Introduction to hands-on network monitoring and threat detection with Zeek (formerly Bro). 

 


Task 2


Task 3


Task 5


Task 6


Task 7


Task 8


Task 9

Before starting the walkthrough :
Some useful commands for Zeek

Generate log files from pcap file

 zeek -C -r file.pcap

Generate log files with signature from pcap file

zeek -C -r file.pcap -s signature.sig

Generate log file with a script

zeek -C -r file.pcap script.zeek

Generate log file with a signature and a script together

zeek -C -r file.pcap -s signature.sig script.zeek

Exploring log files.

When generating the logs file is done, use zeek-cut to exploring the log file. You have to know what « fields » you want to find. Don’t use the #types fields.
So before, you have to open the log file with « head » like head conn.log. When you do that, you get the category of the log file like this :

So if you want to know the IP source and his port, you can to do this command :

cat conn.log | zeek-cut id_orig_h id_orig_p

With zeek-cut, it’s possible to use others Linux command lines like | wc -l to count the line or  | sort -u to find to avoid duplicate information. 

Finally 

Use your kung fu command line skills!!!!!

Task 2 : Network Security Monitoring and Zeek

• What is the installed Zeek instance version number?

Answer : 4.2.1

Commande :  

zeek -v

• What is the version of the ZeekControl module?

Answer : 2.4.0

Commande :

zeekctl -v

• Investigate the « sample.pcap » file. What is the number of generated alert files?

Answer : 8

Commande :

zeek -C -r sample.pcap

Task 3 : Zeek Logs

• Investigate the sample.pcap file. Investigate the dhcp.log file. What is the available hostname?

Answer : Microknoppix

Command :   

zeek -C -r sample.pcap

cat dhcp.log | zeek-cut host_name

• Investigate the dns.log file. What is the number of unique DNS queries?

Answer : 2

Commande :

cat dns.log | zeek-cut query | sort -u | wc -l

• Investigate the conn.log file. What is the longest connection duration?

Answer : 332.319364

Command :

cat conn.log | zeek-cut duration | sort -n

Task 5 Zeek Signatures

• Investigate the http.pcap file. Create the HTTP signature shown in the task and investigate the pcap. What is the source IP of the first event?

Answer : 10.10.57.178

Command :

zeek -C -r http.pcap -s http-password.sig
cat  http.log | zeek-cut id.orig_h

• What is the source port of the second event?

Answer : 38172

Command :

cat  http.log | zeek-cut id.orig_p

• Investigate the conn.log.
  What is the total number of the sent and received packets from source port 38706?

Answer : 20

Command :

zeek -C -r http.pcap -s http-password.sig 

cat conn.log | zeek-cut orig_pkts resp_pkts id.orig_p | grep 38706

• Create the global rule shown in the task and investigate the ftp.pcap file.

  Investigate the notice.log. What is the number of unique events?

Answer : 1413

Command :

zeek -C -r ftp.pcap -s ftp-bruteforce.sig
head notice.log 
cat notice.log | zeek-cut uid | sort -u | wc -l

• What is the number of ftp-brute signature matches?

Answer : 1410

Command :

cat notice.log | zeek-cut  msg | grep Brute-force | wc -l

Task 6 Zeek Scripts | Fundamentals

• Investigate the smallFlows.pcap file. Investigate the dhcp.log file. What is the domain value of the « vinlap01 » host?

Answer : astaro_vineyard

Commande :

zeek -C -r smallFlows.pcap dhcp-hostname.zeek
cat dhcp.log | zeek-cut domain

• Investigate the bigFlows.pcap file. Investigate the dhcp.log file. What is the number of identified unique hostnames?

Answer : 17

Command :

zeek -C -r bigFlows.pcap dhcp-hostname.zeek
cat dhcp.log | zeek-cut host_name | sort -u  | wc -l

• Investigate the dhcp.log file. What is the identified domain value?

Answer : jaalam.net

Command :

cat dhcp.log | zeek-cut domain

• Investigate the dns.log file. What is the number of unique queries?

