ZEEK
NSM & ZEEK
What is the installed Zeek instance version number?
root@thm:~$ which zeek
/opt/zeek/bin/zeek
root@thm:~$ zeek -v
zeek version 4.2.1What is the version of the ZeekControl module?
root@thm:~$ which zeekctl
/opt/zeek/bin/zeekctl
root@thm:~$ zeekctl
Warning: new zeek version detected (run the zeekctl "deploy" command)
Welcome to ZeekControl 2.4.0
Type "help" for help.
[ZeekControl] > Investigate the "sample.pcap" file. What is the number of generated alert files?
root@thm:~$ cd Desktop/Exercise-Files
root@thm:~$ ls
TASK-2 TASK-3 TASK-5 TASK-6 TASK-7 TASK-8 TASK-9 clear-logs.sh
root@thm:~$ cd Desktop/Exercise-Files/TASK-2
root@thm:~$ ls
clear-logs.sh sample.pcap
root@thm:~$ zeek -C -r sample.pcap
* log files will be created in the background but no terminal output will be produced
root@thm:~$ ls
clear-logs.sh dhcp.log ntp.log sample.pcap ssh.log
conn.log dns.log packet_filter.log snmp.log syslog.log
* the generated alert files are: conn.log, dhcp.log, dns.log, ntp.log, packet_filter.log, snmp.log, ssh.log, syslog.logZEEK LOGS
Investigate the sample.pcap file. Investigate the dhcp.log file. What is the available hostname?
root@thm:~$ cd Desktop/Exercise-Files
root@thm:~$ ls
TASK-2 TASK-3 TASK-5 TASK-6 TASK-7 TASK-8 TASK-9 clear-logs.sh
root@thm:~$ cd Desktop/Exercise-Files/TASK-3
root@thm:~$ ls
clear-logs.sh sample.pcap
root@thm:~$ zeek -C -r sample.pcap
* log files will be created in the background but no terminal output will be produced
root@thm:~$ ls
clear-logs.sh dhcp.log ntp.log sample.pcap ssh.log
conn.log dns.log packet_filter.log snmp.log syslog.log
* the generated alert files are: conn.log, dhcp.log, dns.log, ntp.log, packet_filter.log, snmp.log, ssh.log, syslog.log
root@thm:~$ grep -rE "\bquery" ./dns.log
* this cmd will quickly identify the log file where a field contains the name "query"
root@thm:~$ cat dns.log |zeek-cut query | uniq
blog.webernetz.net
ip.webernetz.netInvestigate the sample.pcap file. Investigate the dns.log file. What is the number of unique DNS queries?
root@thm:~$ cd Desktop/Exercise-Files
root@thm:~$ ls
TASK-2 TASK-3 TASK-5 TASK-6 TASK-7 TASK-8 TASK-9 clear-logs.sh
root@thm:~$ cd Desktop/Exercise-Files/TASK-3
root@thm:~$ ls
clear-logs.sh sample.pcap
root@thm:~$ zeek -C -r sample.pcap
* log files will be created in the background but no terminal output will be produced
root@thm:~$ ls
clear-logs.sh dhcp.log ntp.log sample.pcap ssh.log
conn.log dns.log packet_filter.log snmp.log syslog.log
* the generated alert files are: conn.log, dhcp.log, dns.log, ntp.log, packet_filter.log, snmp.log, ssh.log, syslog.log
root@thm:~$ grep -rE "\bquery" ./dns.log
* this cmd will quickly identify the log file where a field contains the name "query"
root@thm:~$ cat dns.log |zeek-cut query | uniq
blog.webernetz.net
ip.webernetz.netInvestigate the sample.pcap file. Investigate the conn.log file. What is the longest connection duration?
root@thm:~$ cd Desktop/Exercise-Files
root@thm:~$ ls
TASK-2 TASK-3 TASK-5 TASK-6 TASK-7 TASK-8 TASK-9 clear-logs.sh
root@thm:~$ cd Desktop/Exercise-Files/TASK-3
root@thm:~$ ls
clear-logs.sh sample.pcap
root@thm:~$ zeek -C -r sample.pcap
* log files will be created in the background but no terminal output will be produced
root@thm:~$ ls
clear-logs.sh dhcp.log ntp.log sample.pcap ssh.log
conn.log dns.log packet_filter.log snmp.log syslog.log
* the generated alert files are: conn.log, dhcp.log, dns.log, ntp.log, packet_filter.log, snmp.log, ssh.log, syslog.log
root@thm:~$ grep -rE "\bdur" ./conn.log
* this cmd will quickly identify the log file where a field contains the name "duration"
root@thm:~$ cat dns.log |zeek-cut duration
59.206449
307.422751
305.791751
-
325.924370
304.539681
...
root@thm:~$ cat conn.log |zeek-cut duration | sort -n
332.319364
* the -n sorts the output numericallyZEEK SIGNATURES
Investigate the http.pcap file. Create the HTTP signature shown in the task and investigate the pcap. What is the source IP of the first event?
root@thm:~$ cd Desktop/Exercise-Files/TASK-5
root@thm:~$ ls
ftp http
root@thm:~$ cd http/
root@thm:~$ ls
clear-logs.sh http-password.sig http.pcap
root@thm:~$ cat http-password.sig
signature http-password {
ip-proto == tcp
dst-port == 80
payload /??????????????/
event "???????????????????????"
}
* copy the payload & event contents of the http-password.sig rule
root@thm:~$ nano http-password.sig
signature http-password {
ip-proto == tcp
dst-port == 80
payload /.*password.*/
event "Cleartext Password Found!"
