And so when I take a look at that, and I'll show you here, if we take a
look at some of those files, so you gave me this pcap.ng file, right?
And pcapng, for those that aren't familiar,
is just a newer version of pcap. Pcap has been the standard format used for
network captures forever, for years and years and years.
Pcapng is just a newer format, and it just adds a couple things.
You can annotate packets within pcapng files and share
them with people and things like that.
So it does add a couple things,
but it's still just all the network traffic that was captured. Absolutely.
And I was a little worried when you first gave it to me. I'm like, oh man,
I don't want to have to go use edit pcap or whatever and remember how to
translate that back into just pcap, which you can do.
It's actually super easy to do if you're using a legacy program that won't
accept pcapng. I didn't have to do that with the newer Bro, so that's that's
good news. It ran no problem. So I ran that, and we have these logs here, and
you also see some of my models and stuff.
But here's all these logs that are kind of general Bro logs, right?
What I also did is I downloaded.
I went to Salesforce, and they have a JA3 module.
So JA3 hashes, if you're not familiar, it takes the cipher suites and
other cipher information that's available in TLS handshake, and it
generates an MD5 hash of that information.
So there's going to be a unique MD5 hash for which cipher suites
and capabilities were presented in that TLS handshake for the
client, as well as for the server.
And so we'll see those. When you add that module in, you can actually use
Bro packages, and you just do Bro package install JA3.
That's one way of doing it.
Or you can go download it.
So I'll show you that here. If you can go to Salesforce GitHub,
and they have the JA3 packages here, you can go into bro,
and you can actually download this information and they just
add that into your local.bro config file.
We'll come back to this because they actually use this in some examples for
Emotet and TrickBot, so that gets kind of interesting too.
But first,
let's take a look at how we would kind of identify this in the first
place. And I'm using Windows Subsystem for Linux.
So, actually, I have Ubuntu loaded on Windows Subsystem for
Linux 1.0 . So 2.0 is coming out really soon.
I'm very excited about it because you can run Docker for Linux on Windows,
which just starts going a couple layers of inception.
But either way, that's what we're using here.
And I use Bro, and I've generated these logs. And so, kind of when
you come at this from like a session perspective,
if we just look at the conn.log, it's the first thing, is the IP 5
tuples, everybody talking, there's a ton of stuff in here.
And not all of this is going to be TrickBot, right?
Right. Because there's other stuff going on and advice. Even
even on your sandbox network it's not, there's still a lot
of Microsoft traffic as well, right?
Yeah, the thing you have to remember is that with any version of Windows,
really any operating system or any device that's on the internet
or network, it's going to be pinging out to other systems, it's
going to be communicating, and there's a lot of legitimate
traffic that's going to be on.
And so we talked a little bit at one point about baselineing your
system. This is definitely one area you want to baseline. You want to
know what is Windows going to go out and do a DNS lookup for? Where is
it going to communicate with in order to download updates or just do
whatever Windows is doing?
And so there's a lot of that traffic in here.
Yeah, absolutely.
So what I end up trying to do is we know that when
connections are made from a box, right? So you were infected on the box.
That connection is going to be made out to some IP and port.
And so generally, if we were talking about 80 and 443 traffic,
that port will be unique in that those connections will
be the only ones made out to that.
If there's other connections, that's kind of interesting.
So we're going to use bro‑cut. Bro‑cut can be loaded as well.
It's just going to allow us to look at those specific fields.
So I'm going to attempt to look at very specific columns,
if I can remember the names, right?
So with some luck here,
we're looking at response host, right? They don't use IP because
that'd be too easy, and then p is for port.
Okay. So when we do this, now we get a list of all the
IPs and ports. So that really good.
And now I'm just going to use some Linux commands. So I'm going
to look for a unique ones and give me a count.
And of course, that didn't work because I didn't use a dash.
There we go.
Cool.
So that's all the unique ones.
But first,
I'm actually going to sort those by number, which will be that last port number.
So I'm sorting by unique port and, oh, IP. I see. So let's take out the IP
that's reaching out to, and let's look at just that port that was going to look
at. So now the list here, these are just all the different ports that were
communicated as the destination. Absolutely, as a destination outside of the
box. So if were looking at TrickBot on the device reaching out, it's going to
reach to likely one of these lower ports, except for these high ephemerals I've
generated back to it.
So we can look at that later and see what ports are
open and available on your device.
That's kind of a different discussion. But for indicators for
reaching out, we kind of get some of the common ones.
And so, just so I'm clear,
we're going to ignore the ones that are like the 49,000s and the
63000s, and the ones kind of that are lower numbers on that, those
are the ones that we're going to focus on.
Absolutely.
And then here is where we're going to have to use a
little bit of our internal knowledge, right?
So this is baselining, as well as just having some experience,
and hopefully watching these kind of courses can help with some
of that experience as well. We go over these in some of our
network analysis courses, right?
Fifty‑three. Got it. That's DNS. Sixty‑seven, it's DHCP.
Eighty, okay. So maybe there's some 80 stuff because we know
that's kind of a common malware thing.
There's nothing weird about it per se. It doesn't _____. You would
expect to see HTTP port 80 traffic on a on a network. Right. One
thirty five and 136, 137, 138, most of these, one of them's not,
but this is all NetBIOS stuff. Right. Right. Okay, and then 443, so
that's SSL again.
Could be associated with TrickBot, could not be. Could just
be you're browsing the Bank of America, right?
Right, exactly. And 447, to me and my experience, that's weird.
Yeah, me too.
You know, 447 and the one below it, 449, those are definitely ports that you
normally don't see when you're doing network monitoring.
Absolutely.
And when, another thing that's interesting about it, and there's some other
interesting ones here is they're fine, maybe this doesn't stand out for all
them, and we have some prior knowledge, so we've realized that we've seen
some of these in Process Explorer,
and we've also seen it in the config files. That's kind of
interesting. But another thing that I like to do is the least
frequent case is often interesting.
So, yes, we're looking at the sandbox, so maybe it's a tad different.
We'd normally see a bunch of different stuff, right?
But if you're in an enterprise doing incident response, when you look
at the least frequent thing happening on the box, that can likely be
an indicator. So if we see something that has two connections as
opposed to thousands of connections,
that's a little weird and something we can look into.
Something unique on your network then.
Yeah, absolutely.
So that's something I usually look at.
Yes, there's other ones.
We also know that 8082 is going to be interesting.
Yeah,
we did see that in the configuration file for TrickBot, so
that kind of stands out regardless. For sure.
And then some of these other ones. I'm actually not really sure what
547 is. But knowing that, now we have multiple things pointing at
447, 449, and 8082, that's something interesting that we can look
at. Yeah, and I think you kind of pointed this out too, we're only
looking at the ports.
Once we kind of add in those IP addresses,
we could find out that port 1900, that could be going to a
broadcast address, which would be normal traffic.
We could immediately ignore that.
Yeah, it could be local as well.
I didn't do the other side of this connection.
The other side of the connection could be like IPv6 or something like that.
Right, okay, that makes sense.