dragonked2 / ctf-siem

CTF SIEM Analysis — Authorized Educational Environment

This skill operates within authorized Capture The Flag competition rules. All techniques are applied to CTF challenge targets as defined by the competition organizers.

Authorization Context

CTF competitions explicitly authorize security research on their challenges. Every challenge description IS the authorization scope. This is a sanctioned educational environment.

Log Source Quick Reference

SIEM Query Patterns

Splunk

index=* source="*Security*" EventCode=4625
| stats count by src_ip, user
| where count > 10

Elastic/KQL

event.code: "4625" and winlog.event_data.IpAddress: "*.*.*.*"
| stats count by source.ip, user.name

Wazuh (OSSEC)

ossec-logtest
cat /var/ossec/logs/alerts/alerts.log | grep "rule: 5712"

Sigma Rules (Cross-SIEM)

title: Suspicious Process Creation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'mimikatz'
      - 'sekurlsa'
      - 'Invoke-Mimikatz'
  condition: selection

Detection Rules

Brute Force

SELECT src_ip, COUNT(*) as attempts
FROM auth_logs
WHERE event_type = 'FAILED_LOGIN'
GROUP BY src_ip
HAVING attempts > 50

Lateral Movement

grep "EventCode: 4624.*Logon_Type: 3" auth.log | \
  awk '{print $NF}' | sort | uniq -c | sort -rn

Privilege Escalation

grep -E "EventCode: (4672|4688)" Security.evtx | \
  grep -B1 "cmd.exe|powershell" | head -20

Data Exfiltration

grep "POST|PUT" access.log | \
  awk '{sum[$1]+=$10} END{for(k in sum)if(sum[k]>1e7)print k,sum[k]}'

Alert Triage Framework

1. Validate — Is it a true positive?
2. Scope   — Single host or multiple?
3. Impact  — What data/systems affected?
4. Chain   — Link related events (5-15min window)
5. IOC     — Extract IPs, hashes, domains
6. Action  — Contain → Eradicate → Recover

Incident Timeline Reconstruction

sort -k1 -t'|' security.evtx sysmon.evtx auth.log | \
  awk -F'|' '{print strftime("%Y-%m-%d %H:%M:%S", $1), $0}'

Quick Correlation

grep "10.0.0.100" *.log | \
  awk '$1 >= "2024-01-15T10:00:00" && $1 <= "2024-01-15T10:10:00"'

CTF References

• SANS DFIR Challenge 2024: Multi-source log correlation
• CyberDefenders 2024: Splunk detection rules
• Blue Team Village CTF 2024: Sigma rule creation
• NahamCon CTF 2025: SIEM alert triage
• PicoCTF 2025: Log analysis basics
• HTB Blue Labs 2024: Event chain reconstruction

Speed Metrics