As an aspiring SOC analyst, I’m continually developing my knowledge and skills in cyber security. And to help me build these skills, I’m subscribed to TryHackMe (THM).
I’m currently working through the SOC Level 1 path, and I’m working through the Network Security Monitoring element of this course.
I’ve already completed this section, but the reason I’m repeating this part of the path is to reinforce my understanding of things.
And I wanted to share here on this blog, what I’ve discovered and learned recently.
As a bit of background, this part of the course discussed network security essentials, network visibility, network perimeter, and monitoring and protecting.
At the end of this section, THM asks you to answer some questions using the THM virtual machine.
Firewall
The first question being asked on THM was as follows.
I initially just opened the firewall txt log file to see what was there, and because the log file was small, I was quickly able to identify that the IP address performing the port scan was 203.0.113.10.
However, I’m conscious of the fact that in a real world scenario, it’s likely you’d be dealing with large logs files. And so, a different approach may be needed to analysing and investigating log files.
A More In-Depth approach
I thought about an approach I’d take if this was a real world scenario and I was dealing with a large log file. And assuming no knowledge, I started with the following commands to see if there was any information I could garner to help me narrow things down.
head -n 20 firewalls_logs.txt
tail -n 20 firewalls_logs.txt
The ‘head’ command with the ‘-n 20’ flag gives me the first 20 lines by position in the log file, whereas ‘head’ on it’s own will just give me the first 10 lines in the file.
As a sidenote, while ‘head’ is useful for understanding the structure and format of a log file, ‘tail’ is typically more valuable during investigations because it shows the most recent activity, which is often where active attacks or anomalies appear. In this case though, ‘tail’ didn’t reveal anything useful to me here.
With the ‘head’ command, I could see the output revealed some interesting information.
As per the previous log I manually looked at, this revealed details of the port scan being conducted. But it also revealed some key words I could use in a more specific search – ‘BLOCK’.
From here, I could then have just used the following command.
grep “BLOCK” firewall_logs.txt | sort | uniq -c
And this shows the following:
With the keyword of ‘BLOCK’, this more clearly shows the port scan occurring.
In conclusion here, what the log is showing is that the same external IP (203.0.113.10) is trying to connect to multiple ports on the same internal machine quickly, but is being blocked by the firewall.
And this is a classic port scan. The attacker is looking for an open service to target.
Prior to using the above command, I used the following command to help me explore the log file further to reach this point.
grep -Eio ‘deny | denied | drop | dropped | block | blocked | reject | rejected’ firewall_logs.txt | sort | uniq -c | sort -nr | head
This command works as follows:
grep – searches for patterns
-E – allows extended regular expressions.
-i – means case insensitive.
-o – only matches the words specified. This is useful because firewalls often log unsuccessful or blocked traffic using these words.
The above command is then piped to ‘sort’ (|). This alphabetically sorts the matched keywords. This step is required to make the next command of ‘uniq -c’ work correctly.
uniq -c – collapses adjacent (removes) duplicate lines and counts them.
sort -nr – sorts numerically (n) and descending (r)
And ‘head’ finally shows the first ten lines/output.
The output from this reveals there are 16 lines with the term ‘BLOCK’. I’ve not included the full image here though because the command is quite long, and the image is reduced in size when pasting here, which makes it difficult to read and see the output.
What I took away from this
Whilst I could’ve got to the answer quicker than I did, my goal in this task was to explore options and to see what I could find using various commands.
I’m aware that in a real world SOC environment speed and accuracy is key. But I hope this post broadly demonstrates my approach to analysing things, while I’m practicing things and learning.