}
root@thm:~$ zeek -C -r http.pcap -s http-password.sig
root@thm:~$ ls
clear-logs.sh files.log http.log notice.log signatures.log
conn.log http-password.sig http.pcap packet_filter.log
#identify the pertinent fields
root@thm:~$ cat signatures.log
#fields ts uid src_addr src_port dst_addr dst_port note sig_id
...
root@thm:~$ cat signatures.log | zeek-cut src_addr src_port dst_addr dst_port event_msg
10.10.57.178 38706 44.228.249.3 80 10.10.57.178: Cleartext PW Found!
10.10.57.178 38712 44.228.249.3 80 10.10.57.178: Cleartext PW Found!Investigate the http.pcap file. Create the HTTP signature shown in the task and investigate the pcap. What is the source port of the second event?
root@thm:~$ cd Desktop/Exercise-Files/TASK-5
root@thm:~$ ls
ftp http
root@thm:~$ cd http/
root@thm:~$ ls
clear-logs.sh http-password.sig http.pcap
root@thm:~$ cat http-password.sig
signature http-password {
ip-proto == tcp
dst-port == 80
payload /??????????????/
event "???????????????????????"
}
* copy the payload & event contents of the http-password.sig rule
root@thm:~$ nano http-password.sig
signature http-password {
ip-proto == tcp
dst-port == 80
payload /.*password.*/
event "Cleartext Password Found!"
}
root@thm:~$ zeek -C -r http.pcap -s http-password.sig
root@thm:~$ ls
clear-logs.sh files.log http.log notice.log signatures.log
conn.log http-password.sig http.pcap packet_filter.log
#identify the pertinent fields
root@thm:~$ cat signatures.log
#fields ts uid src_addr src_port dst_addr dst_port note sig_id
...
root@thm:~$ cat signatures.log | zeek-cut src_addr src_port dst_addr dst_port event_msg
10.10.57.178 38706 44.228.249.3 80 10.10.57.178: Cleartext PW Found!
10.10.57.178 38712 44.228.249.3 80 10.10.57.178: Cleartext PW Found!Investigate the conn.log. What is the total number of the sent and received packets from source port 38706?
root@thm:~$ cd Desktop/Exercise-Files/TASK-5
root@thm:~$ ls
ftp http
root@thm:~$ cd http/
root@thm:~$ ls
clear-logs.sh http-password.sig http.pcap
root@thm:~$ cat http-password.sig
signature http-password {
ip-proto == tcp
dst-port == 80
payload /??????????????/
event "???????????????????????"
}
* copy the payload & event contents of the http-password.sig rule
root@thm:~$ nano http-password.sig
signature http-password {
ip-proto == tcp
dst-port == 80
payload /.*password.*/
event "Cleartext Password Found!"
}
root@thm:~$ zeek -C -r http.pcap -s http-password.sig
root@thm:~$ ls
clear-logs.sh files.log http.log notice.log signatures.log
conn.log http-password.sig http.pcap packet_filter.log
#identify the pertinent fields
root@thm:~$ cat conn.log
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
root@thm:~$ cat conn.log | zeek-cut id.orig_h id.orig_p id.resp_h id.resp_p orig_pkts resp_pkts
10.10.57.178 38704 44.228.249.3 80 4 2
10.10.57.178 38706 44.228.249.3 80 11 9
10.10.57.178 38708 44.228.249.3 80 4 2
10.10.57.178 38710 44.228.249.3 80 4 2
10.10.57.178 38712 44.228.249.3 80 6 5Create the global rule shown in the task and investigate the ftp.pcap file. Investigate the notice.log. What is the number of unique events?
root@thm:~$ cd Desktop/Exercise-Files/TASK-5
root@thm:~$ ls
ftp http
root@thm:~$ cd ftp
root@thm:~$ ls
clear-logs.sh ftp-bruteforce.sig ftp.pcap
root@thm:~$ cat ftp-bruteforce.sig
signature ftp-username {
ip-proto == tcp
ftp /???????????????????????????????/
event "FTP Username Input Found!"
}
signature ftp-brute {
ip-proto == tcp
payload /?????????????????????????/
event "FTP Brute-force Attempt!"
}
* copy the payload & event contents of the ftp-bruteforce.sig rule
root@thm:~$ BROWSER > https://datatracker.ietf.org/doc/html/rfc765
530 Not logged in
root@thm:~$ nano http-password.sig
signature ftp-username {
ip-proto == tcp
ftp /.*USER.*/
event "FTP Username Input Found!"
}
signature ftp-brute {
ip-proto == tcp
payload /.*530.*Login.*incorrect.*/
event "FTP Brute-force Attempt!"
}
root@thm:~$ zeek -C -r ftp.pcap -s ftp-bruteforce.sig
root@thm:~$ ls
clear-logs.sh conn.log ftp-bruteforce.sig ftp.pcap notice.log packet_filter.log signatures.log weird.log
#identify the pertinent fields
root@thm:~$ cat notice.log | more
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
...
root@thm:~$ cat notice.log | zeek-cut uid | sort | uniq
CzqT1E0kp0OjPPFDf
CztIYiOrGdJ91JOr4
Czx9DAxZCgUlefn32
Czxu2n1OLi3rc5VqCi
CzyfuO3aVGNxeGbK09
CzywjFUzrWmHf3xMg
...
root@thm:~$ cat notice.log | zeek-cut uid | sort | uniq | wc -l
1413Create the global rule shown in the task and investigate the ftp.pcap file. Investigate the notice.log. What is the number of ftp-brute signature matches?
root@thm:~$ cd Desktop/Exercise-Files/TASK-5
root@thm:~$ ls
ftp http
root@thm:~$ cd ftp
root@thm:~$ ls
clear-logs.sh ftp-bruteforce.sig ftp.pcap
root@thm:~$ cat ftp-bruteforce.sig
signature ftp-username {
ip-proto == tcp
ftp /???????????????????????????????/
event "FTP Username Input Found!"
