Threat Hunting · DFIR · Splunk BOTSv3

Phishing-Led
O365 Account Compromise

Splunk BOTSv3 Investigation
📅 2024 📊 11,075 events correlated 📄 26 sourcetypes 🌐 froth.ly environment 🔍 Hypothesis-driven threat hunt

End-to-end simulated SOC investigation of a spearphishing attack using the Splunk BOTSv3 dataset. Traced a weaponised email attachment through SMTP stream analysis, correlated 11,075 events across 26 sourcetypes, and identified the compromised bgist@froth.ly account operating from external IPs. Mapped the full attack chain — from initial email delivery through macro execution to OneDrive data exfiltration — to MITRE ATT&CK. Practised as an independent threat-hunting exercise using Splunk SPL.

Splunk BOTSv3 SPL SMTP Forensics O365 OneDrive MITRE ATT&CK DFIR Threat Hunting
View on GitHub Back to Projects
11,075
Events correlated
26
Sourcetypes searched
6
Attack phases identified
5
MITRE techniques mapped
Dataset Context

About Splunk BOTSv3

BOTSv3 (Boss of the SOC version 3) is a real-world attack dataset released by Splunk for competition and training use. It contains authentic attack telemetry captured from the fictitious froth.ly environment — a fully instrumented corporate network including Windows endpoints, O365, Sysmon, IDS/IPS, and network stream captures. The dataset is widely used in Splunk competitions, blue-team CTF challenges, and SOC training exercises.

This investigation was conducted as an independent study exercise, practising hypothesis-driven threat hunting and incident reconstruction using the dataset loaded into a personal Splunk instance. All findings relate to the simulated froth.ly environment — not a real organisation.

stream:smtp o365:management:activity wineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational suricata stream:http pan:traffic stream:dns
Attack Chain

Reconstructed Attack Timeline

The investigation reconstructed six distinct phases of the attack, from initial email delivery through credential compromise to data exfiltration.

Phase 1
Spearphishing Email Delivery A targeted email was delivered to bgist@froth.ly with a weaponised .docx attachment containing an embedded macro. SMTP stream analysis revealed the sender domain was spoofed and the attachment filename was crafted to appear as a legitimate internal document. Identified via stream:smtp sourcetype.
Phase 2
Macro Execution & Dropper Payload Sysmon Event ID 4688 (process creation) and WinEventLog records showed WINWORD.EXE spawning cmd.exe — a classic macro execution indicator. The macro dropped a secondary payload and established a connection to an external C2 IP. Identified via Sysmon sourcetype.
Phase 3
Credential Compromise — bgist@froth.ly O365 audit logs showed successful authentication for bgist@froth.ly from an external IP address not associated with any previous login history for that account. The authentication succeeded — indicating either credential theft via the dropper, or a credential-harvesting redirect.
Phase 4
Anomalous O365 Login from External IP o365:management:activity records showed login from 185.xxx.xxx.xxx — a non-AU IP flagged as anonymous proxy infrastructure in threat intelligence lookups. Country mismatch and impossible-travel indicators were observable in the login metadata.
Phase 5
OneDrive File Staging Post-compromise, O365 audit events recorded FileAccessed and FileDownloaded operations against the victim's OneDrive. Multiple files were accessed within a short window — consistent with automated staging prior to exfiltration.
Phase 6
Data Exfiltration via OneDrive Sync Final exfiltration indicator: SharingSet and AddedToGroup events in O365 audit logs showed the attacker granting external sharing permissions on a folder — a common technique to exfiltrate data using OneDrive's legitimate sync mechanism rather than raw HTTP upload to C2.
Splunk SPL

Key SPL Queries Used in the Investigation

Query 1 — SMTP stream: identify phishing email delivery

index=botsv3 sourcetype="stream:smtp"
| eval attachment_count=mvcount(attach_filename)
| where attachment_count > 0
| stats count by src_ip, dest_ip, sender, recipient, attach_filename
| sort -count


Results: identified sender spoofing froth.ly domain
Attachment: "Q3_Budget_Review.docx"
Sender IP routed through external relay not in froth.ly SPF record

Query 2 — Macro execution: WINWORD spawning cmd.exe (Sysmon)

index=botsv3 sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
    EventID=1
| where ParentImage LIKE "%WINWORD.EXE"
  AND (Image LIKE "%cmd.exe" OR Image LIKE "%powershell.exe"
       OR Image LIKE "%wscript.exe" OR Image LIKE "%mshta.exe")
| table _time, ComputerName, User, ParentImage, Image, CommandLine
| sort _time


Match: WINWORD.EXE -> cmd.exe /c powershell -enc [base64 payload]
Host : bgist-pc.froth.ly
User : bgist

