Zeek European Workshop 2019 Zeek your Windowz! · 2019. 5. 3. · Default Metasploit SSL Cert in...

Zeek your Windowz!Zeek European Workshop 2019

How SSL works

How SSL works

How SSL works

How SSL works

How SSL works

How SSL works

Tools

TTPs

Artifacts

Domain Names

IP Addresses

Hash Values Har

der f

or th

reat

acto

rs to

chan

ge

Even

har

der t

o de

tect

Default Metasploit SSL Cert in Brox509.log

certificate.issuer:

CN=hrzvox.gov,

O=bdlOFqMXlUfgoNQljMuRWgiJ,

L=ZTIhjQVsJEuQIlSgScdegcLSLJVRE,

ST=WI,

C=US

Tools

TTPs

Artifacts

Domain Names

IP Addresses

Hash Values Har

der f

or th

reat

acto

rs to

chan

ge

Even

har

der t

o de

tect

How SSL works

First to the Key (2009)

Lee Brotherston (Derbycon 2015)

How SSL works

How SSL works

Microsoft Edge (Browser)

Dridex Malware (Banking Trojan)

Trickbot Malware (Banking Trojan)

Microsoft Edge (Browser)

Trickbot Malware (Banking Trojan)

Fingerprinting TLS Clients

Fingerprinting TLS - The JA3 Method


Version

771


Version,Ciphers

771,49172-157-156-61-53-47-10


Version,Ciphers,Extensions

771,49172-157-156-61-53-47-10,0-5-10-11-13


Version,Ciphers,Extensions,EllipticCurves

771,49172-157-156-61-53-47-10,0-5-10-11-13,29-23-24


Version,Ciphers,Extensions,EllipticCurves,ECPointFormats

771,49172-157-156-61-53-47-10,0-5-10-11-13,29-23-24,0



771,49172-157-156-61-53-47-10,0-5-10-11-13,29-23-24,0

MD5 hash



771,49172-157-156-61-53-47-10,0-5-10-11-13,29-23-24,0

MD5 hash

JA3 = f4c4f050188e15839a6cd3af798b6c77



771,49172-157-156-61-53-47-10,,,

MD5 hash

JA3 = 4dd4fca5534245b13b641d54a7035851


771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0

JA3 = ce5f3254611a8c095a3d821d44539877

JA3 on TLS 1.3

JA3 on TLS 1.3

No Server, No Problem

Tools

TTPs

Artifacts

Domain Names

IP Addresses

Hash Values Har

der f

or th

reat

acto

rs to

chan

ge

Even

har

dere

r to

dete

ct

JA3

https://github.com/salesforce/ja3

pip install pyja3bro-pkg install ja3

Created by:John AlthouseJeff AtkinsonJosh Atkins

Concept and Inspiration from:Lee Brotherston

Fingerprinting for SSH Clients and ServersIdea and Concept by Ben Reardon

HASSH

HASSH

HASSH

HASSH

Fingerprinting SSH - The HASSH Method


KeyExchange;

[email protected],diffie-hellman-group-exchange-sha256;


KeyExchange;Encryption;

[email protected],diffie-hellman-group-exchange-sha256;aes128-cbc,aes128-ctr;


KeyExchange;Encryption;MessageAuth;

[email protected],diffie-hellman-group-exchange-sha256;aes128-cbc,aes128-ctr;hmac-sha1,hmac-sha1–96;


KeyExchange;Encryption;MessageAuth;Compression

[email protected],diffie-hellman-group-exchange-sha256;aes128-cbc,aes128-ctr;hmac-sha1,hmac-sha1–96;[email protected],zlib,none




