BRIM
BASICS
Process the "sample.pcap" file and look at the details of the first DNS log that appear on the dashboard. What is the "qclass_name"?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > sample.pcap
BRIM > Dashboard > 2017-03-03T20:02:33.387074Z dns CjZFhy3jhLPcrHP1jc ... > right-click > open details
* look for the 1st occurrence of dns log in the dashboard
* qclass_name: C_INTERNETLook at the details of the first NTP log that appear on the dashboard. What is the "duration" value?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > sample.pcap
BRIM > Dashboard > 2017-03-03T20:02:45.706238Z ntp CYGUjM1Ar2CyNM7zGh ... > right-click > open details
* look for the 1st occurrence of ntp log in the dashboard
* Duration: 0.005 secondsLook at the details of the STATS packet log that is visible on the dashboard. What is the "reassem_tcp_size"?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > sample.pcap
BRIM > Dashboard > 2017-03-03T20:02:11.009848Z stats zeek ... > right-click > open details
* look for the 1st occurrence of STATS log in the dashboard
* reassem_tcp_size: 540DEFAULT QUERIES
Investigate the files. What is the name of the detected GIF file?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task4-sample-b.pcap
BRIM > QUERIES > FILE ACTIVITY
BRIM > DASHBOARD > MIME_TYPE > image/gif > right-click > open details
* look for a file that has a .gif extension
* filename: cat01_with_hidden_text.gifInvestigate the conn logfile. What is the number of the identified city names?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task4-sample-b.pcap
BRIM > Query Bar
Search: _path=="conn" | cut geo.resp.country_code, geo.resp.region, geo.resp.city
BRIM > DASHBOARD > geo.resp.city
* visually count
* 2Investigate the Suricata alerts. What is the Signature id of the alert category "Potential Corporate Privacy Violation"?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task4-sample-b.pcap
BRIM > QUERIES > SURICATA ALERTS BY CATEGORY
BRIM > DASHBOARD > Potential Corporate Privacy Violation > right-click > open details > ALERT > CATEGORY > right-click > Pivot to Logs
* look for "alert.signature.id"
* 2,012,887EXERCISE: THREAT HUNTING WITH BRIM | MALWARE C2 DETECTION
What is the name of the file downloaded from the CobaltStrike C2 connection?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task6-malware-c2.pcap
#step 2: identify frequently communicated hosts
BRIM > Query: _path == "conn" | cut id.orig_h, id.resp_p, id.resp_h | sort | uniq -c | sort -r count
valued>id>orig_h value>id>resp_p value>id>resp_h count
10.22.5.47 443 104.168.44.45 75
...
* the output data will provide analysts where to focus
- this will help identify external IPs that could be potentially malicious
#step 3a: identify most active ports/services
BRIM > Query: _path == "conn" | cut id.resp_p, service | sort | uniq -c | sort -r count
value>id>resp_p value>service count
443 ssl 367
53 dns 184
...
* the output data will provide analysts which service focus
#step 3b (DNS): drill down suspected service and build hypothesis
BRIM > Query: _path == "dns" | count() by query | sort -r
query count
hashingold.top 49
...
* the output data will highlight out of the ordinary dns queries
#step 3c (DNS): utilize virustotal to identify possible malicious domains
root@dco:~$ BROWSER > https://www.virustotal.com/gui/home/upload
search: hashingold.top
* automate the process using a script and utilize virustotal's API
#step 3d (HTTP):
BRIM > Query: _path == "http" | cut id.orig_h, id.resp_h, id.resp_p, method, host, uri | uniq -c | sort value.uri
value>id>orig_h value>id>resp_h value>id>resp_p value>host
10.22.5.47 104.168.44.45 80 104.168.44.45
...
* the output data will detect file download requests from IP addresses that are assumed as malicious.
#step 3e (HTTP): utilize virustotal to identify and validate hypothesis
root@dco:~$ BROWSER > https://www.virustotal.com/gui/home/upload
search: 104.168.44.45
* the output data will highlight abnormal activity and the malicious IP addresses
BRIM > QUERIES > HTTP Requests
BRIM > DASHBOARD > {10.22.5.47 <> 104.168.44.45}
* /download/4564.exeWhat is the number of CobaltStrike connections using port 443?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task6-malware-c2.pcap
#step 2: identify frequently communicated hosts
BRIM > Query: _path == "conn" | cut id.orig_h, id.resp_p, id.resp_h | sort | uniq -c | sort -r count
valued>id>orig_h value>id>resp_p value>id>resp_h count
10.22.5.47 443 104.168.44.45 75
...