}
signature ftp-brute {
ip-proto == tcp
payload /?????????????????????????/
event "FTP Brute-force Attempt!"
}
* copy the payload & event contents of the ftp-bruteforce.sig rule
root@thm:~$ BROWSER > https://datatracker.ietf.org/doc/html/rfc765
530 Not logged in
root@thm:~$ nano http-password.sig
signature ftp-username {
ip-proto == tcp
ftp /.*USER.*/
event "FTP Username Input Found!"
}
signature ftp-brute {
ip-proto == tcp
payload /.*530.*Login.*incorrect.*/
event "FTP Brute-force Attempt!"
}
root@thm:~$ zeek -C -r ftp.pcap -s ftp-bruteforce.sig
root@thm:~$ ls
clear-logs.sh conn.log ftp-bruteforce.sig ftp.pcap notice.log packet_filter.log signatures.log weird.log
#identify the pertinent fields
root@thm:~$ cat signatures.log | more
#fields ts uid src_addr src_port dst_addr dst_port note sig_id event_msg sub_msg sig_count host_count
root@thm:~$ cat signatures.log | zeek-cut sig_id event_msg
ftp-username 10.234.125.254: FTP Username Input Found!
ftp-brute 10.121.70.151: FTP Brute-force Attempt!
ftp-brute 10.121.70.151: FTP Brute-force Attempt!
ftp-brute 10.121.70.151: FTP Brute-force Attempt!
ftp-brute 10.121.70.151: FTP Brute-force Attempt!
ftp-brute 10.121.70.151: FTP Brute-force Attempt!
ftp-brute 10.121.70.151: FTP Brute-force Attempt!
...
root@thm:~$ cat signatures.log | zeek-cut sig_id | grep "ftp-brute" | wc -l
1410ZEEK SCRIPTS: FUNDAMENTALS
Investigate the smallFlows.pcap file. Investigate the dhcp.log file. What is the domain value of the "vinlap01" host?
root@thm:~$ cd Desktop/Exercise-Files/TASK-6
root@thm:~$ ls
bigflow smallflow
root@thm:~$ cd smallflow
root@thm:~$ ls
clear-logs.sh dhcp-hostname.zeek smallFlows.pcap
root@thm:~$ cat dhcp-hostname.zeek
event dhcp_message (c: connection, is_orig: bool, msg: DHCP::Msg, options: DHCP::Options)
{
print options$host_name;
}
* the first, second and fourth lines are the predefined syntaxes of the scripting
language.
- the only part an analyst creates is the third line which tells Zeek to extract
DHCP hostnames
root@thm:~$ zeek -C -r smallFlows.pcap dhcp-hostname.zeek
student01-PC
vinlap01
1295981640.291600 expression error in ./dhcp-hostname.zeek, line 3: field value missing (options$host_name)
root@thm:~$ ls
clear-logs.sh dhcp.log files.log reporter.log ssl.log
conn.log dns.log http.log smallFlows.pcap weird.log
dhcp-hostname.zeek dpd.log packet_filter.log snmp.log x509.log
#identify pertinent fields
root@thm:~$ cat dhcp.log
#fields ts uids client_addr server_addr mac host_name client_fqdn domain requested_addr assigned_addr lease_time client_message server_message msg_types duration
#types time set[string] addr addr string string string string addr addr intervalstring string vector[string] interval
1295981573.013593 Ck1jSY3fMuPQPSnhQk 192.168.3.131 - 40:61:86:9a:f1:f5 student01-PC - - - - - - - INFORM 0.000000
1295981640.291009 ClTGlbGLPORFS6Pt7,C0lazw1EB6ujoJwrjb 172.16.255.1 - 00:1e:68:51:4f:a9vinlap01 - astaro_vineyard - - - - - INFORM,ACK 0.000591
root@thm:~$ cat dhcp.log | zeek-cut domain
astaro_vineyardInvestigate the bigFlows.pcap file. Investigate the dhcp.log file. What is the number of identified unique hostnames?
root@thm:~$ cd Desktop/Exercise-Files/TASK-6
root@thm:~$ ls
bigflow smallflow
root@thm:~$ cd bigflow
root@thm:~$ ls
bigFlows.pcap clear-logs.sh dhcp-hostname.zeek
root@thm:~$ cat dhcp-hostname.zeek
event dhcp_message (c: connection, is_orig: bool, msg: DHCP::Msg, options: DHCP::Options)
{
print options$host_name;
}
* the first, second and fourth lines are the predefined syntaxes of the scripting
language.
- the only part an analyst creates is the third line which tells Zeek to extract
DHCP hostnames
root@thm:~$ zeek -C -r bigFlows.pcap dhcp-hostname.zeek
JDT115
1361916156.616130 expression error in ./dhcp-hostname.zeek, line 3: field value missing (options$host_name)
JDT91
m30-sqdesk
...
root@thm:~$ ls
bigFlows.pcap dhcp.log kerberos.log reporter.log ssh.log
clear-logs.sh dns.log ntlm.log sip.log ssl.log
conn.log dpd.log ntp.log smb_files.log syslog.log
dce_rpc.log files.log ocsp.log smb_mapping.log weird.log
dhcp-hostname.zeek http.log packet_filter.log snmp.log x509.log
#identify pertinent fields
root@thm:~$ cat dhcp.log
#fields ts uids client_addr server_addr mac host_name client_fqdn domain requested_addr assigned_addr lease_time client_message server_message msg_types duration
#types time set[string] addr addr string string string string addr addr intervalstring string vector[string] interval
1361916156.615988 CAjLva3eNPcVKtRZXc,CGOhdf144CRNFGjkPd 172.16.133.24 - 00:21:70:67:69:d3JDT115 - jaalam.net - - - - - INFORM,ACK 0.000142
1361916159.858464 CxYUOyWRPqWGR27Ui 172.16.133.38 - 00:90:fb:38:0c:da m30-sqdesk - - - - - - - REQUEST,REQUEST 11.007566
...
