In this demonstration,
we're going to build upon the techniques that we've discussed in the previous
content and now apply that in order to learn how to investigate different
methods of identifying data exfiltration activity.
We're also going to explore commonly used protocols for data exfiltration,
as well as look into how you can utilize the hunt feature of Arkime in order to
perform searches to identify evidence of data exfiltration,
as well as just simply to search for different patterns
that you want to identify in your traffic.
Let's get started.
For our first pcap,
we're going to analyze some traffic that utilizes data
exfiltration over a relatively non‑standard protocol,
at least in terms of data exfiltration.
Now, when it comes to analyzing network traffic,
these demonstrations are designed to just give you some ideas on how you
can utilize Arkime in order to look for these anomalies.
Now, for this particular sample, we will start with the SPI view,
and what we're going to look for is just any
anomalous behavior in the traffic itself.
Now, with these pcaps, this gets to be a little bit easier,
because we don't have to look at an enormous amount of
traffic from a production environment.
So always keep in mind that you can use the filters to help
eliminate the traffic that you know is good.
In this case, we can see that there is some email activity.
Let's say, for example,
that the environment that we're defending doesn't use any internal
email servers; all of it's hosted in the cloud.
This certainly then would be something that we would want to investigate.
And we can expand that section and click Load All.
As we begin to review this data, certain things will stand out.
First, is the body magic of the email itself.
It was a jpeg, or at least it appears to be a jpeg,
that was sent out of the environment.
As we continue to scroll down, things become quite a bit more concerning,
particularly when we see the sender and the receiver,
not to mention the subject title of this email,
which appears to be the name of one of our PCs.
If we scroll back to the top, under the general section,
we can expand the menu from the SMTP protocols list
and then add that as a filter.
Now we can navigate back to the Sessions tab,
and what we'll be able to do is expand the session to see
exactly what took place in this communication.
So here we can see the information that is in fact loaded from the pcaps.
We have an authentication event to the SMTP server.
You'll notice there are credentials there,
and you'll want to be very careful,
because you can find yourself in legal trouble if you attempt to access
a system for which you do not have authorization.
As we scroll down a little bit further,
we'll get to the body of the email itself,
and much like HTTP,
there are several headers that will help us to understand
what content we're actually looking at.
In this case, the content type indicates the image/jpg,
as we've already noted, and the transfer encoding is Base64.
So how could we get this information out to see
actually what data was exfiltrated?
Well,
your first reaction may be to simply use the Show
Image & Files option inside of Arkime.
However, as you'll see, because that was Base64 encoded,
it's not able to understand how to decode that content.
So it's not providing us with the ability to download that file.
While I'm sure you can think of many ways to decode this content,
all I'm going to do is to save it in a file and use the Base64
command line utility in order to decode it.
After creating a file.
I just called it image.b64 for Base64, and saving that content to the file,
we can now use the following commands in order to
decode it from the command line.
We'll cat the image in order to get the content,
and using the redirection operator, the vertical bar,
direct that to the Base64 utility.
With the ‑d option, that will take the input from our cat command and decode it.
We'll finally use the greater‑than operator in order to redirect the output
from Base64 into a new file that I'll just call image.jpg.
What this should provide now is the decoded image.
So we can go to our desktop and open that image file to see what is there.
It looks like maybe some initial reconnaissance,
as there was no other content in the email sent,
nor was there any other follow‑on activity from our
infected system in this particular pcap.
Let's move on to our next one.
With this pcap,
we're going to be looking at some exfil activity from
the Raccoon Stealer family of malware,
which uses zip files in order to steal data from the infected system.
In order to do this, we're going to use the hunt feature of Arkime.
In order to get the Hunt tab to show up,
we first have to go to the Users tab, and from the users that you have created,
you'll have done at least one of these users during the setup process,
and we have to check the Can Create Hunts checkbox.
After that, we can save the options,
and now the Hunt tab is available in the interface.
What the Hunt tab allows you to do is to create queries that you can use
to search across the traffic based off of the filters.
So I still have the protocols filter from the previous pcap.
Unless I only want to search under the SMTP protocol,
I want to make sure to remove that before proceeding. To give
you a heads up on how large your search is going to be, Arkime
provides you with an informational box that tells you how many
sessions will be searched.
So again, for performance reasons, it's just something to keep in mind. Now,
in order to get started, we'll want to click on the Create a packet search
job button on the upper right‑hand part of the interface.
Doing so will bring up all of the different options for
the search that you want to perform.
We can define a name, the number of packets to examine per session,
if you want to be notified. Probably one of the more important parts
of this is the actual search itself.
So we define the content that we want to search for, and
right below that, what is that content?
Is it ASCII? Is it ASCII case sensitive?
Maybe it's hex, maybe it's a regular expression.
Once you've defined the content that you want to search,
you can also further define or refine how you want the search to be performed.
Do you want to search just source packets, just destination packets, or
both? Do you want raw packets or reassembled packets?
Once you've defined all of this information, you click the Create button.
Now, as I mentioned,
this particular malware oftentimes uses zip files in order to exfiltrate data.
And one of the benefits that we have with those zip files is that we can see
at least the content of the file names within the zip.
It's common then,
to have very meaningful names in those zip files, passwords, system info,
cookie values, just to name a few.
So I'm going to use the string, system info, expecting there to be
information about the system that has left the environment.
Since I also anticipate to only find this content in
traffic leaving the environment,
I'm going to disable the search destination packets.
I'm not interested right now in the response.
Alright, I think we're ready.
Let's start the search and see what we get.
Excellent! We can see that we have 100% status, our search is now complete,
and we have one match, which is indicated to us in the second column.
We also have information about our search, when it was created, and an ID,
and this ID is is actually important, because this ID will allow us to use
this search to filter results in the other interface elements within
Arkime. So next we can click on the open folder icon in order to open these
results in a new Sessions tab.
The first thing I want to point out in this new tab is
that in the filter box, you have a hunt ID equivalent to
the ID value that we just saw.
Now we have the particular session that matched on our search
results, so we can go ahead and expand the session in order to see
what type of data was actually exfiltrated.
As we scroll down,
you'll see some of the back and forth from this HTTP
request response, before finally, you'll see that suspicious post.
Fortunately, for this example,
we can enable the Show Image & FIles option in Arkime, and that will allow
us then, via this hyperlink, to download that zip file.
Once we've downloaded it,
it will download as a .pellet. We can rename that with a .zip extension,
and use the default system utility to unzip the file.
I went ahead and moved that file to another folder on my
desktop just to keep things organized.
As you can see, I've already given it the .zip extension,
which allows me to simply double‑click on the file.
And now we can extract that content to the current directory and then finally,
we can explore the content that was sent within that zip.
At this point, you can continue to explore the content that is in this zip,
and sometimes you'll find even more revealing information about
the malware that you've just encountered.
In any case,
you now have a better understanding on how to use the hunt feature in order to
explore and search for different patterns in your traffic,
as well as how we can use different views, such as the SPI
view, in order to detect anomalous behaviors. We're now ready
to move on to our next demonstration.