* the output data will provide analysts where to focus
- this will help identify external IPs that could be potentially malicious
#step 3a: identify most active ports/services
BRIM > Query: _path == "conn" | cut id.resp_p, service | sort | uniq -c | sort -r count
value>id>resp_p value>service count
443 ssl 367
53 dns 184
...
* the output data will provide analysts which service focus
#step 3b (DNS): drill down suspected service and build hypothesis
BRIM > Query: _path == "dns" | count() by query | sort -r
query count
hashingold.top 49
...
* the output data will highlight out of the ordinary dns queries
#step 3c (DNS): utilize virustotal to identify possible malicious domains
root@dco:~$ BROWSER > https://www.virustotal.com/gui/home/upload
search: hashingold.top
* automate the process using a script and utilize virustotal's API
#step 3d (HTTP):
BRIM > Query: _path == "http" | cut id.orig_h, id.resp_h, id.resp_p, method, host, uri | uniq -c | sort value.uri
value>id>orig_h value>id>resp_h value>id>resp_p value>host
10.22.5.47 104.168.44.45 80 104.168.44.45
...
* the output data will detect file download requests from IP addresses that are assumed as malicious.
#step 3e (HTTP): utilize virustotal to identify and validate hypothesis
root@dco:~$ BROWSER > https://www.virustotal.com/gui/home/upload
search: 104.168.44.45
* the output data will highlight abnormal activity and the malicious IP addresses
BRIM > Query: _path=="conn" | 104.168.44.45 | cut id.orig_h, id.resp_p, id.resp_h | sort | uniq -c
* 328There is an additional C2 channel in used the given case. What is the name of the secondary C2 channel?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task6-malware-c2.pcap
#step 2: identify frequently communicated hosts
BRIM > Query: _path == "conn" | cut id.orig_h, id.resp_p, id.resp_h | sort | uniq -c | sort -r count
valued>id>orig_h value>id>resp_p value>id>resp_h count
10.22.5.47 443 104.168.44.45 75
...
* the output data will provide analysts where to focus
- this will help identify external IPs that could be potentially malicious
#step 3a: identify most active ports/services
BRIM > Query: _path == "conn" | cut id.resp_p, service | sort | uniq -c | sort -r count
value>id>resp_p value>service count
443 ssl 367
53 dns 184
...
* the output data will provide analysts which service focus
#step 3b (DNS): drill down suspected service and build hypothesis
BRIM > Query: _path == "dns" | count() by query | sort -r
query count
hashingold.top 49
...
* the output data will highlight out of the ordinary dns queries
#step 3c (DNS): utilize virustotal to identify possible malicious domains
root@dco:~$ BROWSER > https://www.virustotal.com/gui/home/upload
search: hashingold.top
* automate the process using a script and utilize virustotal's API
#step 3d (HTTP):
BRIM > Query: _path == "http" | cut id.orig_h, id.resp_h, id.resp_p, method, host, uri | uniq -c | sort value.uri
value>id>orig_h value>id>resp_h value>id>resp_p value>host
10.22.5.47 104.168.44.45 80 104.168.44.45
...
* the output data will detect file download requests from IP addresses that are assumed as malicious.
#step 3e (HTTP): utilize virustotal to identify and validate hypothesis
root@dco:~$ BROWSER > https://www.virustotal.com/gui/home/upload
search: 104.168.44.45
* the output data will highlight abnormal activity and the malicious IP addresses
BRIM > Query: event_type=="alert" | cut alert.signature | sort -r | uniq -c | sort -r count
* ET MALWARE Win32/IcedID Request Cookie
root@thm:~$ BROWSER > https://www.virustotal.com
search: 104.168.44.45 > relations
- Scanned Detections Type Name
2025-01-03 0/ 61 Text ips.txt
2024-06-07 0/ 62 Text 2022-01-12-IOCs-for-IcedID-with-Cobalt-Strike-and-DarkVNC.txt
2022-01-19 0/ 56 Network capture cobalt.pcapEXERCISE: THREAT HUNTING WITH BRIM | CRYPTO MINING
How many connections used port 19999?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task7-crypto-mine.pcapng
#step 2: identify frequently communicated hosts to detect any anomaly indicators
BRIM > Query: _path == "conn" | cut id.orig_h, id.resp_p, id.resp_h | sort | uniq -c | sort -r count
192.168.1.100 3333 52.31.186.94 2
...