root@thm:~$ cat dhcp.log | zeek-cut host_name
JDT115
m30-sqdesk
JDT91
JDT100
JDT094
JDT096
m30-sqdesk
...
root@thm:~$ cat dhcp.log | zeek-cut host_name | sort -nr | uniq
m30-sqdesk
JLT108
JDT95
JDT91
JDT80
JDT168
JDT153
JDT134
JDT131
JDT123
JDT120
JDT115
JDT107
JDT100
JDT096
JDT094
JDT081
-
ubuntu@ip-10-10-246-29:~/Desktop/Exercise-Files/TASK-6/bigflow$ cat dhcp.log | zeek-cut host_name | sort -nr | uniq | wc -l
18 (subtract 1 to exclude the "-")Investigate the bigFlows.pcap file. Investigate the dhcp.log file. What is the identified domain value?
root@thm:~$ cd Desktop/Exercise-Files/TASK-6
root@thm:~$ ls
bigflow smallflow
root@thm:~$ cd bigflow
root@thm:~$ ls
bigFlows.pcap clear-logs.sh dhcp-hostname.zeek
root@thm:~$ cat dhcp-hostname.zeek
event dhcp_message (c: connection, is_orig: bool, msg: DHCP::Msg, options: DHCP::Options)
{
print options$host_name;
}
* the first, second and fourth lines are the predefined syntaxes of the scripting
language.
- the only part an analyst creates is the third line which tells Zeek to extract
DHCP hostnames
root@thm:~$ zeek -C -r bigFlows.pcap dhcp-hostname.zeek
JDT115
1361916156.616130 expression error in ./dhcp-hostname.zeek, line 3: field value missing (options$host_name)
JDT91
m30-sqdesk
...
root@thm:~$ ls
bigFlows.pcap dhcp.log kerberos.log reporter.log ssh.log
clear-logs.sh dns.log ntlm.log sip.log ssl.log
conn.log dpd.log ntp.log smb_files.log syslog.log
dce_rpc.log files.log ocsp.log smb_mapping.log weird.log
dhcp-hostname.zeek http.log packet_filter.log snmp.log x509.log
#identify pertinent fields
root@thm:~$ cat dhcp.log
#fields ts uids client_addr server_addr mac host_name client_fqdn domain requested_addr assigned_addr lease_time client_message server_message msg_types duration
#types time set[string] addr addr string string string string addr addr intervalstring string vector[string] interval
1361916156.615988 CAjLva3eNPcVKtRZXc,CGOhdf144CRNFGjkPd 172.16.133.24 - 00:21:70:67:69:d3JDT115 - jaalam.net - - - - - INFORM,ACK 0.000142
1361916159.858464 CxYUOyWRPqWGR27Ui 172.16.133.38 - 00:90:fb:38:0c:da m30-sqdesk - - - - - - - REQUEST,REQUEST 11.007566
...
root@thm:~$ cat dhcp.log | zeek-cut domain
jaalam.net
...
root@thm:~$ cat dhcp.log | zeek-cut domain | sort -nr | uniq
root@thm:~$ cat dhcp.log | zeek-cut domain | sort -nr | uniq
jaalam.net
-ZEEK SCRIPTS: SIGNATURES
Investigate the sample.pcap file with 103.zeek script. Investigate the terminal output. What is the number of the detected new connections?
root@thm:~$ cd Desktop/Exercise-Files/TASK-7
root@thm:~$ ls
101 201 202
root@thm:~$ cd 101
root@thm:~$ ls
101.zeek 102.zeek 103.zeek clear-logs.sh sample.pcap
root@thm:~$ cat 103.zeek
event new_connection(c: connection)
{
print ("###########################################################");
print ("");
print ("New Connection Found!");
print ("");
print fmt ("Source Host: %s # %s --->", c$id$orig_h, c$id$orig_p);
print fmt ("Destination Host: resp: %s # %s <---", c$id$resp_h, c$id$resp_p);
print ("");
}
root@thm:~$ zeek -C -r sample.pcap 103.zeek >> newConn
root@thm:~$ cat newConn
###########################################################
New Connection Found!
Source Host: 192.168.121.2 # 54445/udp --->
Destination Host: resp: 192.168.110.10 # 69/udp <---
###########################################################
New Connection Found!
Source Host: 192.168.110.10 # 1556/udp --->
Destination Host: resp: 192.168.121.2 # 54445/udp <---
###########################################################
New Connection Found!
Source Host: 192.168.121.40 # 123/udp --->
Destination Host: resp: 212.227.54.68 # 123/udp <---
root@thm:~$ cat newConn | grep "New Connection Found!" | wc -l
87Investigate the ftp.pcap file with ftp-admin.sig signature and 201.zeek script. Investigate the signatures.log file. What is the number of signature hits?
root@thm:~$ cd Desktop/Exercise-Files/TASK-7
root@thm:~$ ls
101 201 202
root@thm:~$ cd 201
root@thm:~$ ls
201.zeek clear-logs.sh ftp-admin.sig ftp.pcap
root@thm:~$ cat 201.zeek
event signature_match (state: signature_state, msg: string, data: string)
{
if (state$sig_id == "ftp-admin")
{
print ("Signature hit! --> #FTP-Admin ");
}
}
root@thm:~$ cat ftp-admin.sig
signature ftp-admin {
ip-proto == tcp
ftp /.*USER.*admin.*/
event "FTP Username Input Found!"