Answer : 1312

Command :

cat dns.log | zeek-cut query | sort -u | grep -v -e ‘*’ -e ‘-‘ | wc -l

Task 7 Zeek Scripts | Scripts and Signatures

• Go to folder TASK-7/101.
  Investigate the sample.pcap file with 103.zeek script. Investigate the terminal output. What is the number of the detected new connections?

Answer : 87

Command :

zeek -C -r sample.pcap 103.zeek
cat conn.log | zeek-cut uid | wc -l

• Go to folder TASK-7/201.
  Investigate the ftp.pcap file with ftp-admin.sig signature and  201.zeek script. Investigate the signatures.log file. What is the number of signature hits?

Answer : 1401

Command :

cat signatures.log | zeek-cut event_msg
cat signatures.log | zeek-cut event_msg | wc -l

• Investigate the signatures.log file. What is the total number of « administrator » username detections?

Answer : 731

Command :

cat signatures.log | zeek-cut sub_msg
cat signatures.log | zeek-cut sub_msg | grep administrator

• Investigate the ftp.pcap file with all local scripts, and investigate the loaded_scripts.log file. What is the total number of loaded scripts?

Answer : 498

Command :

zeek -C -r ftp.pcap local
cat loaded_scripts.log
cat loaded_scripts.log | grep zeek | wc -l

• Go to folder TASK-7/202.
  Investigate the ftp-brute.pcap file with « /opt/zeek/share/zeek/policy/protocols/ftp/detect-bruteforcing.zeek » script. Investigate the notice.log file. What is the total number of brute-force detections?

Answer : 2

Command :

zeek -C -r ftp-brute.pcap /opt/zeek/share/zeek/policy/protocols/ftp/detect-bruteforcing.zeek
cat notice.log | zeek-cut note
cat notice.log | zeek-cut note | wc -l

Task 8 Zeek Scripts | Frameworks

• Investigate the case1.pcap file with intelligence-demo.zeek script. Investigate the intel.log file. Look at the second finding, where was the intel info found? 

Answer : IN_HOST_HEADER

Command :

zeek -C -r case1.pcap intelligence-demo.zeek

cat intel.log | zeek-cut seen.where

• Investigate the http.log file. What is the name of the downloaded .exe file?

Answer : knr.exe

Command :

cat http.log | zeek-cut uri

• Investigate the case1.pcap file with hash-demo.zeek script. Investigate the files.log file. What is the MD5 hash of the downloaded .exe file?

Answer : cc28e40b46237ab6d5282199ef78c464

Command :

zeek -C -r case1.pcap hash-demo.zeek

cat files.log | zeek-cut tx_rhosts rx_hosts md5

• Investigate the case1.pcap file with file-extract-demo.zeek script. Investigate the « extract_files » folder. Review the contents of the text file. What is written in the file?

Answer : Microsoft NCSI

Command :

zeek -C -r case1.pcap file-extract-demo.zeek

cd extract_files/

cat « first-file. The name will be different » 

Task 9 Zeek Scripts | Packages

• Investigate the http.pcap file with the zeek-sniffpass module. Investigate the notice.log file. Which username has more module hits?

Answer : BroZeek

Command :

zeek -C -r http.pcap /opt/zeek/share/zeek/site/zeek-sniffpass
head notice.log
cat notice.log | zeek-cut note msg

• Investigate the case2.pcap file with geoip-conn module. Investigate the conn.log file. What is the name of the identified City?

Answer : Chicago

Command :

zeek -C -r case2.pcap /opt/zeek/share/zeek/site/geoip-conn
head conn.log | zeek-cut geo.resp.city
cat conn.log | zeek-cut geo.resp.city

• Which IP address is associated with the identified City?

Answer : 23.77.86.54

Command :

cat conn.log | zeek-cut id.resp_h geo.resp.city

• Investigate the case2.pcap file with sumstats-counttable.zeek script. How many types of status codes are there in the given traffic capture?

Answer : 4

Command :

zeek -C -r case2.pcap sumstats-countable.zeek

That’s all folks

Thank you for having taken the trouble to come on the site to read this Write-Up

I hope you enjoyed it and that it taught you some new things.

Feel free to leave a comment or share this article.

Facebook
Twitter
LinkedIn
Pinterest

Light

Dark