* the output data will provide analysts where to focus
- this will help identify external IPs that could be potentially malicious
#step 3: identify most active ports/services
BRIM > Query: _path == "conn" | cut id.resp_p, service | sort | uniq -c | sort -r count
19999 22What is the name of the service used by port 6666?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task7-crypto-mine.pcapng
#step 2: identify frequently communicated hosts to detect any anomaly indicators
BRIM > Query: _path == "conn" | cut id.orig_h, id.resp_p, id.resp_h | sort | uniq -c | sort -r count
192.168.1.100 3333 52.31.186.94 2
...
* the output data will provide analysts where to focus
- this will help identify external IPs that could be potentially malicious
#step 3: identify most active ports/services
BRIM > Query: _path == "conn" | cut id.resp_p, service | sort | uniq -c | sort -r count
6666 irc 40What is the amount of transferred total bytes to "101.201.172.235:8888"?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task7-crypto-mine.pcapng
#step 2: identify frequently communicated hosts to detect any anomaly indicators
BRIM > Query: _path == "conn" | cut id.orig_h, id.resp_p, id.resp_h | sort | uniq -c | sort -r count
192.168.1.100 3333 52.31.186.94 2
...
* the output data will provide analysts where to focus
- this will help identify external IPs that could be potentially malicious
#step 3: identify most active ports/services
BRIM > Query: _path == "conn" | cut id.resp_p, service | sort | uniq -c | sort -r count
6666 irc 40
...
#step 3f: analyze transferred data bytes
BRIM > Query: _path == "conn" | put total_bytes := orig_bytes + resp_bytes | sort -r total_bytes | cut uid, id, orig_bytes, resp_bytes, total_bytes
CpxVR11UKEe7LhlWae 192.168.1.100 60740 101.201.172.235 8888 141 3588 3729
...
* the output should highlight IP addresses that have huge amount of trafficWhat is the detected MITRE tactic id?
root@thm:~$ which brim
/usr/bin/brim
root@thm:~$ brim
BRIM > Import Files > Desktop > Exercise-Files > task7-crypto-mine.pcapng
#step 2: identify frequently communicated hosts to detect any anomaly indicators
BRIM > Query: _path == "conn" | cut id.orig_h, id.resp_p, id.resp_h | sort | uniq -c | sort -r count
192.168.1.100 3333 52.31.186.94 2
...
* the output data will provide analysts where to focus
- this will help identify external IPs that could be potentially malicious
#step 3: identify most active ports/services
BRIM > Query: _path == "conn" | cut id.resp_p, service | sort | uniq -c | sort -r count
6666 irc 40
...
#step 3f: analyze transferred data bytes
BRIM > Query: _path == "conn" | put total_bytes := orig_bytes + resp_bytes | sort -r total_bytes | cut uid, id, orig_bytes, resp_bytes, total_bytes
CpxVR11UKEe7LhlWae 192.168.1.100 60740 101.201.172.235 8888 141 3588 3729
...
* the output should highlight IP addresses that have huge amount of traffic
#step 4: gather/hunt the low hanging fruits with Suricata rules/logs.
BRIM > Query: event_type=="alert" | count() by alert.severity,alert.category | sort count
...
2 Crypto Currency Mining Activity Detected 944
* the output will highlight the malicious activities detected by Suricata
- this requires the use of suricata rules
#step 4d: utilize suricata logs to correlate the event to a MITRE ATT&CK techniques
BRIM > Query: event_type=="alert" | alert.metadata.mitre_tactic_id | sort | uniq
* SURICATA CATEGORY MITRE TECHNIQUE NAME MITRE TECHNIQUE ID MITRE TACTIC NAME
Crypto Currency Mining Resource_Hijacking [TA0040] ImpactLast updated