Threat Hunting

 Bro/Zeek example of decoding many apps:

cat conn.log | bro-cut id.orig_h id.resp_h id.resp_p proto service orig_ip_bytes resp_ip_bytes

cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto service orig_ip_bytes resp_ip_bytes

Too many FQDN's finding:

tshark -r thunt-lab.pcapng -T fields -e dns.qry.name | sort | uniq | rev | cut -d '.' -f 1-2 | rev | sort | uniq -c | sort -rn | head -10

tshark -r thunt-lab.pcapng -T fields -e dns.qry.name | sort | uniq | head -4

tshark -r thunt-lab.pcapng -T fields -e dns.qry.name | sort | uniq | rev | head -4

tshark -r thunt-lab.pcapng -T fields -e dns.qry.name | sort | uniq | rev | cut -d '.' -f 1-2 | rev | head -4

cat http.08_33_18-09_00_00.log | bro-cut user_agent | sort | uniq -c | sort

Tshark example to extract dns query field:

tshark -r thunt-lab.pcapng -T fields -e dns.qry.name udp.port==53 | head -10

tshark example for extracting user agent:

tshark -r sample.pcap -T fields -e http.user_agent tcp.dstport==80 | sort | uniq -c | sort -n | head -10

bro/zeek example for cert check:

cat ssl* | zeek-cut id.orig_h id.resp_h id.resp_p validation_status | grep 'self signed' | sort | uniq

ngrep for pattern match on passing packets:

ngrep -q -I odd.pcap Admin | head -15

-q dont print "#" for non-matches

-I read from a pcap file

sudo apt install ngrep

https://github.com/jpr5/ngrep

Datamash:

cat conn.log | bro-cut id.orig_h id.resp_h duration | sort -k 3 -rn | head

You may get duplicate entries like same ip showing two connection duration. one is for say 41 seconds and another one is 31 seconds. If you want to combine them both then datamash tool will help you. 

cat conn.log | bro-cut id.orig_h id.resp_h duration | sort | datamash -g 1,2 sum 3 | sort -k 3 -rn | head

https://www.gnu.org/software/datamash/

sudo apt install datamash

RITA:

Rita will make your life easier. 

Beacon:

rita show-beacons beacon | head -10

 

C2 over dns:

rita show-exploded-dns test | head -10 

LAB long connections:

useful commands to try

capinfos -aeu <pcap file>

cat conn.log | zeek-cut id.orig_h id.resp_h duration | sort -k 3 -rn | head 

cat conn.log | zeek-cut id.orig_h id.resp_h duration | sort | grep -v -e '^$' | grep -v '-'  | datamash -g 1,2 sum 3 | sort -k 3 -rn | head

LAB beacon size:

Most connections:

Session size analysis:

cat conn.log | zeek-cut id.orig_h id.resp_h | sort | uniq -c | sort -rn | head

cat conn.log | zeek-cut id.orig_h id.resp_h orig_bytes | grep 192.168.99.51 | grep 104.248.234.238 | sort | uniq -c | sort -rn | head

Payload analysis with ngrep:

say you found suspicious ip pair. 

ngrep -q -I trace1.pcap host 192.168.99.51 and host 104.248.234.238 | less

What malicious URI data sending:

cat http.log | zeek-cut id.orig_h id.resp_h id.resp_h uri | grep 104.248.234.238 | sort | uniq -c | sort -rn

LAB - C2 over dns:

cat dns.log | zeek-cut query | sort | uniq | rev | cut -d . -f 1-2 | rev | sort | uniq -c | sort -rn | head

cat dns.log | zeek-cut qtype_name query | grep honestimnotevil | cut -f 1 | sort | uniq -c | sort -rn

Last lab - doing some repetitive task: 

cat conn.log | zeek-cut id.orig_h id.resp_h duration | sort -k 3 -rn | head

cat conn.log | zeek-cut id.orig_h id.resp_h duration | sort | grep -v -e '^$' | grep -v '-' | datamash -g 1,2 sum 3 | sort -k 3 -rn | head

cat conn.log | zeek-cut id.orig_h id.resp_h | sort | uniq -c | sort -rn | head

host 167.71.97.235