threat hunting | finding long and cumulative connections - part 1

pcap and zeek logs already captured and provided you on a vm for threat hunting.

1. find top 10 longest connection or top 10 talkers:

zeek stores duration in conn.log

trace1.pcap this is our actual file. from this file we have created zeek logs. 

capinfos -aeu trace1.pcap

cat conn.log | zeek-cut id.orig_h id.resp_h duration | sort -k 3 -rn | head

sorting means organizing. 

2. find 10 cumulative communication time between private and legal ip addresses (internal to external) 

cat conn.log | zeek-cut id.orig_h id.resp_h duration | sort | grep -v -e '^$' | grep -v '-' | datamash -g 1,2 sum 3 | sort -k 3 -rn | head

3. after finding the suspicious ip, now look for dns log to see anything anomaly there or not. zeek extracts all dns related logs into dns.log file.

cat dns.log | zeek-cut query answers | grep 52.179.219.14 | sort | uniq -c

cat conn.log | zeek-cut id.orig_h id.resp_h service | grep 52.179.219.14 | sort | uniq -c

cat ssl.log | zeek-cut id.resp_h server_name subject version | grep 52.179.219.14 | sort | uniq -c

 

Avi