Large data transfers going out of a network can be an indicator of data theft.
Zeek provides us with much of the log data necessary to
spot most cases of potential exfil.
However,
we need to perform more focused hunts to identify
exfiltration that tries to avoid detection.
The MITRE ATT&CK framework lists several techniques an
adversary will use to perform data exfiltration.
In this clip,
I will cover how we can perform Zeek connection log analysis to
identify potential instances of data theft.
Then we will look at DNS exfiltration and ICMP exfiltration.
The last thing I will cover in this lesson will be a Zeek
script by Corelight that generates alerts in the notice log
when it discovers long connections.
The Zeek connection log should be your starting
resource for hunting data exfiltration.
This is because, among other things,
it can tell us approximately how long a connection lasted,
the size of most payloads, and which protocol was utilized.
Looking at the sample connection log on the screen,
can you tell what happened with this connection?
You can pause the video and come back to hear the answer.
Okay, so in this example log,
the connection originated remotely over TCP and
connected to port 8089 on the 28.7 server.
The connection lasted 4 seconds,
during which 18 KB of data was transferred from the
external system into the Globomantics server.
I want to point out that there is nothing in this log file
that will tell you that a particular connection is malicious
or confirmed data exfiltration.
An analyst will have to make that assessment after correlating the
information in this log file with other Zeek logs,
and knowledge of what is expected behavior between these two systems.
There are over 20 fields in the connection log that can help with analysis.
The Zeek documentation has an explanation for each of
them under the Conn::Info record type.
Zeek does not correctly report long‑running sessions that
have significant periods of inactivity.
The reason for this is because Zeek logs connections
after they have been terminated.
If a connection is dropped or there was no FIN or RST packet,
Zeek would hold that connection indefinitely in memory.
This situation is averted by having an inactivity_timeout.
The default for TCP is 5 minutes,
which tends to be too low for specific connections.
The default for FTP and SSH is set to 1 hour.
In any case,
when these default timeouts are exceeded and the connection is still active,
the result is seen as several connections listed
for one long‑running connection.
Globomantics has intellectual property stored on the network,
and wants the security team to hunt for evidence of possible data theft.
There are several areas where we can start our hunt,
but let's look at DNS exfiltration.
Most environments tend to allow a majority of DNS
traffic through the border firewall.
Adversaries take advantage of this knowledge and use the
255‑character query limit to ship data out of a network.
DNScat is a free and open source tool that allows data theft using DNS queries.
Cobalt Strike, a prominent threat emulation tool,
will also use DNS queries as a command and control channel.
The queries are easy to spot if you monitor DNS traffic,
since they will typically be unintelligible strings
using various record types such as TXT, MX,
and CNAME.
When hunting for this type of exfiltration,
look for large volumes of DNS requests from endpoints and search for
queries with lengths over 20 or 30 characters.
This number will vary based on what's appropriate for your environment.
For example,
telemetry and advertisement servers tend to use text records
that could generate false positive alerts.
ICMP is used for network diagnostics and error reporting.
You've probably used the ping utility before while
troubleshooting whether another host was up or even a check
if you had connectivity to the internet.
I know a few sysadmins that ping quad8 to check if they can reach the internet.
Well, it turns out you can exfiltrate data using the ICMP protocol,
which is what the Ping tool does.
Almost every mainstream operating system on an enterprise network
comes with the Ping utility installed by default.
If you guessed that most networks do not block outbound ICMP,
you would be correct.
Most decent security stacks can detect invalid ICMP packets,
however, some techniques can perform data exfil using RFC‑compliant ICMP packets.
There is a third‑party Zeek script by Corelight that tracks long‑lived
connections and provides an intermediate log file.
Whenever a long connection is detected,
a notice is generated and a conn_long log file is written.
This script solves the problem of long‑lived connections that would
otherwise be subject to an inactivity timeout.
I will show you how to configure the script in the upcoming demo.