Welcome everyone to Network Analysis with Arkime. My name is Josh Stroschein,
and I'll be your instructor for this course.
I'm really excited that you're here,
so let's get started with some of the background information
about Arkime. Arkime was originally created by Andy Wick and
is formally known as Moloch.
Arkime augments your current security infrastructure to allow you to
store and index network traffic in standard PCAP format.
The power of this is that it provides fast, indexed access.
It has an intuitive and simple web interface provided for PCAP browsing,
searching, and even exporting.
This project is large scale, open source, and provides
indexed packet capture and search.
It is currently available under the Apache 2.0 open‑source license,
and you can download it at arkime.com.
There are three components that comprise the Arkime project,
and you'll learn about those in this course.
The first is the capture component.
This is a threaded C application that is used to capture the network traffic.
This can either capture traffic live on the network or it can process PCAPs,
which is what we'll do in this course. There is a viewer, which is
an intuitive Node.js application and where we'll spend most of our
time performing traffic analysis.
And finally, there's Elastic,
which can be installed as part of the default Arkime setup. Before we get
into all the technical details of Arkime, let's spend a few moments
discussing some of the different cybersecurity frameworks.
First up is the NIST Cybersecurity Framework.
This framework provides for the ability to manage cybersecurity risks across
the enterprise with both internal and external stakeholders.
At its core,
it provides a set of functions to achieve specific
cybersecurity outcomes, which you can see here,
identify, protect, detect, respond, and recover.
Each function can be further broken down into categories and are closely
tied to the programmatic needs and particular activities to defend an
organization. Arkime helps an organization fill the gaps in the Anomalies
and Events and Security Continuous Monitoring categories. We can break this
down even further because the CSF provides subcategories tied to specific
technical activities.
Arkime, then can help to ensure that detected events are analyzed to
understand attack targets and methods, the impact of events is
determined during analysis, and that the network is monitored to
detect potential cybersecurity events.
The demonstrations that we'll have later in this course
will help tie these concepts together.
Next up,
let's take a look at MITRE ATT&CK. MITRE ATT&CK provides different attack
techniques that adversaries can use against an organization.
For this course, we're going to look specifically at network analysis.
And while Arkime can provide the ability to view all of the
traffic that goes across your network, we're specifically going
to focus on prevalent attack techniques.
The first one is phishing, and more precisely, spearfishing attachments.
We're also going to take a look at application layer protocols.
It is very common for attackers to utilize common web protocols such as HTTP
when they're communicating with command and control nodes.
And finally, we'll take a look at exfiltration over C2 channels.
MITRE SHIELD is another framework that helps you to map
the different attack techniques to steps you can take in
order to defend your network.
So if we map the attack techniques and sub‑techniques to MITRE Shield, we'll be
able to look a different categories such as DTE0021 ‑ Hunting: The process of
searching for the presence of or information about an adversary. DTE0027 ‑
Network Monitoring in that the defender can implement network monitoring for an
alert on anomalous traffic patterns,
large or unexpected data transfers, and other activity that
may reveal the presence of an adversary.
Well,
we're not going to use Arkime to generate alerts. Arkime does
allow us, then to investigate and perform network traffic
analysis to identify these patterns.
Arkime also has the ability to integrate with popular and
open‑source intrusion detection systems, so you can potentially
get alert information into your Arkime setup.
And finally, we have DTE0028 ‑ PCAP Collection.
That's one of the main capabilities that Arkime provides is the ability
to collect full packet capture of all network traffic.
This allows you to review historically what's happened over
your network to help reconstruct events,
identify patterns that maybe were previously undiscovered, and overall
have a greater capability to defend your network.
So where does Arkime fit in to a standard enterprise setup?
Well,
the deployment really depends on where you want to have coverage. Arkime, at
its core, Arkime needs to be able to monitor network traffic.
So, any segment on your network that you want to provide
that full packet capture ability is where you want to
consider placing an Arkime sensor.
Once an Arkime sensor is deployed,
it begins performing not only the full packet capture, but
also submitting data to an Elastic cluster.
What Arkime submits to Elastic is just metadata about the traffic,
and this is the content that you'll see in the viewer.
This is what gives you the ability to search through your network
traffic data. When you need to look at the data that was not part of
this index metadata, it also has the ability,
through the viewer,
to load that data for you or allow you to export the
PCAP for more detailed analysis.
As we wrap up this introduction,
there is a common attack scenario that I want you to keep in
mind as we're going through the different demonstrations and
performing our network traffic analysis.
This is a very common pattern that we see right now, that is that a threat
actor group or an adversary decides to attach an office document to an email
and try to get that in front of a potential victim.
Those office documents, then oftentimes contained macros, and those
macros, while a normal part of the office suite,
those are used to achieve code execution.
If the user can be social engineered into enabling that content,
then there is typically additional stages that occur.
PowerShell may be executed or used to download the next stage payload.
There's really any number of different techniques
that can be utilized at this stage.
Eventually, though,
the malware is dropped in the environment, and we
move into a post‑infection phase.
During this time, there is often key network activity that occurs.
It is very common to see HTTP used to request the executable,
and those executable are oftentimes stored to compromised hosts, legitimate
websites that have been compromised in order to host the malware. Once the
malware has been introduced into the environment,
then we'll see a shift in the command and control, the infrastructure that it's
using in order to check in to receive further instructions and to exfiltrate
data. It's at these later stages of initial attack that we're going to be
looking at and analyzing the network traffic.
I hope you're ready to get hands on with our Arkime.
Let's get started.