}
root@thm:~$ zeek -C -r ftp.pcap -s ftp-admin.sig 201.zeek
Signature hit! --> #FTP-Admin
Signature hit! --> #FTP-Admin
...
root@thm:~$ ls
201.zeek conn.log ftp.pcap packet_filter.log weird.log
clear-logs.sh ftp-admin.sig notice.log signatures.log
root@thm:~$ head signature.log
#fields ts uid src_addr src_port dst_addr dst_port note sig_id event_msg sub_msg sig_count host_count
#types time string addr port addr port enum string string string count count
1024380731.210890 C9x2tG2ib3mDnZwjxd 10.234.125.254 2228 10.121.70.151 21 Signatures::Sensitive_Signature ftp-admin 10.234.125.254: FTP Username Input Found! USER admin - -
1024380731.267148 CasjJv2h3bXRnC2si9 10.234.125.254 2225 10.121.70.151 21 Signatures::Sensitive_Signature ftp-admin 10.234.125.254: FTP Username Input Found! USER admin - -
root@thm:~$ cat signatures.log | grep ftp-admin | wc -l
1401Investigate the signatures.log file. What is the total number of "administrator" username detections?
root@thm:~$ cd Desktop/Exercise-Files/TASK-7
root@thm:~$ ls
101 201 202
root@thm:~$ cd 201
root@thm:~$ ls
201.zeek clear-logs.sh ftp-admin.sig ftp.pcap
root@thm:~$ cat 201.zeek
event signature_match (state: signature_state, msg: string, data: string)
{
if (state$sig_id == "ftp-admin")
{
print ("Signature hit! --> #FTP-Admin ");
}
}
root@thm:~$ cat ftp-admin.sig
signature ftp-admin {
ip-proto == tcp
ftp /.*USER.*admin.*/
event "FTP Username Input Found!"
}
root@thm:~$ zeek -C -r ftp.pcap -s ftp-admin.sig 201.zeek
Signature hit! --> #FTP-Admin
Signature hit! --> #FTP-Admin
...
root@thm:~$ ls
201.zeek conn.log ftp.pcap packet_filter.log weird.log
clear-logs.sh ftp-admin.sig notice.log signatures.log
root@thm:~$ head signature.log
#fields ts uid src_addr src_port dst_addr dst_port note sig_id event_msg sub_msg sig_count host_count
#types time string addr port addr port enum string string string count count
1024380731.210890 C9x2tG2ib3mDnZwjxd 10.234.125.254 2228 10.121.70.151 21 Signatures::Sensitive_Signature ftp-admin 10.234.125.254: FTP Username Input Found! USER admin - -
1024380731.267148 CasjJv2h3bXRnC2si9 10.234.125.254 2225 10.121.70.151 21 Signatures::Sensitive_Signature ftp-admin 10.234.125.254: FTP Username Input Found! USER admin - -
root@thm:~$ cat signatures.log | grep administrator | wc -l
731Investigate the ftp.pcap file with all local scripts, and investigate the loaded_scripts.log file. What is the total number of loaded scripts?
root@thm:~$ cd Desktop/Exercise-Files/TASK-7
root@thm:~$ ls
101 201 202
root@thm:~$ cd 201
root@thm:~$ ls
201.zeek clear-logs.sh ftp-admin.sig ftp.pcap
root@thm:~$ zeek -C -r ftp.pcap local
WARNING: No Site::local_nets have been defined. It's usually a good idea to define your local networks.
root@thm:~$ ls
clear-logs.sh ftp-admin.sig loaded_scripts.log stats.log
capture_loss.log conn.log ftp.pcap packet_filter.log weird.log
root@thm:~$ head signature.log
#fields name
#types string
/opt/zeek/share/zeek/base/init-bare.zeek
/opt/zeek/share/zeek/base/bif/const.bif.zeek
root@thm:~$ cat loaded_scripts.log | grep -v "#"
/opt/zeek/share/zeek/policy/frameworks/intel/seen/smtp.zeek
/opt/zeek/share/zeek/policy/frameworks/intel/seen/smtp-url-extraction.zeek
/opt/zeek/share/zeek/policy/frameworks/intel/seen/x509.zeek
...
root@thm:~$ cat loaded_scripts.log | grep -v "#" | wc -l
498Investigate the ftp-brute.pcap file with "/opt/zeek/share/zeek/policy/protocols/ftp/detect-bruteforcing.zeek" script. Investigate the notice.log file. What is the total number of brute-force detections?
root@thm:~$ cd Desktop/Exercise-Files/TASK-7
root@thm:~$ ls
101 201 202
root@thm:~$ cd 202
root@thm:~$ ls
clear-logs.sh ftp-brute.pcap ftp.pcap
root@thm:~$ cat /opt/zeek/share/zeek/policy/protocols/ftp/detect-bruteforcing.zeek
#! FTP brute-forcing detector, triggering when too many rejected usernames or
##! failed passwords have occurred from a single address.
