Exercise 1.1: Exploring Suspicious Executable Detected using SIEM

Goals

To investigate suspicious activity using SIEM.

Objectives

After completing this exercise, you should be able to:

• Investigate an alert in SIEM.
• Document findings.
• Make an assessment based on your investigation.

Introduction

The next entry in the shift log is:

•     Incident (inc02): Alert on suspicious executable detected 

Metasploit is a penetration testing tool used by both security professionals and hackers. Activity of this nature may or may not present a security threat.

Instructions

Follow these steps to complete this exercise: 

1. From your lab environment, open SIEM.
2. Select Unifiedà Investigation.
3. The investigation device list appears.
4. Choose Concentrator by double-clicking on it.
5. Investigate the ‘hacker tool activity’ alert which is listed in the Alerts section.
6. List the affected IP addresses:
7. Identify the user account involved in this alert:
8. Classify the suspicious activity:
9. Which service is exploited?
10. What do you conclude after investigating this alert?

Solution

•

List the affected IP addresses:

• Source IP Addresses:
• 192.168.5.10
• 172.15.2.11
• Destination IP addresses:
• 192.168.5.189
• 64.53.52.12
• 192.168.5.172

•

Identify the user account involved in this alert? –            metasploit

•

Classify the suspicious activity: –           Account escalation

•

Which service is exploited?

–    SMB

•

What do you conclude after investigating this alert?

–    Nothing suspicious

•

Any recommendations?