MD5 hash




MD5 hash

HASSH = 9c325a9bc631ff065307ccc05217c7da


[email protected],diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,[email protected],diffie-hellman-group15-sha256,[email protected],[email protected],diffie-hellman-group16-sha256,[email protected],[email protected],[email protected];aes128-cbc,aes128-ctr,aes192-cbc,aes192-ctr,aes256-cbc,aes256-ctr,blowfish-cbc,blowfish-ctr,cast128-cbc,cast128-ctr,idea-cbc,idea-ctr,serpent128-cbc,serpent128-ctr,serpent192-cbc,serpent192-ctr,serpent256-cbc,serpent256-ctr,3des-cbc,3des-ctr,twofish128-cbc,twofish128-ctr,twofish192-cbc,twofish192-ctr,twofish256-cbc,twofish256-ctr,twofish-cbc,arcfour,arcfour128,arcfour256;hmac-sha1,hmac-sha1–96,hmac-md5,hmac-md5–96,hmac-sha2–256,hmac-sha2–512;[email protected],zlib,none


[email protected],diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,[email protected],diffie-hellman-group15-sha256,[email protected],[email protected],diffie-hellman-group16-sha256,[email protected],[email protected],[email protected];aes128-cbc,aes128-ctr,aes192-cbc,aes192-ctr,aes256-cbc,aes256-ctr,blowfish-cbc,blowfish-ctr,cast128-cbc,cast128-ctr,idea-cbc,idea-ctr,serpent128-cbc,serpent128-ctr,serpent192-cbc,serpent192-ctr,serpent256-cbc,serpent256-ctr,3des-cbc,3des-ctr,twofish128-cbc,twofish128-ctr,twofish192-cbc,twofish192-ctr,twofish256-cbc,twofish256-ctr,twofish-cbc,arcfour,arcfour128,arcfour256;hmac-sha1,hmac-sha1–96,hmac-md5,hmac-md5–96,hmac-sha2–256,hmac-sha2–512;[email protected],zlib,none

HASSH = 8a8ae540028bf433cd68356c1b9e8d5b

HASSH

https://github.com/salesforce/hassh

https://engineering.salesforce.com/

Created by:Ben Reardon @benreardonAdel Karimi @0x4d31John Althouse @4A4133Jeff Atkinson /in/anNh

Mapping JA3 to Client Application

https://github.com/salesforce/ja3/tree/master/lists



Baseline your sandboxhttps://github.com/gbarford/testssl

Win10-socket: c12f54a3f91dc7bafd92cb59fe009a35

Win10-socket-SNI: 3b5074b1b5d032e5620f69f9f700ff0e

Win10-powershell: fc54e0d16d9764783542f0146a98b300

Win10-powershell-SNI: 54328bd36c14bd82ddaa0c04b25ed9ad

Win10-iexplore: be6155e945a3e59a1dd0841b86f6c945

Win10-iexplore-SNI: 10ee8d30a5d01c042afd7b2b205facc4

Win2016-socket: 043c543b63b895881d9abfbc320cb863

Win2016-socket-SNI: 7c410ce832e848a3321432c9a82e972b

Win2016-powershell: 17b69de9188f4c205a00fe5ae9c1151f

Win2016-powershell-SNI: 235a856727c14dba889ddee0a38dd2f2

Win2016-iexplore: 4f2e9c50db9bd107439136bd24740c0d

Win2016-iexplore-SNI: f88610704d61a237aa9e5e0849573998

Over TLS

File Exfil Detection

Original Concept by Bob Rotsted

https://github.com/reservoirlabs/bro-scripts/tree/master/exfil-detection-framework

Normal Outbound Traffic

File Transfer Outbound

Threshold Byte Count and Byte Rate

Exfil Detection from the WireSource IP: 10.1.2.3Destination IPs: 50.1.2.3, 50.1.2.4, 50.1.2.5 …Destination Port: 443Service: HTTPSDestination Certificate: CN=*.dropbox.com ...Certificate Valid: TrueFiles Transferred: 512TotalBytes Transferred: 2,048MB

Exfil Detection from the WireSource IP: 10.1.2.3Destination IPs: 50.1.2.3, 50.1.2.4, 50.1.2.5 …Destination Port: 443Service: HTTPSDestination Certificate: CN=*.dropbox.com ...Certificate Valid: TrueFiles Transferred: 512TotalBytes Transferred: 2,048MBJA3: fa030dbcb2e3c7141d3c2803780ee8dbJA3ClientApplication: Dropbox

