All right, now that we were able to see the Intel framework in action,
let's pivot a little bit and talk about JA3.
Now before we get into how we can use that information,
we need to understand what it is, what tools also use it,
and how we can make it available in Zeek.
Let's break down what JA3 really is.
We have two different things or methods that give us
hashes for SSL and TLS connections.
The first one is JA3, and the second is actually JA3S.
JA3 is a method that's very common in the industry,
and it's used for fingerprinting the client connections.
This uses the fields in the client hello messages to the server.
This process was created by a few Salesforce engineers.
It helps us identify applications and libraries,
but we're able to use it for our security processes as well,
helping us identify malicious applications.
JA3S is similar in capabilities,
but looks at the server side of the conversation to create a hash or a JA3
server profile for the server or application on the server's end.
Here's an example of a JA3 hash from a client server connection.
There's nothing special about these except that their hash is in MD5 format.
We get the hashes for these and compare them to known JA3 or,
if we're using JA3S, JA3S hash databases that are available.
And we can match on the malicious activity based on that.
The theory around this,
and the practical application of using a feature like this,
is that the creation and communication of a unique malware
executable will have its own hashes.
As we see new malware in our networks,
we can grab the JA3 hash and use that as an indicator of
compromise to identify the malware more easily.
Since the focus for this course is on Zeek,
how can we use JA3 in our Zeek environment?
Well, there's an app for that.
Just kidding.
But there really is a Zeek package for that.
This is it.
The path is salesforce/ja3,
and we'll be using this in the coming demo to see it actually working for us.
As you can see,
it's supported by a lot of different applications that we use in
cyber operations and a couple of the tools and platforms that we've
already discussed here in this module.
We have things like Suricata, Packetbeat from the Elastic Stack,
Splunk, NetWitness, Security Onion, RockNSM.
All of these use it.
Are you able to think of any other uses for JA3 or JA3S hashes besides
matching against potentially malicious communications?
Let me know via social media or in the course comments if so.
So here's what we're going to do.
We'll use the Salesforce package to get the hashes from our secure
communications and look at the data that we get from the conversation.
We'll take a look at the configurations and the README for them,
then see it in action.
After we're done with that, we'll get ready to close out the course.
Let's hop into the lab.
All right, and here we are back in the lab exactly where we left off.
I'm going to go ahead and clear my screen to give us some room to work with.
So the first thing that I'm going to do is install the Salesforce package.
Now I'm just using the Zeek Package Manager to install it.
And now that that's good, it already loaded it.
Before we get into demonstrating how to use it,
let's go ahead and look at a few of the configurations for it.
Now as you can see, we have a couple files here.
We have the README.
We have the load file.
Of course, we have an Intel file for JA3.
We have the JA3 file and then the JA3S script.
So let's go ahead and look at a couple of these and see what they're doing.
So the first one, let's do the README.
Now I'm always a big fan of looking at what the scripts are doing
before I add them to my Zeek instance just to make sure that I fully
understand how it's affecting the system,
how it's affecting my network, and exactly what I'm getting from it.
And then also,
it's helpful so you can make any modifications that you think you might want.
So looking at the README file, it's describing the features that we have.
So we have the JA3 field being added to the ssl.log.
We have the Intel file that adds the JA3 information into the Intel framework,
which gives us the ability to use it for matching
and then the same for the JA3S.
We have those added to the ssl.log as well.
Let's look at the Intel file and see how it's handling these events.
So as you can see, what we're looking for is the ssl_client_hello,
and we're grabbing all of this information from that connection and
passing it over to the Intel framework as an indicator.
And the indicator type is being defined as Intel JA3,
which is different than the initial list that we have.
So we're actually adding new indicator types in here.
All right, so let's modify the JA3 file,
and we're looking at the different fields and creating the
record type for the TLS conversation.
We have the fields that we'll go ahead and uncomment so
we can get those extra ones in there.
And then, as you can see, we have our event definitions like normal,
and we have the if/then statements or if/else statements
telling Zeek how to handle these connections and the
information that it gets from them.
And there's a lot of information here about the actual SSL and TLS
connections and the ciphers and formats that we need.
So let's go ahead and nano this and make sure that we uncomment
all of the values that we want and then scroll down to the end
of the script and do the same.
And then we'll redeploy Zeek since we have that new configuration.
And now that it's started, we need to generate some traffic.
So let's go ahead and navigate over to pluralsight.com now so we
can generate that SSL conversation and hop back over and see
what the logs say. And look at this.
We have a lot of information here in the JA3 fields and even the JA3S fields.
So we have the ciphers, the extensions, the formats,
the JA3S hash, and the JA3 hash.
So these two hashes are what we see in the conversation between the two
hosts. And remember, like we saw in the slides, we can use these hashes to
match against known malware signatures or known malware hashes based on the
communication. So we can match this according to the JA3 database and see if
we have Trickbot or Emotet or other known malwares that have JA3 hashes that
are already known.
We can match against those.
We can download the database itself and use it within Zeek to see if
we have malicious activity going on in the network.
So these hashes are extremely useful in helping us find new indicators of
compromise and matching against already known indicators. And that's really
it for the JA3 data. You can dive a little bit more into the scripts and
customize them to handle the traffic a little bit differently if you want or
add additional fields if you're interested in trying to find new helpful
fields or convert some of these fields to other formats. That's all possible
in these scripts.
But even just out of the box,
this package is awesome because it gives us this super useful information.