ANALYTICS

#convert pcaps into zeek logs
root@dco:~$ zeek readpcap pcaps/AsyncRAT.pcap zeek_logs/asyncrat
 Starting the Zeek docker container
 Zeek logs will be saved to /home/ubuntu/zeek_logs/asyncrat
 
root@dco:~$ cd /home/ubuntu/zeek_logs/asyncrat/ && ls
 capture_loss.log  dns.log    http.log         known_services.log  notice.log  packet_filter.log  software.log  stats.log  x509.log
 conn.log          files.log  known_hosts.log  loaded_scripts.log  ocsp.log    reporter.log       ssl.log       weird.log
 
#import logs into RITA for parsing and analysis
root@dco:~$ rita import --logs ~/zeek_logs/asyncrat/ --database asyncrat
 [REDACTED]
 2025-10-23T10:56:58Z INF Initiating new import... dataset=asyncrat directory=/tmp/zeek_logs rebuild=false rolling=false started_at="2025-10-23 10:56:58.079568235 +0000 UTC m=+0.013974881"
 2025-10-23T10:56:58Z INF [THREAT INTEL] Updating online feed... feed_url=https://feodotracker.abuse.ch/downloads/ipblocklist.txt
 [-] Parsing:  /tmp/zeek_logs/conn.log
 [-] Parsing:  /tmp/zeek_logs/http.log
 [-] Parsing:  /tmp/zeek_logs/ssl.log
 [-] Parsing:  /tmp/zeek_logs/dns.log
 Log Parsing ? ??????????????????????????????????????????????????????????? 4 / 4
 [REDACTED]
 
 * RITA will parse and analyze the imported logs

#
root@dco:~$ rita view <database-name>

 * Larger datasets will provide more insights than smaller ones. Smaller datasets are 
   also more prone to false positive entries. 
 * a structured terminal window with the results will be shown after entering the cmd

RITA > 

 search bar: 
  - Start a search by entering a forward slash (/) followed by the search term
  - Enter ? while in search mode to view available search fields and examples.
  - Press ? again to exit the help page.
  - Press the Escape key (Esc) to exit search mode entirely.
 results pane:
  - Severity: Score calculated using threat modifiers
  - Source and Destination: IP addresses or FQDNs involved in the connection
  - Beacon Likelihood: Indicates potential command-and-control (C2) activity
  - Connection Duration: Long-lived connections may indicate compromise; 
     most application-layer protocols are short-lived (exceptions include SSH, RDP, and VNC)
  - Subdomains: Multiple subdomains under the same domain may suggest C2 beaconing or
     data exfiltration
  - Threat Intelligence: Shows matches against known threat intelligence feeds
 details pane: 
 
#use the potentially identified malicious 5 tuples as inputs into VirusTotal
VirusTotal > 
 query: maliciousFQDN
 query: ipAddress