Exfil Detection from the WireSource IP: 10.1.2.3Destination IPs: 50.1.2.3, 50.1.2.4, 50.1.2.5 …Destination Port: 443Service: HTTPSDestination Certificate: CN=*.dropbox.com ...Certificate Valid: TrueFiles Transferred: 512TotalBytes Transferred: 2,048MBJA3: fc54e0d16d9764783542f0146a98b300JA3ClientApplication: Powershell

Caution

Client Hello Tooling

Sergey Frolov & Eric WustrowUniversity of Colorado Boulder

The use of TLS in Censorship Circumventionhttps://tlsfingerprint.io/static/frolov2019.pdf

https://tlsfingerprint.io/static/frolov2019.pdf


https://github.com/arlolra/meek/blob/master/READMEmeek is a blocking-resistant pluggable transport for Tor. It encodes adata stream as a sequence of HTTPS requests and responses. Requests are reflected through a hard-to-block third-party web server in order toavoid talking directly to a Tor bridge. HTTPS encryption hidesfingerprintable byte patterns in Tor traffic.

https://github.com/arlolra/meek/blob/master/README


https://github.com/arlolra/meek/blob/master/READMEmeek is a blocking-resistant pluggable transport for Tor. It encodes adata stream as a sequence of HTTPS requests and responses. Requests are reflected through a hard-to-block third-party web server in order toavoid talking directly to a Tor bridge. HTTPS encryption hidesfingerprintable byte patterns in Tor traffic.

https://github.com/arlolra/meek/blob/master/README


Client Hello ToolinguTLS - https://github.com/refraction-networking/utls/README.md

https://github.com/refraction-networking/utls

UTLS in actionfunc reverse(connectString string, fingerprint []byte) { config := &tls.Config{InsecureSkipVerify: true} dialConn, err := tls.Dial("tcp",connectString, config) if err != nil { fmt.Printf("net.Dail() failed: %+v\n", err) return } // Define which ClientHelloID you want here. conn := tls.UClient(dialConn, config, tls.HelloGolang) defer conn.Close() interactiveShell(conn)}



We can do better...

Bro-OSQuerySteffen Haashttps://github.com/bro/bro-osquery

Monitor Changes to Host systemsUses a customized binaryQueries are scheduled every minute

https://svs.informatik.uni-hamburg.de/publications/2018/2018-05-31-Haas-QueryCon-Bro-Osquery.pdf

https://github.com/bro/bro-osquery

Bro-OSQueryGoal:

Map Linux processes to JA3

Logs Needed:● Zeek JA3 ssl.log● OSQuery socket_events

Bro-OSQuery

Socket_events

SELECT action, pid, path, family, protocol, local_address, remote_address, local_port, remote_port, time, success FROM socket_events

{ "action": "added", "columns": {

"time": "1527895541", "success": "1", "remote_port": "443", "action": "connect", "auid": "1000", "family": "2","local_address": "", "local_port": "0","path": "/usr/bin/curl","pid": "30220", "remote_address": "212.13.197.231"

}, "unixTime": 1527895545, "hostIdentifier": "vagrant", "name": "socket_events" }

Bro-OSQuery

Bro-OSQueryWarning

Read The Docs….

“(socket) table is not automatically enabled when process_events are enabled because it can introduce considerable load on the system.”

Bro-OSQuery

Only able to implement on Linux & OSX.

Due to dependencies of CAF and Broker being compiled

Introduction to Broker

Broker Demo

Ping / Ponghttps://docs.zeek.org/projects/broker/en/stable/python.html#exchanging-bro-events

How can we monitor Windows Hosts?

