Using Bro to Hunt Persistent Threats by Benjamin Klimkowski
Channel: Zeek
Date: 29/09/2017

Originally recorded September 13, 2017

In this presentation, we demonstrate how Bro can be used to successfully detect malicious traffic from compromised machines to a remote command and control (C2) server. Specifically, our team focused on detecting Cobalt Strike, a popular penetration tool. Cobalt Strike possesses a sophisticated callback mechanism that uses common protocols to beacon back to a remote C2 server and fetch instructions. From the remote server, attackers can send C2 instructions to processes running on the compromised hosts. This stored-and-forward architecture is designed to avoid detection, blending in with ordinary traffic. Our team will present how we used Bro and other tools to discover indications of compromise (IOCs) from past datasets, and then used this insight to develop Bro scripts that detected those IOCs on a live network. Our techniques were evaluated during the 2017 Cyber Defense Exercise, where undergraduates compete against the Nation Security Agency (NSA) Red Team. Additionally, we will provide observations how Bro performed as part of a greater security architecture, which included the Snort Intrusion Detection System and an implementation of an Elasticsearch, Logstash, Kibana monitoring suite.

Slides: https://www.bro.org/brocon2017/slides/persistent_threats.pdf