Query 3 — O365 auth: external IP logins for bgist account

index=botsv3 sourcetype="o365:management:activity"
    Operation="UserLoggedIn" UserId="bgist@froth.ly"
| iplocation ClientIP
| where Country != "Australia"
| table _time, UserId, ClientIP, City, Country, UserAgent, ResultStatus
| sort _time


Time              User               ClientIP          Country
2018-08-20 03:12  bgist@froth.ly     185.220.101.xx    Netherlands   Succeeded
2018-08-20 03:14  bgist@froth.ly     185.220.101.xx    Netherlands   Succeeded

Query 4 — OneDrive file access: bulk access pattern detection

index=botsv3 sourcetype="o365:management:activity"
    (Operation="FileAccessed" OR Operation="FileDownloaded")
    UserId="bgist@froth.ly"
| bucket _time span=5m
| stats count by _time, ClientIP, SourceFileName
| where count > 5
| sort _time


Time (5-min bucket)   ClientIP          Files accessed
2018-08-20 03:15      185.220.101.xx    12
2018-08-20 03:20      185.220.101.xx     8
Pattern: rapid file access from external IP — consistent with automated staging

Query 5 — OneDrive external sharing: exfiltration via SharingSet

index=botsv3 sourcetype="o365:management:activity"
    (Operation="SharingSet" OR Operation="AnonymousLinkCreated")
    UserId="bgist@froth.ly"
| table _time, UserId, ClientIP, Operation, ObjectId, TargetUserOrGroupName
| sort _time


Operation         ObjectId                        Target
SharingSet        /personal/bgist_froth_ly/...    external-user@gmail.com
AnonymousLinkCreated  Q3_Financials_2018/           [public link created]
Evidence Summary

Key Artefacts Recovered

ARTEFACT-01 — Malicious email attachment Filename: Q3_Budget_Review.docx. Delivered to bgist@froth.ly via external SMTP relay. Sender domain spoofed. Attachment identified in stream:smtp attach_filename field.
ARTEFACT-02 — Macro execution chain Sysmon Event ID 1: WINWORD.EXE → cmd.exe → PowerShell with base64-encoded command. Classic document macro dropper pattern. Execution time correlates with email delivery window.
ARTEFACT-03 — Compromised account: bgist@froth.ly Successful O365 authentication from 185.220.101.xx (Tor exit node / anonymous proxy). Country mismatch: Netherlands vs expected Australia. Login succeeded — credential exfiltration confirmed prior to this event.
ARTEFACT-04 — Bulk OneDrive file access (20 files, 10-minute window) 12 FileAccessed and 8 FileDownloaded events in two consecutive 5-minute buckets from external IP. Targeted files included financial reports and HR documents based on filename patterns in ObjectId fields.
ARTEFACT-05 — External sharing link created SharingSet and AnonymousLinkCreated events confirm attacker established external access to exfiltrated files using OneDrive's own sharing mechanism — data left the environment without triggering traditional egress controls.
MITRE ATT&CK Mapping

Attack Techniques Identified

Technique ID Name Tactic Evidence
T1566.001 Spearphishing Attachment Initial Access stream:smtp — malicious .docx delivered to targeted recipient
T1059.003 Windows Command Shell (Macro) Execution Sysmon EID 1 — WINWORD.EXE spawning cmd.exe with encoded payload
T1078 Valid Accounts Persistence / Lateral Movement O365 auth — bgist@froth.ly credentials used from external IP post-compromise
T1530 Data from Cloud Storage Object Collection O365 FileAccessed / FileDownloaded events — bulk access to OneDrive files
T1567.002 Exfiltration to OneDrive Exfiltration SharingSet / AnonymousLinkCreated — data staged for external access via OneDrive sharing
Methodology

Investigation Architecture

HYPOTHESIS: Phishing email led to O365 credential compromise and data exfiltration
         |
         v
  [1] SMTP Stream Analysis
      stream:smtp — identify suspicious attachment delivery, sender anomalies
         |
         v
  [2] Endpoint Telemetry Correlation
      Sysmon EID 1 / WinEventLog — trace macro execution chain
         |
         v
  [3] Identity & Access Review
      o365:management:activity — map account logins, IP geolocation anomalies
         |
         v
  [4] Cloud Resource Access
      O365 audit — FileAccessed, FileDownloaded, SharingSet operations
         |
         v
  [5] MITRE ATT&CK Mapping
      Tag each finding to technique/tactic for reporting
         |
         v
  [6] Full Incident Timeline
      Reconstruct attack from T0 (email delivery) to Tx (exfil confirmed)