## https://sploitus.com/exploit?id=5FE41074-EC7D-5240-B6D5-4C93B4C54FC3
# Splunk SIEM Investigation — Web Server Compromise
A hands-on SIEM triage exercise: starting from raw `web_traffic` and `firewall_logs` events in Splunk, I traced a single attacker IP through recon, SQL injection and LFI scanning, web shell deployment, malware execution, and confirmed command-and-control activity — corroborated by firewall logs on the compromised host.
📄 **Full write-up:** [INCIDENT_REPORT.md](./INCIDENT_REPORT.md)
## What this demonstrates
- Building and iterating SPL searches (`timechart`, `stats`, `table`, field filtering) to go from "something looks off" to a full attack timeline
- Pivoting across multiple data sources (web access logs → firewall logs) to correlate an event chain
- Recognizing attacker tooling from `user_agent` strings (sqlmap, Havij, zgrab) and mapping findings to MITRE ATT&CK
- Producing an analyst-style incident report with IOCs and remediation recommendations
## Key finding
Attacker `198.51.100.55` compromised the web host `10.10.1.5` via an uploaded web shell, staged and executed a binary (`bunnylock.bin`), and established outbound C2 on port 8080 — flagged by the firewall as `C2_CONTACT` (126 KB transferred across 285 sessions).
## Repo structure
```
.
├── README.md
├── INCIDENT_REPORT.md # full investigation write-up, IOCs, ATT&CK mapping, SPL queries
└── screenshots/ # Splunk search screenshots referenced in the report
```
## Tools
Splunk Enterprise (Search & Reporting)