All right, now that we were able to see another Zeek integration with a
great network security monitoring platform, let's move on and focus
almost entirely on Zeek for the remainder of the course. In this clip,
and for the remainder of the module, we're going to be talking about
using Zeek for file carving.
If you're working in cyber operations or security engineering,
you may already know what file carving is. But if you don't,
here's the definition from Techopedia, although most other sources have
very similar definitions. Essentially, it's the process of reassembling
files from the data stream or a storage device.
The key for this though is that file carving is doing so without
the assistance of a file system giving us things like metadata
and other attributes for the file.
But why would we want to do something like this?
There's a few reasons as to why we would want to carve
files, especially from the network streams.
The first and possibly the most important is to be able to
conduct additional analysis on the file itself.
If we're sniffing a network stream and trying to detect malicious
files in the payloads, we could use file carving to save it
somewhere and send it off for analysis.
We also might want to just keep a record of the files for record
keeping or forensic purposes, which could prove beneficial in
investigations. When carving, we're making structured data out of
unstructured data or raw data.
In our use case in this module,
we're going to be carving a file from an actual network stream.
But others use this ability with other tools to also recover
files and fragments when our file systems are failing,
corrupt, or the directory is missing.
So there's a few good use cases for this capability, and our
favorite tool, Zeek, is able to do this for us as well.
Zeek uses the File Analysis Framework in order to present
and use file‑related information and actually carve the
files for us and save them to disk.
This is a big improvement over previous versions of Zeek that
required very detailed scripts in order to perform the same
capabilities. Using the File Analysis Framework along with other
Zeek frameworks and integrations,
we can define what to do after a file is detected and where to
send it or put the data extracted from it.
If you're familiar with Zeek packages that are
available, then this one might seem familiar.
It's by Stephen Hosom, and it's an easy way to get started carving your files.
Of course,
you can always create your own scripts to be able to specify exactly how you
want Zeek to behave with the files and their analysis.
You can also just use these packages as a baseline and
modify the configurations to ensure that you're getting out
of them what you need specifically.
You can download this package at the link here if you want to play around
with it in your own Zeek instance. In the next demo,
we'll go and look at the configurations and see what the important areas are.
Then we'll test it out to make sure that we can extract and,
if needed, export our files from the live network stream.