Integrate Windows Sysmon into Zeek

Bro-Sysmon

Bro-SysmonGoal:

Map Windows processes to JA3

Logs Needed:● Zeek JA3 ssl.log● Sysmon Event ID 3: Network Connection

Bro-SysmonSysmon Event ID 3:

Network Connection

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" /> <EventID>3</EventID> <Version>5</Version> <Level>4</Level> <Task>3</Task> <Opcode>0</Opcode> <Keywords>0x8000000000000000</Keywords> <TimeCreated SystemTime="2017-04-28T22:12:23.657698300Z" /> <EventRecordID>10953</EventRecordID> <Correlation /> <Execution ProcessID="3216" ThreadID="3976" /> <Channel>Microsoft-Windows-Sysmon/Operational</Channel> <Computer>rfsH.lab.local</Computer> <Security UserID="S-1-5-18" /> </System> <EventData> <Data Name="UtcTime">2017-04-28 22:12:22.557</Data> <Data Name="ProcessGuid">{A23EAE89-BD28-5903-0000-00102F345D00}</Data> <Data Name="ProcessId">13220</Data> <Data Name="Image">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Data> <Data Name="User">LAB\rsmith</Data> <Data Name="Protocol">tcp</Data> <Data Name="Initiated">true</Data> <Data Name="SourceIsIpv6">false</Data> <Data Name="SourceIp">192.168.1.250</Data> <Data Name="SourceHostname">rfsH.lab.local</Data> <Data Name="SourcePort">3328</Data> <Data Name="SourcePortName"> </Data> <Data Name="DestinationIsIpv6">false</Data> <Data Name="DestinationIp">104.130.229.150</Data> <Data Name="DestinationHostname"> </Data> <Data Name="DestinationPort">443</Data> <Data Name="DestinationPortName">https</Data> </EventData></Event>

Bro-Sysmon

Bro-Sysmon

Bro-Sysmon

Bro-Sysmon

Bro-Sysmon

Windows SysmonInstall, configure and get Results:

Event ID 1: Process creation

Event ID 2: A process changed a file creation time

Event ID 3: Network connection

Event ID 4: Sysmon service state changed

Event ID 5: Process terminated

Event ID 6: Driver loaded

Event ID 7: Image loaded

Event ID 8: CreateRemoteThread

Event ID 9: RawAccessRead

Event ID 10: ProcessAccess

Event ID 11: FileCreate

Event ID 12: RegistryEvent (Object create and delete)

Event ID 13: RegistryEvent (Value Set)

Event ID 14: RegistryEvent (Key and Value Rename)

Event ID 15: FileCreateStreamHash

Event ID 17: PipeEvent (Pipe Created)

Event ID 18: PipeEvent (Pipe Connected)

Event ID 19: WmiEvent (WmiEventFilter activity detected)

Event ID 20: WmiEvent (WmiEventConsumer activity detected)

Event ID 21: WmiEvent (WmiEventConsumerToFilter activity detected)

Event ID 255: Error

Windows Sysmon

Warning - can be very noisy

Example Logging levels:https://github.com/salesforce/bro-sysmon/blob/master/sysmon-verbose.xml

6347 - 60s of idle time28083 - 300s of idle time

Swiftonsecurity! - https://github.com/SwiftOnSecurity/sysmon-config2268 - 60s of idle time11492 - 300s of idle time 35% -40%

Windows SysmonCreate your own filter! Filter events based on Event ID name Use conditionals to include or exclude

<NetworkConnect onmatch="exclude"> <Image condition="contains">iexplore.exe</Image> </NetworkConnect>

https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

Danger!Legitimate processes are routinely used by threats - do not blindly exclude them. Additionally, be mindful of process-hollowing / imitation.

Install WinLogBeat & Configure

winlogbeat.event_logs:

- name: Microsoft-Windows-Sysmon/Operational

output.logstash:

# The Logstash hosts

hosts: ["192.168.200.1:9000"]

WinLogBeats

Running Command line

- Testing Config

.\winlogbeat.exe test config -c .\winlogbeat.yml -e

- Running in foreground

.\winlogbeat.exe -c .\winlogbeat.yml

Install service

PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-winlogbeat.ps1

WinLogBeats

LogstashConfigure/etc/logstash/conf.d/winlogbeat_receiver.conf

input { beats { port => 9000 }}

output { file { path => "/home/logstash/bro-sysmon/WindowsSysmon.json" }}

Start ServiceSystemctl start logstash

Python & Broker BindingsEstablish connection with Zeek

import brokerep = broker.Endpoint()ep.peer("127.0.0.1", 9999)