@load base/protocols/ftp
@load base/frameworks/sumstats
@load base/utils/time
module FTP;
export {
redef enum Notice::Type += {
## Indicates a host bruteforcing FTP logins by watching for too
## many rejected usernames or failed passwords.
Bruteforcing
};
## How many rejected usernames or passwords are required before being
## considered to be bruteforcing.
...
root@thm:~$ zeek -C -r ftp-brute.pcap /opt/zeek/share/zeek/policy/protocols/ftp/detect-bruteforcing.zeek
root@thm:~$ ls
clear-logs.sh conn.log ftp-brute.pcap ftp.pcap notice.log packet_filter.log weird.log
root@thm:~$ head notice.log
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] set[string] interval string string string double double
1024380732.223481 - - - - - - - - - FTP::Bruteforcing 10.234.125.254 had 20 failed logins on 1 FTP server in 0m1s - 10.234.125.254 - - - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
root@thm:~$ cat notice.log | grep "FTP::Brut*"
1024380732.223481 - - - - - - - - - FTP::Bruteforcing 10.234.125.254 had 20 failed logins on 1 FTP server in 0m1s - 10.234.125.254 - - - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1389721084.522861 - - - - - - - - - FTP::Bruteforcing 192.168.56.1 had 20 failed logins on 1 FTP server in 0m37s - 192.168.56.1 - - - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
root@thm:~$ cat notice.log | grep "FTP::Brut*" | wc -l
2ZEEK SCRIPTS: FRAMEWORKS
Investigate the case1.pcap file with intelligence-demo.zeek script. Investigate the intel.log file. Look at the second finding, where was the intel info found?
root@thm:~$ cd Desktop/Exercise-Files/TASK-8
root@thm:~$ ls
case1.pcap clear-logs.sh file-extract-demo.zeek hash-demo.zeek intelligence-demo.zeek
root@thm:~$ cat intelligence-demo.zeek
# Load intelligence framework!
@load /opt/zeek/share/zeek/policy/frameworks/intel/seen
@load /opt/zeek/share/zeek/policy/frameworks/intel/do_notice.zeek
redef Intel::read_files += { "/opt/zeek/intel/zeek_intel.txt" };
root@thm:~$ zeek -C -r case1.pcap intelligence-demo.zeek
root@thm:~$ ls
case1.pcap dhcp.log files.log intel.log pe.log
clear-logs.sh dns.log hash-demo.zeek intelligence-demo.zeek
conn.log file-extract-demo.zeek http.log packet_filter.log
root@thm:~$ cat intel.log
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc
#types time string addr port addr port string enum enum string set[enum] set[string] string string string
1561667898.779213 C2CbcG26BMyZCrXnmh 10.6.27.102 53770 10.6.27.1 53 smart-fax.com Intel::DOMAIN DNS::IN_REQUEST zeek Intel::DOMAIN TASK-8-Demo - - -
1561667898.911759 CfQQgQTipHqVBnvSh 10.6.27.102 49162 107.180.50.162 80 smart-fax.com Intel::DOMAIN HTTP::IN_HOST_HEADER zeek Intel::DOMAIN TASK-8-Demo - - -
root@thm:~$ cat intel.log | zeek-cut seen.where
DNS::IN_REQUEST
HTTP::IN_HOST_HEADERnvestigate the case1.pcap file with intelligence-demo.zeek script. Investigate the http.log file. What is the name of the downloaded .exe file?
root@thm:~$ cd Desktop/Exercise-Files/TASK-8
root@thm:~$ ls
case1.pcap clear-logs.sh file-extract-demo.zeek hash-demo.zeek intelligence-demo.zeek
root@thm:~$ cat intelligence-demo.zeek
# Load intelligence framework!
@load /opt/zeek/share/zeek/policy/frameworks/intel/seen
@load /opt/zeek/share/zeek/policy/frameworks/intel/do_notice.zeek
redef Intel::read_files += { "/opt/zeek/intel/zeek_intel.txt" };
root@thm:~$ zeek -C -r case1.pcap intelligence-demo.zeek
root@thm:~$ ls
case1.pcap dhcp.log files.log intel.log pe.log
clear-logs.sh dns.log hash-demo.zeek intelligence-demo.zeek
conn.log file-extract-demo.zeek http.log packet_filter.log
root@thm:~$ cat http.log
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types
#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string]
1561667874.713411 CBeR9d3RW63znDZY62 10.6.27.102 49157 23.63.254.163 80 1 GET www.msftncsi.com /ncsi.txt - 1.1 Microsoft NCSI - 0 14 200 OK - - (empty) - - - - - - Fpgan59p6uvNzLFja - text/plain
1561667889.643717 CrQiLZ1aWt2zkKmHB1 10.6.27.102 49159 107.180.50.162 80 1 GET smart-fax.com /Documents/Invoice&MSO-Request.doc - 1.1 Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko - 0 323072 200 OK - - (empty) - - - - - - FB5o2Hcauv7vpQ8y3 - application/msword
1561667898.911759 CfQQgQTipHqVBnvSh 10.6.27.102 49162 107.180.50.162 80 1 GET smart-fax.com /knr.exe - 1.1 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) - 0 2437120 200 OK - - (empty) - -- - - - FOghls3WpIjKpvXaEl - application/x-dosexec
root@thm:~$ cat http.log | zeek-cut uri
/ncsi.txt
/Documents/Invoice&MSO-Request.doc
/knr.exeInvestigate the case1.pcap file with hash-demo.zeek script. Investigate the files.log file. What is the MD5 hash of the downloaded .exe file?
