Welcome to the Tier 3 SOC Simulation. In this scenario, you will practice writing and analyzing Regular Expressions (Regex). Regex is a mandatory skill for SOC analysts, required for querying SIEMs, building custom parsing rules, and performing data extraction during incident response.
You are a SOC Analyst at CyberSecure Corp, an e-commerce platform. Threat Intelligence has recently warned of a Magecart-style web skimmer campaign targeting payment gateways. The attackers are attempting to bypass Web Application Firewalls (WAF) by hiding malicious JavaScript and data exfiltration payloads within CSS parameters—specifically by abusing user-controlled theme color inputs.
To detect potential data smuggling or UI redressing attacks, your L3 Lead has asked you to create a Splunk rex command that extracts all hex color codes from the raw WAF URIs so they can be cross-referenced against a list of known malicious hex sequences.
Below is a snippet of the raw WAF logs showing suspicious web requests targeting the site's customization API:
[WAF Access Log - Edge Node 04]
Timestamp: 2023-11-15T08:45:12Z
SrcIP: 192.0.2.45
Request: GET /checkout/customize?theme_color=%23FF5733&bg=%23000&font=Arial HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Alert: WAF_RULE_941100 (Suspicious Parameter Length)
[WAF Access Log - Edge Node 04]
Timestamp: 2023-11-15T08:46:01Z
SrcIP: 203.0.113.88
Request: GET /checkout/customize?theme_color=%23AABBCCDD&bg=%23F00 HTTP/1.1
User-Agent: python-requests/2.28.1
Alert: WAF_RULE_920280 (Missing Accept Header)IR Context Note: The URL-encoded %23 resolves to the # symbol. The SIEM normalizes the URL decoding prior to your regex execution, meaning you are searching for literal `#` symbols in your query.
The SOC team at CyberSecure Corp is conducting a security review to identify anomalous log entries from their firewall logs. The team needs to extract specific patterns such as email addresses, IP addresses, and URLs to detect unauthorized access attempts, phishing activities, and suspicious external communications. The SOC analyst applies various regular expressions (regex) patterns to filter and analyze logs efficiently. For example they use \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b to matches IPv4 addresses. Which regex pattern should the SOC analyst use to extract all hexadecimal color codes found in the logs?
#) and are followed by exactly 3 or exactly 6 characters representing combinations of letters (A-F) and numbers (0-9).
Data parsing is the backbone of SOC analytics. When standard SIEM parsers fail, or when hunting for highly specific IOCs embedded in long string fields (like URLs or command-line arguments), analysts must rely on Regex. In this scenario, extracting hex colors allows the SOC to baseline normal UI inputs and detect anomalies where an attacker might be passing large volumes of data (exfiltration) or malicious executable code encoded within CSS parameter bounds.
#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3}) successfully matches standard web hex colors. Let's break it down:
# : Matches the literal hash character.() : Creates a capture group.[A-Fa-f0-9] : A character class allowing any hex digit (0-9, a-f, A-F).{6} and {3} : Exact length quantifiers. A hex color is either 6 characters (e.g., #FF5733) or 3 characters (e.g., #000).| : The logical OR operator, meaning it will match either the 6-character sequence OR the 3-character sequence.\b\d{1,3}\.\d{1,3}... matches 4 octets separated by literal dots (e.g., 192.168.1.1). The \b indicates word boundaries....+@...+\.[a-zA-Z]{2,} looks for a string of alphanumeric/special characters, followed by an @, followed by a domain string, a literal dot, and a TLD of at least 2 characters (e.g., admin@cybersecure.corp).(0[1-9]|1[0-2])/.../\d{4} enforces standard MM/DD/YYYY date formatting, matching months (01-12) and days (01-31).While Regex is powerful, poorly written regex can cause a "catastrophic backtracking" event, severely spiking CPU usage on your SIEM indexers (like Splunk or Elasticsearch) and delaying critical alerts.
SIEM Regex Best Practices:
index=waf sourcetype=access uri="*checkout/customize*") to narrow the data pool before applying regex extraction.^ (start of string) and $ (end of string) speeds up processing because the engine doesn't have to scan the entire string if the beginning doesn't match..* (match everything greedily) is dangerous. Prefer non-greedy modifiers .*? or strict character classes [^/]+ (match anything except a forward slash) to limit the search scope.Master the EC-Council CSA, log parsing, and real-world threat hunting with our comprehensive lab environments.
Explore more CSA simulations