (Process Creation), is correct because it records the exact process image, parent process, and command line executed on a host, letting hunters spot remote-execution artifacts such as PsExec, WMI, or schtasks spawning cmd.exe/powershell.exe from unusual parents. Option B, Windows System Event ID 7045 (Service Installation), is correct because lateral-movement tools like PsExec and Impacket's smbexec install a temporary service on the target, and 7045 captures the service name, image path, and service type for that pivot. Option E, Windows Security Event ID 4624 (Logon), is correct because its Logon Type field (e.g., 3 for network, 10 for RDP) and source workstation/IP reveal the origin of remote authentication, which is the core correlation point for tracking movement between hosts. Option C (System Event ID 104, Log Cleared) is anti-forensic evidence of cleanup rather than a record of lateral movement itself, and Option D (Security Event ID 4611, Trusted Logon) concerns a process registering as trusted for logon, which is not a standard lateral-movement indicator.

Answer

Windows System Event ID 104 (Log Cleared)

Answer

Windows Security Event ID 4611 (Trusted Logon)

Question 7

You are a threat hunter investigating potential data exfiltration over DNS. You have Splunk Enterprise Security with the Network_Traffic data model accelerated. You want to find DNS TXT queries where the query length exceeds 100 characters, which may indicate DNS tunneling. Which Splunk search correctly uses tstats to query the Network_Traffic data model?

Accepted Answer

| tstats summariesonly=t count from datamodel=Network_Traffic.DNS where DNS.message_type="TXT" by DNS.query | eval qlen=len(DNS.query) | where qlen > 100. To hunt for DNS tunneling, you must query the correct data model dataset and use the appropriate fields. The DNS child dataset in Network_Traffic contains fields like message_type and query, but not query_length. Therefore, you must calculate the query length using eval len() after the tstats command, and filter for TXT message types. This approach leverages accelerated data model summaries for efficiency while accurately identifying long DNS queries that may indicate exfiltration.

Answer

| tstats summariesonly=t count from datamodel=Network_Traffic.DNS where DNS.query_length > 100 by DNS.query | search DNS.message_type="TXT"

Answer

| tstats summariesonly=t count from datamodel=Network_Traffic.DNS where DNS.query_length > 100 by DNS.query | search DNS.query="*.txt*"

Answer

| tstats summariesonly=t count from datamodel=Network_Traffic.All_Traffic where DNS.message_type="TXT" by DNS.query | where len(DNS.query) > 100

Question 8

During a threat hunt for beaconing activity, you observe periodic outbound connections to a rare external IP every 60 seconds with small, consistent payloads. You want to quantify how regular these intervals are to distinguish automated C2 from human-driven traffic. Which Splunk command should you use to calculate the standard deviation of the time between connections?

Accepted Answer

streamstats. To detect beaconing, you need the time between consecutive connections and a measure of how consistent those intervals are. streamstats can compute the delta between events in sequence, and then stats stdev on those deltas reveals regularity. This distinguishes automated callbacks from irregular human traffic.

Answer

transaction

Answer

eventstats

Answer

stats

Question 9

You are hunting for anomalous authentication activity across your Windows environment, which ingests Security event logs. You want to find accounts that have authenticated from an unusually high number of distinct source workstations within the last 24 hours, a pattern that may indicate credential misuse or lateral movement. Which Splunk search best identifies these accounts?

Accepted Answer

index=wineventlog EventCode=4624 | stats dc(WorkstationName) as distinct_sources by Account_Name | where distinct_sources > 10 | sort - distinct_sources. The hunt aims to detect accounts authenticating from an unusually high number of distinct workstations, a sign of credential misuse. Filtering successful logons (4624) and using dc(WorkstationName) by Account_Name correctly measures unique source hosts per account. A where clause then isolates accounts exceeding a threshold, surfacing potential lateral movement or shared credential abuse that warrants further investigation.

Answer

index=wineventlog EventCode=4624 | stats sum(WorkstationName) as total_sources by Account_Name | where total_sources > 10 | sort - total_sources

Answer

index=wineventlog EventCode=4625 | stats count by Account_Name | where count > 10 | sort - count

Answer

index=wineventlog EventCode=4624 | stats values(WorkstationName) as sources by Account_Name | where mvcount(sources) > 10 | sort - mvcount(sources)

Question 10

You are building a hunt to detect DNS tunneling. You have DNS logs in Splunk with fields query, src, and answer. Which Splunk command is best for identifying hosts that generate an unusually high number of unique DNS queries with long subdomain strings?

Accepted Answer

stats dc(query) as unique_queries by src. DNS tunneling encodes data in subdomains, generating many unique queries from a single compromised host. Using stats dc(query) by src reveals hosts with abnormally high unique query counts. This is a simple and effective first-pass hunt for tunneling activity.

