Detecting Attacks in Real-Time

Threat Hunting: Detecting Attacks in Real-Time with Splunk and ELK​

Table of Contents​

1. Introduction to Threat Hunting in Enterprise Environments
2. The Role of Splunk and ELK in Threat Detection
3. Setting Up Splunk and ELK for Threat Hunting
4. Threat Hunting Techniques and Queries
   • 4.1. Anomaly-Based Detection with Splunk
   • 4.2. Pattern-Based Detection with ELK
5. Automating Threat Detection with Machine Learning
6. Case Study: Detecting an Ongoing Attack in Real-Time
7. Best Practices for Threat Hunting
8. Conclusion
9. References
10. Disclaimer

1. Introduction to Threat Hunting in Enterprise Environments​

Why Threat Hunting?​

• Proactive Defense: Reduces dwell time of adversaries.
• Advanced Persistent Threats (APTs): Identifies attacks that evade traditional defenses.
• Incident Response: Provides valuable insights into the nature and scope of attacks.

2. The Role of Splunk and ELK in Threat Detection​

3. Setting Up Splunk and ELK for Threat Hunting​

Installing Splunk​

1. Download Splunk Enterprise from
   This link is hidden for visitors. Please Log in or register now.
   .
2. Install using:
   • Bash:

     wget -O splunk-9.0.0-linux-x86_64.tgz "https://download.splunk.com/..."
     tar -xvzf splunk-9.0.0-linux-x86_64.tgz -C /opt
     /opt/splunk/bin/splunk start --accept-license

3. Configure data sources (firewall logs, system logs, etc.).

Installing ELK Stack​

1. Install Elasticsearch, Logstash, and Kibana:
   • Bash:

     sudo apt update && sudo apt install elasticsearch logstash kibana

2. Enable services:
   • Bash:

     sudo systemctl start elasticsearch
     sudo systemctl start logstash
     sudo systemctl start kibana

3. Configure log sources using Filebeat or Winlogbeat.

4. Threat Hunting Techniques and Queries​

4.1. Anomaly-Based Detection with Splunk​

Finding Unusual Login Locations:​

index=security sourcetype=auth_logs
| stats count by src_ip, user
| where count > 5

Detecting Brute-Force Attempts:​

index=security sourcetype=auth_logs
| stats count by user, src_ip
| where count > 50

4.2. Pattern-Based Detection with ELK​

Searching for Known Malicious Commands:​

{
  "query": {
    "match": {
      "command": "nc -e /bin/sh"
    }
  }
}

Detecting Lateral Movement (Suspicious RDP Sessions):​

{
  "query": {
    "range": {
      "event.duration": {
        "gte": "1h"
      }
    }
  }
}

5. Automating Threat Detection with Machine Learning​

| inputlookup historical_data.csv
| fit DensityFunction event_count by user output mean, stdev
| eval is_anomalous=if(abs(event_count-mean) > 2*stdev, 1, 0)

{
  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [{
      "function": "high_mean",
      "field_name": "event_count"
    }]
  }
}

6. Case Study: Detecting an Ongoing Attack in Real-Time​

• Splunk Query:
  • Bash:

    index=network sourcetype=firewall_logs | search dest_port=4444

• ELK Query:
  • Bash:

    {
      "query": {
        "match": {
          "dest_port": "4444"
        }
      }
    }

• Outcome: Threat detected, blocked, and incident report generated.

7. Best Practices for Threat Hunting​

• Continuous Log Monitoring: Set up alerts for suspicious activity.
• Threat Intelligence Feeds: Integrate external threat feeds with Splunk/ELK.
• Regular Red Teaming Exercises: Test detections with simulated attacks.
• Behavioral Analysis: Go beyond signatures and analyze abnormal behaviors.

8. Conclusion​

9. References​

• Splunk Documentation:
  This link is hidden for visitors. Please Log in or register now.
• ELK Documentation:
  This link is hidden for visitors. Please Log in or register now.
• MITRE ATT&CK Framework:
  This link is hidden for visitors. Please Log in or register now.

10. Disclaimer​