Zeek - Using some intelligence
Hi !
It’s time to talk a bit about the Zeek tool again. I’m not going to go into the details of what it is and allows you to do because there are sites that will be much better than me for this.
Instead, I’ll show you how to use it with the Intelligence Framework. I will now paraphrase what is stated in the documentation: “https://docs.zeek.org/en/master/frameworks/intel.html".
=> “The goals of Zeek’s Intelligence Framework are to consume intelligence data, make it available for matching, and provide infrastructure to improve performance and memory utilization”
=> “Data in the Intelligence Framework is an atomic piece of intelligence such as an IP address or an e-mail address. This atomic data will be packed with metadata such as a freeform source field, a freeform descriptive field, and a URL which might lead to more information about the specific item. The metadata in the default scripts has been deliberately kept to a minimum.”
So obviously we needed data sources. Now I’m going to tell you about a company that is doing a great job providing the community with a whole lot of data for Zeek. I am talking here about “Critical Path Security” (https://www.criticalpathsecurity.com).
They offer a github repository with a whole bunch of data: (https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds) The eponymous page gives instructions for incorporating the things offered into your favorite instance of Zeek.
Here is an example of generated “intel.log” file:
intel.log:
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path intel
#open 2023-03-21-17-01-01
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node
matched sources fuid file_mime_type file_desc cif.tags cif.confidence cif.source cif.description cif.firstseen cif.lastseen
#types time string addr port addr port string enum enum string set[enum] set[string] string string string string double string string string string
1679436060.721256 Ck6NEz2PxoLFiXCpE5 193.142.146.35 50676 a.b.c.d 80 193.142.146.35 Intel::ADDR Conn::IN_ORIG zeek Intel::ADDR CPS-ILLUMINATE - - - - - - - - -
1679436062.101794 Caqh0F2DZ8Ub0OYm4i 68.x.y.x 60812 a.b.c.d 443 68.x.y.x Intel::ADDR Conn::IN_ORIG zeek Intel::ADDR BINARY-DEFENSE-SYSTEMS - - - - - - - - -
1679436092.589164 CXCWAm2PaXPDTNuas9 152.x.y.x 46758 a.b.c.d 80 152.x.y.x Intel::ADDR Conn::IN_ORIG zeek Intel::ADDR BINARY-DEFENSE-SYSTEMS,CPS-ILLUMINATE - - - - - - - - -
1679436169.025817 CahUUy2slpR9VhgU97 193.x.y.x 57355 a.b.c.d 80 193.x.y.x Intel::ADDR Conn::IN_ORIG zeek Intel::ADDR CPS-ILLUMINATE - - - - - - - - -
1679439772.289378 C7gDxlYaHH6GOq1v4 185.x.y.z 20109 a.b.c.d 443 185.x.y.z Intel::ADDR Conn::IN_ORIG zeek Intel::ADDR BINARY-DEFENSE-SYSTEMS,CPS-ILLUMINATE - - - - - - - - -
1679439783.450085 CgCDc4LeonNUMkDVh 220.x.y.z 46448 a.b.c.d 22 220.x.y.z Intel::ADDR Conn::IN_ORIG zeek Intel::ADDR RUTGERS-BANLIST - - - - - - - - -
1679439788.986034 CAVOLz2b6r1Zqk5Ex1 88.x.y.z 39010 a.b.c.d 22 88.x.y.z Intel::ADDR Conn::IN_ORIG zeek Intel::ADDR RUTGERS-BANLIST - - - - - - - - -
1679439860.179770 Ccy2K333bzwi8Dbcef 167.x.y.z 36102 a.b.c.d 22 167.x.y.z Intel::ADDRConn::IN_ORIG zeek Intel::ADDR RUTGERS-BANLIST - - - - - - - - -
Let’s take a look at the last line.
The IP address “167.x.y.z” wanted to connect to IP address “a.b.c.d” via the port 22. Unfortunately at this point we don’t know more about the connection status:
- Did she succeed?
- Is it a failure?
We have to go a little further in the search for information. For this, let’s take the stream identifier (the second field of the line): “Ccy2K333bzwi8Dbcef” and try to find more information.
Let’s go to the directory where the Zeek logs are.
$ cd /var/log/zeek/2021-03-21
Let’s search for the selected patern.
$ zgrep Ccy2K333bzwi8Dbcef conn*.*
conn.18:00:00-19:00:00.log.gz:1679439860.179575 Ccy2K333bzwi8Dbcef 167.x.y.z 36102 a.b.c.d 22 tcp ssh 1.345465 1250 1369 SF F T 0 ShADdaFf 14 1986 10 1901 - DE HE Frankfurt am Main 50.1188 8.6843 US - - 37.751 -97.822
We can observe that the source IP address (167.x.y.z) has successfully connected to the ‘SSH’ port. How do we see that ?
Let’s check the connection state: the “conn_state” flag (the twelfth field in the line) which is “SF”. For more information, refer to: (https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html)
We can therefore say that a “strange” IP address managed to make a connection to one of our addresses.
Here is a small overview of what Zeek allows when used with the Intelligence Framework.
Cheers