root@thm:~$ cd Desktop/Exercise-Files/TASK-8
root@thm:~$ ls
case1.pcap clear-logs.sh file-extract-demo.zeek hash-demo.zeek intelligence-demo.zeek
root@thm:~$ cat hash-demo.zeek
# Enable MD5, SHA1 and SHA256 hashing for all files.
@load /opt/zeek/share/zeek/policy/frameworks/files/hash-all-files.zeek
root@thm:~$ zeek -C -r case1.pcap hash-demo.zeek
root@thm:~$ ls
case1.pcap clear-logs.sh conn.log dhcp.log dns.log file-extract-demo.zeek files.log hash-demo.zeek http.log intelligence-demo.zeek packet_filter.log pe.log
root@thm:~$ cat files.log
#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size
#types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string bool count
1561667874.743959 Fpgan59p6uvNzLFja 23.63.254.163 10.6.27.102 CQP7Mi4HUOPGcPM9lb HTTP 0 SHA1,MD5 text/plain - 0.000000 - F 14 14 0 0F - cd5a4d3fdd5bffc16bf959ef75cf37bc 33bf88d5b82df3723d5863c7d23445e345828904 - - - -
1561667889.703239 FB5o2Hcauv7vpQ8y3 107.180.50.162 10.6.27.102 C0d8Sz2HCrBEXNcEf HTTP 0 SHA1,MD5 application/msword - 4.386569 - F 323072 - 00 F - b5243ec1df7d1d5304189e7db2744128 a66bd2557016377dfb95a87c21180e52b23d2e4e - - - -
1561667899.060086 FOghls3WpIjKpvXaEl 107.180.50.162 10.6.27.102 CHwAij1Q2bSTESk3ad HTTP 0 SHA1,MD5,PE application/x-dosexec - 0.498764 - F 2437120 - 00 F - cc28e40b46237ab6d5282199ef78c464 0d5c820002cf93384016bd4a2628dcc5101211f4 - - - -
root@thm:~$ cat files.log | zeek-cut md5 sha1 sha256
text/plain cd5a4d3fdd5bffc16bf959ef75cf37bc 33bf88d5b82df3723d5863c7d23445e345828904 -
application/msword b5243ec1df7d1d5304189e7db2744128 a66bd2557016377dfb95a87c21180e52b23d2e4e -
application/x-dosexec cc28e40b46237ab6d5282199ef78c464 0d5c820002cf93384016bd4a2628dcc5101211f4 -Investigate the case1.pcap file with file-extract-demo.zeek script. Investigate the "extract_files" folder. Review the contents of the text file. What is written in the file?
root@thm:~$ cd Desktop/Exercise-Files/TASK-8
root@thm:~$ ls
case1.pcap clear-logs.sh file-extract-demo.zeek hash-demo.zeek intelligence-demo.zeek
root@thm:~$ cat file-extract-demo.zeek
# Load file extract framework!
@load /opt/zeek/share/zeek/policy/frameworks/files/extract-all-files.zeek
root@thm:~$ zeek -C -r case1.pcap file-extract-demo.zeek
root@thm:~$ ls
case1.pcap clear-logs.sh conn.log dhcp.log dns.log extract_files file-extract-demo.zeek files.log hash-demo.zeek http.log intelligence-demo.zeek packet_filter.log pe.log
root@thm:~$ cd extract_files
root@thm:~$ ls
extract-1561667874.743959-HTTP-Fpgan59p6uvNzLFja extract-1561667889.703239-HTTP-FB5o2Hcauv7vpQ8y3 extract-1561667899.060086-HTTP-FOghls3WpIjKpvXaEl
root@thm:~$ file * | nl
1 extract-1561667874.743959-HTTP-Fpgan59p6uvNzLFja: ASCII text, with no line terminators
2 extract-1561667889.703239-HTTP-FB5o2Hcauv7vpQ8y3: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Template: Normal.dotm, Last Saved By: Administrator, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Jun 27 18:24:00 2019, Last Saved Time/Date: Thu Jun 27 18:24:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
3 extract-1561667899.060086-HTTP-FOghls3WpIjKpvXaEl: PE32 executable (GUI) Intel 80386, for MS Windows
root@thm:~$ cat extract-1561667874.743959-HTTP-Fpgan59p6uvNzLFja
Microsoft NCSIZEEK SCRIPTS: PACKAGES
Investigate the http.pcap file with the zeek-sniffpass module. Investigate the notice.log file. Which username has more module hits?
root@thm:~$ cd Desktop/Exercise-Files/TASK-9
root@thm:~$ ls
cleartext-pass geoip-conn
root@thm:~$ cd cleartext-pass
root@thm:~$ ls
clear-logs.sh http.pcap
root@dco:~$ find / -iname "zeek-sniffpass" 2>/dev/null
/opt/zeek/share/zeek/site/packages/zeek-sniffpass
root@dco:~$ ls /opt/zeek/share/zeek/site/packages/zeek-sniffpass
__load__.zeek main.zeek
root@dco:~$ cat /opt/zeek/share/zeek/site/packages/zeek-sniffpass/main.zeek
@load base/protocols/http
@load base/frameworks/notice
module SNIFFPASS;
...
#call the package by name
root@thm:~$ zeek -C -r http.pcap zeek-sniffpass
root@thm:~$ ls
clear-logs.sh conn.log files.log http.log http.pcap notice.log packet_filter.log
root@thm:~$ cat notice.log
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] set[string] interval string string string double double
1647504684.298943 Cw0VgS29N0gBieUiVa 10.10.57.178 38706 44.228.249.3 80 - -- tcp SNIFFPASS::HTTP_POST_Password_Seen Password found for user BroZeek - 10.10.57.178 44.228.249.3 80 - - Notice::ACTION_LOG (empty) 3600.000000 - -- - -
root@thm:~$ cat notice.log | zeek-cut msg
Password found for user BroZeek
Password found for user BroZeek
Password found for user BroZeek
Password found for user ZeekBro
Password found for user ZeekBroInvestigate the case2.pcap file with geoip-conn module. Investigate the conn.log file. What is the name of the identified City?
root@thm:~$ cd Desktop/Exercise-Files/TASK-9
root@thm:~$ ls
cleartext-pass geoip-conn
root@thm:~$ cd geoip-conn
root@thm:~$ ls
case1.pcap case2.pcap clear-logs.sh sumstats-counttable.zeek
root@dco:~$ find / -iname "geoip*" 2>/dev/null
/opt/zeek/share/zeek/site/packages/geoip-conn
root@dco:~$ ls /opt/zeek/share/zeek/site/packages/geoip-conn
GeoLite2-ASN.mmdb GeoLite2-City.mmdb GeoLite2-Country.mmdb __load__.zeek geoip-conn.zeek
root@dco:~$ cat /opt/zeek/share/zeek/site/packages/geoip-conn/geoip-conn.zeek
##! Populate geolocation fields in the connection logs.
