FIN7 Threat Hunting with Splunk: Execution Analysis

Hi Nicooks​, looks like no one on the Community has got back to you, so I dug up this hint:

Since this is a Splunk threat hunting lab, you don't need external dynamic analysis tools because the execution artifacts and telemetry are already indexed for you. Instead, pivot your Splunk search to look for network connection logs (such as Sysmon Event ID 3) originating from the compromised process. Correlating the exact timeframe of the shellcode execution with outbound network traffic should reveal the destination IP and port you are looking for.