threat hunting | finding beacons - part 2

beacon check is based on connection delta, session size or both. rita tool and its helpful easy command will help you to find beacons quite easily. 

RITA

rita | less         

(list all of rita's commands.)

rita list            

lab1

lab2

lab3

(list all of the known databases. pcap lab files need to import into                         rita.)

rita import <zeek log files>       

(it will import zeek log files.) 

rita | grep beacons 

rita show-beacons lab1 -H | less -S   

(lab1 is your dataset that you import                                                              earlier) 

anything that score starting from 0.8, please investigate. 

Now using that two ip's, check with dns logs.

first two dns query comes with nothing. that means these two ip's is not resolving dns names. thats kind of suspicious. so lets search for what service they try to reach. 

1st one says http and 2nd one says nothing. which is weird. 

 

 

conn_state means --> what tcp flags zeek seen in the packet. 

OTH means --> it did not see 3 tcp packet at the beginning and fin/ack or RST at the end. just see established connection in the middle. all 72 connections use same source port and same destination port. zeek by default has 5 minutes sesison time out. this is why it is unable to decode service. if zeek does not see any packet goes by on that session for 5 minutes then remove that entry from its state table and starts from a newer one when same session starts communicating again. change it to 60 minutes or higher. 

 

rita show-beacons-fqdn lab1  

(show beacons between internal ip and external fqdn)

rita show-beacons-proxy lab1  

(all of my internal ip are going to same proxy server. from that proxy server they go to internet. from that proxy where they trying to go out to, this command will find you that)

 

Avi