A walkthrough of TryHackMe's Advent of Cyber 2025 Day 3 challenge focused on using Splunk for incident investigation. The guide covers ingesting web traffic and firewall logs, writing SPL queries to identify a malicious IP, tracing an attack chain from reconnaissance through SQL injection, webshell deployment, ransomware
•12m read time• From infosecwriteups.com
Table of contents
Let’s break down our result for a better understanding:Visualizing the Logs TimelineAnomaly DetectionFiltering out Benign ValuesNarrowing Down Suspicious IPsTracing the Attack ChainSort: