Threat hunting with Zeek logs
In large Zeek log archives you track activity with stack counting, rarity and correlation, and turn your hunts into repeatable queries.
Level 401 · 13 lessons · 12 practice labs
Lessons
Hunting techniques
- Stack counting: the least frequent values
- Rare user agents and HTTP header order
- Failed and half-open connections with conn_state and history
- Short task: find a user agent used by only one host on the network
Correlating logs
- Matching DNS answers to later connections: connections with no name
- Going from file hashes to affected hosts
- Hunting suspicious certificates in ssl and x509 logs
- Network software inventory and outdated versions with software.log
- