SPLK-5001 Threat Hunting Practice Test 2 — 15 Questions

Question 1

You are hunting for Kerberoasting activity in your Active Directory environment. You have Windows Security event logs and want to identify accounts that requested Kerberos service tickets (TGS) for multiple distinct service principal names (SPNs) within a short period, which may indicate an attacker enumerating and requesting tickets for offline cracking. Which Splunk search best detects this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=wineventlog EventCode=4769 | stats dc(Service_Name) as distinct_spns by Account_Name | where distinct_spns > 5 | sort - distinct_spns. Kerberoasting involves requesting Kerberos service tickets (EventCode 4769) for multiple SPNs to crack them offline. Detecting an account that requests tickets for many distinct services within a short period is a strong indicator. Using dc(Service_Name) by Account_Name correctly counts unique SPNs and surfaces anomalous behavior, enabling further investigation.

Answer

index=wineventlog EventCode=4769 | stats sum(Service_Name) as total_spns by Account_Name | where total_spns > 5 | sort - total_spns

Answer

index=wineventlog EventCode=4768 | stats count by Account_Name | where count > 5 | sort - count

Answer

index=wineventlog EventCode=4769 | stats values(Service_Name) as spns by Account_Name | where mvcount(spns) > 5 | sort - mvcount(spns)

Question 2

You are hunting for Kerberoasting activity in a Windows environment where Splunk ingests Security event logs and has the Authentication data model populated. Which TWO detection approaches best surface this behavior? (Choose two.)

Accepted Answer

Search for EventCode 4769 with a failure code of 0x0 requested by a non-service account, then use the Authentication data model to rank accounts by count of unique service names per hour.. Kerberoasting depends on requesting RC4-encrypted service tickets for accounts with registered SPNs. Detection therefore focuses on EventCode 4769 with encryption type 0x17, excluding krbtgt, and on behavioral baselines such as the number of distinct SPNs requested per account. Correlating through the Authentication data model standardizes fields and makes the enumeration burst visible across the environment.

Answer

Search for EventCode 4768 followed immediately by EventCode 4769 from the same host, and alert when the interval exceeds 30 minutes.

Answer

Search for EventCode 4624 with Logon Type 3 and filter for accounts authenticating from unusual source workstations during off-hours.

Answer

Search for EventCode 4769 where the Ticket Options field indicates a renewal or the ticket lifetime is abnormally long, and correlate with privileged account usage.

Question 3

A hunter wants to detect suspicious scheduled task creation on endpoints, using Splunk data from Windows Security Event Code 4698. The hunt should return the task name, the account that created it, and the command the task will run. Which search structure best achieves this?

Accepted Answer

index=wineventlog EventCode=4698 | rex field=Message "TaskName=(?<task_name>[^\s]+)" | table _time, ComputerName, SubjectUserName, task_name, Message. Security Event Code 4698 captures scheduled task creation, but the most useful details, including the task name and the action it will perform, are embedded in the event message rather than exposed as separate fields. Extracting the task name with rex and presenting it with the computer, creating account, and raw message lets an analyst quickly assess whether the task is suspicious.

Answer

index=wineventlog EventCode=4697 | table _time, ComputerName, SubjectUserName, Message

Answer

index=wineventlog EventCode=4698 | dedup ComputerName | table _time, ComputerName, SubjectUserName

Answer

index=wineventlog EventCode=4698 | stats count by ComputerName, SubjectUserName | sort - count

Question 4

A threat hunter suspects an attacker is using scheduled tasks for persistence. After collecting Windows Task Scheduler operational logs into Splunk, which search best identifies newly created tasks that execute from user-writable directories?

Accepted Answer

index=wineventlog source="*TaskScheduler*" EventCode=200 OR EventCode=201 | rex field=Message "Action: (?<action_path>[^\s]+)" | search action_path="*\Users\*" OR action_path="*\AppData\*" | table _time, Computer, TaskName, action_path. Task Scheduler operational events 200 and 201 capture the actual action path when a task runs, and the message field includes the executable location. Extracting that path and filtering for user-writable directories like Users or AppData isolates tasks executing from locations where attackers stage payloads, which is the persistence signal the hunt targets.

Answer

index=wineventlog source="*TaskScheduler*" EventCode=106 | search TaskContent="*\Users\*" OR TaskContent="*\AppData\*" | table _time, Computer, TaskName, TaskContent

Answer

index=wineventlog EventCode=4698 | stats count by TaskName | where count > 1

Answer

index=wineventlog source="*TaskScheduler*" | stats dc(TaskName) as tasks by Computer | where tasks > 20

Question 5

You are hunting for adversaries abusing the Windows Remote Registry service for remote discovery and persistence. Splunk ingests Sysmon Event ID 1 (Process Create) and Windows Security Event ID 4657 (registry value modified). Which TWO Splunk search strategies most directly surface this abuse in your environment? (Choose two.)

Accepted Answer

Search Sysmon Event ID 1 for process_image ending in reg.exe where command_line contains 'save' or 'export' combined with a remote hostname or UNC path.. Remote Registry abuse leaves two complementary traces: process creation showing reg.exe acting against a remote hive path, and registry modification events naming RemoteRegistry objects under the acting account. Combining the process-level command line with the registry-level audit event gives both the tool used and the account performing the change, which is essential for scoping the intrusion. Neither event alone tells the full story, so pairing them produces a defensible hunt finding.

Answer

Search Sysmon Event ID 3 for network connections to tcp/445 and filter for processes with image paths under C:\Windows\System32\spoolsv.exe.

Answer

Search Windows Security Event ID 4624 for Logon Type 3 and filter for the RemoteRegistry service account to identify remote registry access.

Answer

Search Sysmon Event ID 1 for process_image ending in svchost.exe with command_line containing '-k netsvcs' to detect the RemoteRegistry service being enabled.

Question 6

You are hunting for adversary use of Windows Management Instrumentation (WMI) event subscriptions for persistence. Splunk ingests Sysmon Event ID 19, 20, and 21 (WMI Event Filter, Consumer, and Consumer-to-Filter binding). Which Splunk search best surfaces a newly created permanent WMI subscription that would survive a reboot?

Accepted Answer

index=wineventlog source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=19 OR EventCode=20 OR EventCode=21) | stats values(EventType) as types dc(EventType) as tcount by User | where tcount>=3. Permanent WMI persistence requires three coordinated artifacts: an event filter that defines the trigger, an event consumer that defines the action, and a binding that links them. Seeing all three event types recorded by Sysmon under the same account is the strongest single-signal indicator of a durable subscription. Grouping by the acting user keeps the actor in view, enabling immediate pivoting to the responsible process and host.

Answer

index=wineventlog source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=19 | stats count by User, EventType, Query

Answer

index=wineventlog source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=19 OR EventCode=20 OR EventCode=21) | stats values(EventType) as types dc(EventType) as tcount by User, Query, Destination | where tcount>=3

Answer

index=wineventlog source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=21 | stats count by User, Consumer, Filter | sort - count

Question 7

You are hunting for credential dumping via the Windows Local Security Authority Subsystem Service (LSASS) memory. Splunk ingests Sysmon Event ID 10 (ProcessAccess) with GrantedAccess, CallTrace, and SourceImage fields. Which Splunk search best isolates suspicious access to lsass.exe that indicates an attempt to read credential material?

Accepted Answer

index=sysmon EventCode=10 TargetImage="*\lsass.exe" | where GrantedAccess="0x1010" OR GrantedAccess="0x1410" | stats count by SourceImage, TargetImage. Reading LSASS memory for credentials requires the process to request virtual memory read access, which appears as GrantedAccess 0x1010 or 0x1410 in Sysmon Event ID 10. Filtering on those masks while targeting lsass.exe narrows millions of process-access events to the small set consistent with dumping tools. Grouping by SourceImage and TargetImage then exposes which binary performed the access, giving you an immediate pivot for containment.

Answer

index=sysmon EventCode=10 TargetImage="*\lsass.exe" | stats count by SourceImage | sort - count | head 10

Answer

index=sysmon EventCode=10 TargetImage="*\lsass.exe" | where GrantedAccess="0x1FFFFF" | stats count by SourceImage

Answer

index=sysmon EventCode=10 TargetImage="*\lsass.exe" | where GrantedAccess="0x1000" | stats count by SourceImage

Question 8

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

Accepted Answer

index=windows EventCode=4688 | stats count by ParentProcessName, ProcessName. EventCode 4688 is Windows Security logging for process creation, and it includes both the new process name and the parent process name. By using stats count by ParentProcessName, ProcessName, an analyst can spot wmiprvse.exe spawning unusual shells like cmd.exe or powershell.exe, which is a hallmark of WMI lateral movement. The other event codes cover service installation, logon activity, or service creation, not process lineage.

Answer

index=windows EventCode=4697 | table User, ServiceName

Answer

index=windows EventCode=4624 | table Logon_Type, User

Answer

index=windows EventCode=7045 | stats count by ServiceName

Question 9

You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?

Accepted Answer

EventCode 10. Sysmon EventCode 10 is the correct answer because it specifically logs process access events, including when a process opens a handle to another process with memory-read permissions. Credential dumping tools such as Mimikatz must access lsass.exe memory to extract credentials, so EventCode 10 with a TargetImage of lsass.exe and a GrantedAccess mask indicating read access is the primary detection signal. This event is the most direct Sysmon telemetry for identifying LSASS memory access.

Answer

EventCode 1

Answer

EventCode 11

Answer

EventCode 3

Question 10

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

Accepted Answer

Hunt Procedure and Query Logic. The Hunt Procedure and Query Logic section documents the exact steps, SPL queries, data sources, and expected outputs of the hunt. This is what makes the playbook repeatable by another analyst and auditable later, because it captures the reproducible method rather than just the outcome. Without it, the playbook is not a procedure.

Answer

Threat Intelligence Source List

Answer

Executive Summary

Answer

Hardware Requirements

Question 11

Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?

Accepted Answer

Search Macro. A Search Macro in Splunk allows you to save a search query with variables (arguments) that can be reused across different searches, time ranges, and entities. It supports parameterization, enabling analysts to define placeholders that are replaced at runtime, making it ideal for reusable and dynamic searches.

Answer

Saved Search

Answer

Data Model Acceleration

Answer

Event Type

Question 12

Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?

Accepted Answer

Hypothesis Generation. Hypothesis Generation is the phase of the proactive threat hunting methodology where the hunter formulates a specific, testable hypothesis about a threat actor, technique, or behavior to investigate. This phase defines what to hunt for, based on threat intelligence, ATT&CK techniques, or environmental anomalies, before any data collection or execution occurs.

Answer

Data Preparation

Answer

Reporting

Answer

Hunt Execution

Question 13

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

Accepted Answer

eval decoded=base64_decode(field). The eval command with base64_decode function (A) is the correct SPL function to decode a Base64-encoded string. It takes a field containing Base64 data and returns the decoded string, which can then be analyzed.

Answer

rex field=field "(?<decoded>.*)"

Answer

transform base64 field

Answer

eval decoded=decode(field, "base64")

Question 14

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

Accepted Answer

dest. The Splunk Common Information Model (CIM) standardizes field names to enable consistent searching and reporting across diverse data sources. For network traffic data models, the CIM specifies 'dest' as the canonical field for the destination IP address. This normalization allows analysts to write a single search (e.g., `| tstats ... where nodename=All_Traffic`) that works regardless of whether the underlying source used 'dst_ip', 'remote_address', or 'target_ip'. Option C is correct because 'dest' is the exact field name defined in the CIM's Network Traffic data model.

Answer

dst_ip

Answer

remote_address

Answer

target_ip

Question 15

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

Accepted Answer

Event ID 1. Sysmon Event ID 1 is the 'Process Create' event, which logs the full command line, image path, parent process, user, and hashes for every process launched. For detecting living-off-the-land techniques (e.g., powershell.exe, wmic.exe, certutil.exe with suspicious arguments), Event ID 1 is the definitive source for command-line arguments.

Answer

Event ID 7

Answer

Event ID 2

Answer

Event ID 5