##! This package includes GeoLite2 data created by MaxMind, available from
##! https://www.maxmind.com
module Conn;
# The following redef ensuers the .mmdb included with this package is used
# out-of-the-box. If you delete that file, Zeek will fall back to looking in
# default locations. See this link for paths:
#
# https://github.com/zeek/zeek/blob/09483619ef0839cad189f22c4d5be3d66cedcf55/src/zeek.bif#L3964-L3971
redef mmdb_dir = @DIR;
...
#call the package by name
root@thm:~$ zeek -C -r case2.pcap geoip-conn
root@thm:~$ ls
case1.pcap clear-logs.sh dns.log http.log ssl.log x509.log
case2.pcap conn.log files.log packet_filter.log sumstats-counttable.zeek
root@thm:~$ cat conn.log
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto serviceduration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents geo.orig.country_code geo.orig.region geo.orig.city geo.orig.latitude geo.orig.longitude geo.resp.country_code geo.resp.region geo.resp.city geo.resp.latitude geo.resp.longitude
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string string string double double string string string double double
1561766548.962324 C7oGeVuzM68kBNPbc 10.6.29.101 49247 23.77.86.54 80 tcp http 0.072321 370 452 SF - - 0 ShADadFf 6 622 5656 - - - - - - US IL Chicago 41.8874 -87.6318
root@thm:~$ cat conn.log | zeek-cut geo.resp.city
ChicagoInvestigate the case2.pcap file with geoip-conn module. Investigate the conn.log file. Which IP address is associated with the identified City?
root@thm:~$ cd Desktop/Exercise-Files/TASK-9
root@thm:~$ ls
cleartext-pass geoip-conn
root@thm:~$ cd geoip-conn
root@thm:~$ ls
case1.pcap case2.pcap clear-logs.sh sumstats-counttable.zeek
root@dco:~$ find / -iname "geoip*" 2>/dev/null
/opt/zeek/share/zeek/site/packages/geoip-conn
root@dco:~$ ls /opt/zeek/share/zeek/site/packages/geoip-conn
GeoLite2-ASN.mmdb GeoLite2-City.mmdb GeoLite2-Country.mmdb __load__.zeek geoip-conn.zeek
root@dco:~$ cat /opt/zeek/share/zeek/site/packages/geoip-conn/geoip-conn.zeek
##! Populate geolocation fields in the connection logs.
##! This package includes GeoLite2 data created by MaxMind, available from
##! https://www.maxmind.com
module Conn;
# The following redef ensuers the .mmdb included with this package is used
# out-of-the-box. If you delete that file, Zeek will fall back to looking in
# default locations. See this link for paths:
#
# https://github.com/zeek/zeek/blob/09483619ef0839cad189f22c4d5be3d66cedcf55/src/zeek.bif#L3964-L3971
redef mmdb_dir = @DIR;
...
#call the package by name
root@thm:~$ zeek -C -r case2.pcap geoip-conn
root@thm:~$ ls
case1.pcap clear-logs.sh dns.log http.log ssl.log x509.log
case2.pcap conn.log files.log packet_filter.log sumstats-counttable.zeek
root@thm:~$ cat conn.log
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto serviceduration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents geo.orig.country_code geo.orig.region geo.orig.city geo.orig.latitude geo.orig.longitude geo.resp.country_code geo.resp.region geo.resp.city geo.resp.latitude geo.resp.longitude
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string string string double double string string string double double
1561766548.962324 C7oGeVuzM68kBNPbc 10.6.29.101 49247 23.77.86.54 80 tcp http 0.072321 370 452 SF - - 0 ShADadFf 6 622 5656 - - - - - - US IL Chicago 41.8874 -87.6318
root@thm:~$ cat conn.log | zeek-cut geo.resp.city id.resp_h
Chicago 23.77.86.54
Chicago 23.77.86.54
...Investigate the case2.pcap file with sumstats-counttable.zeek script. How many types of status codes are there in the given traffic capture?
root@thm:~$ cd Desktop/Exercise-Files/TASK-9
root@thm:~$ ls
cleartext-pass geoip-conn
root@thm:~$ cd geoip-conn
root@thm:~$ ls
case1.pcap case2.pcap clear-logs.sh sumstats-counttable.zeek
root@thm:~$ cat sumstats-counttable.zeek
@load /opt/zeek/share/zeek/site/packages/zeek-sumstats-counttable
event zeek_init()
...
root@thm:~$ zeek -Cr case2.pcap sumstats-counttable.zeek
Host: 116.203.71.114
status code: 200, count: 26
status code: 404, count: 6
status code: 302, count: 4
status code: 301, count: 4
Host: 23.77.86.54
status code: 301, count: 4
root@thm:~$ ls
case1.pcap case2.pcap clear-logs.sh conn.log dns.log files.log http.log packet_filter.log ssl.log sumstats-counttable.zeek x509.logLast updated