ZeekWeek 2022 - Zeek for Endpoint: Detection and Device Discovery - Boaz Wasserman
Channel: Zeek
Date: 2022-11-03

By Boaz Wasserman, Senior Security Researcher, Microsoft

At Microsoft, we have created a modified version of Zeek that can run natively on Windows machines, both workstations and servers. Developing this modified version has allowed us to unlock critical capabilities for network based malicious activity detections as well as network based device discovery.

Zeek was chosen out of several different possibilities thanks to it being robust, easily extendible, and has a lot of milage and community content. Zeek on Windows can easily be deployed automatically   on a large number of machines without needing to change any network configuration. This attribute provides visibility into intrasubnet communication as well as avoiding the need to deploy a centralized network tap which requires additional hardware, configuration, and maintenance. Zeek provides great value by itself thanks to the session-aware telemetry, which is a significant upgrade to single packet telemetry when it comes to device discovery and detection.

Moreover, the preexisting community content gave Zeek a huge benefit as there are many dissectors and scripts that we could start using from day one.

In this talk, we are going to present how we leveraged the ability to run Zeek on most Windows endpoints in an organization, to significantly improve the device discovery and detection value we get from network based telemetry. Using already available protocol dissectors, we were able to quickly integrate NTLM, FTP and SSH traffic processing, and perform passive device discovery on top of it. Moreover, we will present our usage of both community-based detection scripts (for example, PrintNightmare) as well as proprietary detection logics based on raw telemetry. We will present the Zeek scripts modifications we have made to make sure they suit our needs of providing telemetry that can be used for device discovery as well as detection. We will also give a few examples on detection and device discovery logics that could be implemented over the modified telemetry. 

Speaker Bio: Boaz brings over 9 years of experience in cyber security research, cyber operations, and incident response. Before joining Microsoft, Boaz served as a lieutenant in Unit 8200, the IDF’s cyber and intelligence unit, and led a team of cyber research and analytics experts for some of the IDF’s most groundbreaking intelligence projects. Following his discharge from the army, Boaz spent over two years “in the trenches” leading high-profile incident response engagements. At Microsoft, he develops detections for the Microsoft Defender for Endpoint (MDE) Network Detection and Response (NDR) component as well as IoT and endpoint device discovery and classification mechanisms.