Answer

top limit=10 query

Answer

rare query

Answer

timechart count by query

Question 11

You are conducting a hunt for DNS tunneling, where malware encodes data in DNS queries. Your DNS logs are in the Splunk CIM DNS data model. You want to identify hosts making an unusually high number of DNS queries with long subdomain strings to a single domain within a short window. Which Splunk search using tstats best surfaces this behavior?

Accepted Answer

| tstats count from datamodel=Network_Resolution.DNS by DNS.src, DNS.query | rex field=DNS.query "\.(?<domain>[^.]+\.com)$" | eval len=len(DNS.query) | where len > 50 | stats count by DNS.src, domain | where count > 100. DNS tunneling often manifests as a host sending numerous long, encoded subdomain queries to a single domain. Using tstats on the Network_Resolution.DNS data model, extracting the base domain, filtering for long queries, and then counting per source host and domain with a threshold isolates this behavior. This approach surfaces the high-volume, single-domain pattern characteristic of tunneling.

Answer

Answer

Answer

Question 12

You are hunting for signs of data exfiltration over HTTP. You have proxy logs in Splunk with fields src_ip, dest_host, bytes_out, and http_method. Which TWO Splunk search constructs are most effective for identifying potential exfiltration? (Choose two.)

Accepted Answer

stats sum(bytes_out) as total_bytes by src_ip, dest_host | where total_bytes > 10000000. Exfiltration over HTTP often manifests as unusually large outbound transfers. Summing bytes_out per source and destination with a threshold detects bulk uploads, while comparing each transfer to the host's average highlights anomalies. Together, these constructs efficiently narrow down potential exfiltration events.

Answer

timechart span=1h sum(bytes_out) by src_ip

Answer

top limit=5 dest_host by src_ip

Answer

search http_method=POST | stats count by dest_host

Question 13

During a hunt for DNS-based data exfiltration, you want to surface hosts that resolve an unusually high number of unique subdomains under a single parent domain, which may indicate DNS tunneling. Which SPL search best produces this result from your network telemetry?

Accepted Answer

index=dns | rex field=query "\.(?<parent_domain>[^.]+\.(com|net|org))$" | stats dc(query) as subdomain_count by src_ip, parent_domain | where subdomain_count > 50. Effective DNS-tunneling hunts require two things: normalization to the parent domain so all encoded subdomains collapse into one group, and a distinct count of the full query names per source host. Only an approach that extracts the registrable domain and applies dc(query) with a threshold reveals a single host fanning out across many unique labels beneath one authoritative domain, which is the hallmark of encoded exfiltration over DNS.

Answer

index=dns | stats dc(query) as subdomain_count by src_ip, query | where subdomain_count > 50

Answer

index=dns | top limit=50 query by src_ip

Answer

index=dns | stats count by src_ip, query | sort - count | head 100

Question 14

You are hunting for PowerShell-based attacks and want to identify suspicious command-line arguments that may indicate obfuscation or malicious intent. You have process creation logs in Splunk. Which TWO command-line patterns are most indicative of potentially malicious PowerShell usage? (Choose two.)

Accepted Answer

-EncodedCommand. The -EncodedCommand and -ExecutionPolicy Bypass parameters are strongly associated with malicious PowerShell usage. -EncodedCommand hides the actual script in Base64, complicating detection, while -ExecutionPolicy Bypass allows unrestricted script execution. Both are frequently observed in attacker command lines and are high-fidelity indicators when hunting for PowerShell-based threats.

Answer

-Verbose

Answer

-WindowStyle Hidden

Answer

-NoProfile

Question 15

You are hunting for DNS tunneling used by malware to exfiltrate data. You have Splunk ES with the Network_Resolution data model populated. Which search most effectively surfaces hosts generating abnormally high volumes of unique DNS queries with long subdomain strings in a 24-hour window?

Accepted Answer

| tstats summariesonly=true count from datamodel=Network_Resolution.DNS where DNS.query=* groupby DNS.src, DNS.query | eval qlen=len(DNS.query) | where qlen > 50 | stats dc(DNS.query) as uniq by DNS.src | where uniq > 500. DNS tunneling produces many unique, unusually long subdomain queries from a single host, so the effective hunt combines accelerated data model access, a per-query length filter, and a distinct-count aggregation by source. Searching raw DNS events and ranking only by total volume or by common subdomain labels misses the uniqueness and length signals that distinguish tunneling from normal resolution.

Answer

index=dns | stats count by query | sort -count | head 20

Answer

index=dns | rex field=query "(?<subdomain>^[^.]+)" | top subdomain | where count > 100

Answer

| datamodel Network_Resolution DNS search | search query=* | stats sum(len(query)) as total by src | where total > 10000