One of the MITRE ATT&CK enterprise techniques is
user execution of a malicious file.
This file can be presented in several ways,
such as an email attachment or social engineering.
In this clip,
I will explain how Zeek can be used to capture
malicious files that traverse a network.
I'll be covering four areas related to Zeek and file extraction.
The first is MIME types, which is how different types of data are identified.
The second is the Zeek file analyzers that handle
things like extraction and hash in.
If your environment is performing full packet captures,
I will discuss some of the trade‑offs between extracting files
from a PCAP versus Zeek file extraction.
Lastly, we will look at the built‑in Zeek file extraction policy,
and as a bonus, I've included a custom policy that targets executable files.
There are many MIME types that are used to describe data.
Clients and servers use these MIME types so they understand how to
process data exchanged during communications.
When you download a file from the internet,
such as a Windows OS application,
it will typically have an application/x‑dosexec MIME type associated.
The same goes for file archives and images.
From a more technical perspective,
Zeek uses the first binary sequences in a file,
also known as the file signature, or magic number,
to determine the correct MIME type.
Zeek will also process the MIME type provided in HTTP sessions.
I will point out that the MIME type and file signature are
not the same and serve different purposes.
For instance, although an audio file or Word document may have a file signature,
plain text documents like JSON do not have such special by
sequences, and these files have their MIME types provided by a
web server using the content type headers.
Whenever Zeek encounters a file,
it produces a files.log with a wealth of information
that is valuable to a security analyst.
Zeek has file analyzers that will capture the hash of a file, parse x509
certificates, and even extract the data and store it on disk.
The log that the file analyzed will capture the protocol,
MIME type,
the host that received the file, and the host that transmitted the file.
The conn_uids field can be used to make correlations with other Zeek log files.
When a file is extracted to disk,
we can use the fuid field to find the file. As you will see later, without
the fuid, it will be relatively difficult to find a particular malicious
file among potentially thousands of similar files.
If you're in an organization that utilizes full packet capture,
there is a process and tools available to extract malicious files.
Full packet capture consumes a lot of resources, and I've seen many requests
made to retrieve a file in a PCAP after data retention has elapsed. Zeek can
provide a compromise of only extracting files,
which in turn will consume far less resources than full packet capture.
What you see on the screen is the full content of the default Zeek
file extraction script. By default, this feature is not enabled and
will extract all files. Keep in mind that if Zeek is only positioned
to monitor encrypted traffic,
then there will be a limited capability to extract files.
However, when it comes to encrypted traffic,
you will notice a large volume of x509 certificates being extracted.
Now let's look at a customized script. In this script, I tell Zeek to check the
mime_type and only perform the file extraction process if it finds an
executable. Since this script is not bundled with Zeek,
you will have to save it to the Zeek policy directory and then
reference it in the local .zeek file for it to take effect.
It should be noted that it will be redundant to have the previous
extract all files and the script enabled at the same time.
So, we have talked about MIME types and how Zeek can be used
to extract files from network traffic.
We have a situation now where the Globomantics incident response
team has discovered a compromised system on the network and have
started the remediation process.
They have noticed that the malware was deleted from the system and they
would like to know if Zeek was able to capture the executable so they can
analyze the binary for their postmortem report.
If Zeek was configured to extract at least executable files
and it was positioned where it had an opportunity to observe
the malicious file in question,
then all we would need to do is capture the IP address of the compromised
system and query the files.log to identify the FUID.
Once we have the FUID,
we can navigate to the location where all the extracted files are
stored and follow the chain of custody process to provide the IR
team the executable. In the upcoming demo,
I will show you how to perform these tasks.