Parse JSON object

Send to function to parse JSON event data

create Zeek event

Python & Broker BindingsSysmon ID3: Network Connection message = broker.bro.Event( 'sysmon_networkConnection', winevt.get('computer_name').encode('ascii','ignore'), evt_data.get('ProcessId','None').encode('ascii','ignore'), evt_data.get('Protocol','None').encode('ascii','ignore'), evt_data.get('SourceIp','None').encode('ascii','ignore'), evt_data.get('SourcePort','None').encode('ascii','ignore'), evt_data.get('DestinationIp','None').encode('ascii','ignore'), evt_data.get('DestinationPort','None').encode('ascii','ignore'), evt_data.get('Image','None').encode('ascii','ignore'), return message

Bro EventsEvents are received by Broker and raised to script land

event sysmon_networkConnection(computerName: string, processId: string, proto: string, srcip: string, srcprt: string, dstip: string, dstprt: string, procImage: string)

Default scripts output to filesystem

fingerprint_mapping

Fingerprint_mappingsysmon/__load__.bro

@load ./fingerprint_mapping

sysmon/fingerprint_mapping/__load__.bro@load ./trackNewPid.bro@load ./trackNewConns.bro@load ./mapJA3_Proc.bro#@load ./mapHASSH.bro

Bro-Sysmon

Bro-SysmonSysmon-Broker.py Bro

| |

| ------ Establish Peering ------> |

| <----- Establish Peering ------- |

| <----- Subscirbe /sysmon ------- |

| |

Receive Sysmon JSON --> | |

| |

| -- Parse JSON |

| -- Build Event |

| ------ Publish to /sysmon ------> |

| | --> Bro Scipt to Log

| |

| | --> Bro Script Build Map JA3 to Application

Bro-Sysmon

ProblemsRace conditions of event typesDistributed environmentsEats up your memory in large deployments

But wait, there’s more

Install WinLogBeat & Configure

Winlogbeat.event_logs:

- name: Application

- name: Security

- name: System

- name: Microsoft-Windows-Sysmon/Operational

output.logstash:

# The Logstash hosts

hosts: ["192.168.200.1:9000"]

WinLogBeats

Current handler message = broker.bro.Event( 'WindowsEvent', str(winevt.get('computer_name')), str(winevt.get('log_name')), int(winevt.get('event_id')), str(winevt.get('opcode')), str(winevt.get('task', 'None')), str(winevt.get('message', 'None')), str(winevt.get('event_data', 'None')), )

WinLogBeats

Current Bro Event event WindowsEvent(computerName: string,

log_name: string, event_id: int, task: string, opcode: string, message: string, event_data: string)

TODO: Extend to handle in more detail.

WinLogBeats

Demo or it didn’t happen

Accurately Map JA3 to Client Application

for YOUR environment



"""search index=Bro_SSL DestinationPort=443 JA3!=null JA3Ciphers!=null ConnectionEstablished=true



search index=lots-o-logs sourcetype=OSQuery LogType=procs_on_internet Outcome=added

SourcePort!=0 DestinationAddr!=0 IPSource!=0 DestinationPort=443 Protocol=6

ClientApplication!=null



| join SourcePort, DestinationPort, SourceAddr, DestinationAddr max=1 type=inner

[

search index=lots-o-logs sourcetype=OSQuery LogType=procs_on_internet Outcome=added

SourcePort!=0 DestinationAddr!=0 IPSource!=0 DestinationPort=443 Protocol=6

ClientApplication!=null

| fields IPSource,SourcePort,DestionationAddr,DestinationPort,ClientApplication

]

| fields JA3, JA3Ciphers, ClientApplication

| stats values(ClientApplication) by JA3"""

https://github.com/salesforce/bro-sysmonhttps://github.com/salesforce/ja3

https://github.com/salesforce/hassh

Jeff Atkinsonneslogf<at>gmail<dot>com@4a7361in/anNh

Date post:	04-Sep-2020
Category:	Documents
Upload:	others
View:	26 times
Download:	0 times

Zeek European Workshop 2019 Zeek your Windowz! · 2019. 5. 3. · Default Metasploit SSL Cert in...

Documents