filmov
tv
Analyzing PCAP with Zeek - HTB Sherlocks - KnockKnock
Показать описание
00:00 - Going over the Scenario
01:30 - Talking about why I'm using Zeek and running it in a docker
05:20 - Showing a Corelight Zeek Cheat Sheet, which is tremendously helpful
08:00 - Showing Zeek-Cut on the x509 log, then looking at the SSL Log
11:50 - Looking for a single IP that sent multiple SSH Banners
13:20 - Creating an alias for zeek-grek (alias zeek-grep='grep -e "^#" -e'), which lets us easily filter logs
17:00 - Looking at the HTTP Log, discovering a wget downloading ransomware
21:10 - Looking at the FTP Log, and showing the passwords are hidden. Editing the Zeek Config to unmask the password
24:30 - Editing the FTP Logged commands to add PASS so we see failed logins too
34:10 - Using the DNS Log to see that our attacker was likely using Amazon EC2
36:15 - Looking at how many connections each IP made, discovering our attacker doing a port scan using date -d @epoch to convert to human readable time
42:30 - Editing our zeek config to also extract_files, then looking at the ransomware download
53:15 - Looking at the files downloaded over FTP
1:07:00 - Start answering the questions. Doing some Grep Fu to see all the open ports during initial recon
1:18:10 - Finding when the port knock happened
01:30 - Talking about why I'm using Zeek and running it in a docker
05:20 - Showing a Corelight Zeek Cheat Sheet, which is tremendously helpful
08:00 - Showing Zeek-Cut on the x509 log, then looking at the SSL Log
11:50 - Looking for a single IP that sent multiple SSH Banners
13:20 - Creating an alias for zeek-grek (alias zeek-grep='grep -e "^#" -e'), which lets us easily filter logs
17:00 - Looking at the HTTP Log, discovering a wget downloading ransomware
21:10 - Looking at the FTP Log, and showing the passwords are hidden. Editing the Zeek Config to unmask the password
24:30 - Editing the FTP Logged commands to add PASS so we see failed logins too
34:10 - Using the DNS Log to see that our attacker was likely using Amazon EC2
36:15 - Looking at how many connections each IP made, discovering our attacker doing a port scan using date -d @epoch to convert to human readable time
42:30 - Editing our zeek config to also extract_files, then looking at the ransomware download
53:15 - Looking at the files downloaded over FTP
1:07:00 - Start answering the questions. Doing some Grep Fu to see all the open ports during initial recon
1:18:10 - Finding when the port knock happened
1:31:13
Analyzing PCAP with Zeek - HTB Sherlocks - KnockKnock
0:13:03
12 Days of Defense - Day 2: How to use Zeek for PCAP Analysis
0:30:30
ZW21 Day2 PacketTotal – A Community Service for Zeek Based PCAP Analysis Jamin Becker
0:08:19
Cybersecurity Tool for Network Analysis - Zeek
0:42:27
PCAP Network Capture & Zeek Processing
0:15:35
Network forensics and PCAP investigations using Brim for malware analysis (Suricata + Zeek)
0:19:30
How To Easily Connect Zeek to Python
0:30:00
Getting Started with Zeek PCAPs | Chris Brenton
0:33:37
Cutting through network forensic data with Zeek
0:59:50
Introduction to Zeek Log Analysis w/ Troy Wojewoda
0:24:07
Packet & Log Analysis with Zeek P1 | TryHackMe Zeek
0:11:10
Industrial Control Systems (ICS) PCAPs For Zeek And Wireshark
0:25:20
Zeek in Action, Video 7, Capture Loss Statistics
0:18:51
Pcap Analysis #9
0:21:59
Using Zeek Signatures To Detect CVEs
0:42:22
Visualizing, Analyzing and Filtering Zeek Events using a Graphical Frontend and OpenGL, Nick Skelsey
0:15:24
Zeek and ICS Protocols | SANS ICS Concepts
0:52:25
Zeek From Home - Zeek Scripts - 101 to 595 in 45 mins by Aashish Sharma - 10 June
0:05:19
Network Capture & Zeek
0:04:52
Using Zeek Logs in CloudShark
0:09:17
Zeek: Enhanced Security with Suricata
0:10:24
KringleCon 2019 - 12/12 - Zeek Analysis Terminal & Weather Data Filtering
0:00:53
Daily Cyber Shorts: Industrial Control Systems (ICS) PCAP Resources For Zeek And Wireshark
0:31:41
Packet Analysis with Zeek P3 | Frameworks & Packages | TryHackMe
Комментарии