Forum Discussion
FIN7 Threat Hunting with Splunk: Execution Analysis
Hello everyone,
I am stuck at the following task :
"Which IP address and port does the encrypted payload communicate with? (Format ip:port)"
I think I found the right function (babymetal) as I could answer the previous question :
"What key is used to decode the embedded shellcode?"
But where do I go from there ? I thought about doing dynamic analysis, but I have no tools to do so. Quite frankly I am lost
Thanks for your help
1 Reply
- SamDickison
Community Manager
Hi Nicooks, looks like no one on the Community has got back to you, so I dug up this hint:
Since this is a Splunk threat hunting lab, you don't need external dynamic analysis tools because the execution artifacts and telemetry are already indexed for you. Instead, pivot your Splunk search to look for network connection logs (such as Sysmon Event ID 3) originating from the compromised process. Correlating the exact timeframe of the shellcode execution with outbound network traffic should reveal the destination IP and port you are looking for.
