In this demo, I will show you some methods for performing post‑mortem analysis.
I will start by filtering the dataset results so we only
see data related to the compromised host.
Then I will show you how to isolate all the lateral
connections made on the Globomantics network.
We will then transition to observing all the DNS
requests and encrypted connections.
I will end the demo with how to view all the external connections
performed by the compromised host on the date of infection.
Let's dive in.
In the Kibana Web UI,
I have already filtered the results by the connection log
and by the source IP of 192.168.27.14, which is our compromised host.
I have also selected the date range of June 10th.
Notice that there is 30 minutes missing from the time frame.
This is because the default time selection does not
allow us to quick pick 23:59, so I'll have to type it in myself.
Done.
Now we gain about 200 extra log messages.
In order to get all the log data that we can use to
identify potential lateral movement,
you might be guessing that we search for all destination
hosts within the Globomantics subnet.
That would not be wrong,
but there is a better way to get the same information using the
network direction field and selecting internal.
These results can be analyzed by looking at the destinations visited to get
an idea of which other systems may have been exposed.
If you decide you want to start your analysis using a
different field such as the network protocol,
then we can search for that field and examine the results.
Of course, if you want a broader view,
we can search for the network transport field instead.
Next, let us look at the DNS connections.
Once again, I've already filtered the data by the log path and source IP.
We can begin our analysis using the parent domain or the sub domain.
We can see that the system only used the internal DNS
server during the time frame we selected.
I want to show you one more item that could be where you
start your analysis on the DNS data.
If we expand the chart,
you can see that there is a significant spike in DNS traffic after 21:00.
If you decide to focus your analysis on this spike,
clicking on the desired bar will dynamically change the time period selected.
Moving on to encrypted traffic, I have selected the SSL and X509 logs as filters,
and we still have the 27.14 source host included.
With encrypted traffic,
a good place to start for post‑mortem analysis is
the Zeek SSL validation status.
We can look for any self‑signed certificates, and then search
for the issuer common name to get an idea of what type of
self‑signed certificates are in the data.
The last thing we will look at in this demo is the outbound
connections from the compromised host.
The filters I have in place are similar to the lateral
connection section of this demo,
but now I have changed the direction to outbound.
The destination address that the host connected to
externally would be of interest to most analysts and can be
compared against your IP intel feeds.