Advent of Cyber 2025: Day 03 Splunk Basics — Did you SIEM?

0x7ipher

3 min read

·

Dec 3, 2025

--

Listen

Share

Assalamo Alaikum, my readers.
s you all know, today is 03/12/2025, so here is the Day 3 write-up of Advent of Cyber 2025. This write-up is specially made for beginners who are struggling with the tasks.

I am 100% sure that you have already completed the steps given in the room. So, without wasting any time, let’s move forward and solve all 5 tasks in this room step by step.

Press enter or click to view image in full size

1) What is the attacker IP found attacking and compromising the web server?

• The command I used on splunk to get the client ip (suspicious ip)!!

index=main sourcetype=web_traffic user_agent!=*Mozilla* user_agent!=*Chrome* user_agent!=*Safari* user_agent!=*Firefox*

Press enter or click to view image in full size

• Here the client ip is the suspicious ip address talking about in this task.

Answer: 198.51.100.55

2) Which day was the peak traffic in the logs? (Format: YYYY-MM-DD)?

• The command I used on splunk for getting the exact day that had the peak traffic!!

index=main sourcetype=web_traffic
| timechart span=1d count
| sort - count
| head 1
| eval peak_day = strftime(_time, "%Y-%m-%d")
| table peak_day count

Press enter or click to view image in full size

Answer: 2025–10–12

3) What is the count of Havij user_agent events found in the logs?

• The command I used on splunk to count the user_agent events!!

index=main sourcetype=web_traffic user_agent="*Havij*"
| stats count

Press enter or click to view image in full size

Answer: 993

4) How many path traversal attempts to access sensitive files on the server were observed?

• The command I used on splunk to count the total path traversal attempts !!

index=main sourcetype=web_traffic client_ip="198.51.100.55"
AND path="*..*"
AND (
    path="*/etc/passwd*" OR
    path="*/etc/shadow*" OR
    path="*/proc/self/environ*" OR
    path="*.env*" OR
    path="*.ini*"
)
| stats count

Press enter or click to view image in full size

Answer: 658

5) Examine the firewall logs. How many bytes were transferred to the C2 server IP from the compromised web server?

• The command I used on splunk to count !!

index=main sourcetype=web_traffic client_ip="198.51.100.55"
AND path="*..*"
AND (
    path="*/etc/passwd*" OR
    path="*/etc/shadow*" OR
    path="*/proc/self/environ*" OR
    path="*.env*" OR
    path="*.ini*"
)
| stats count

Press enter or click to view image in full size

Answer: 126167

“I hope you all enjoyed this write-up. Insha Allah, we will meet soon with a new write-up, new challenges, and new tasks.”

My TryHackme Profile : https://tryhackme.com/p/7aad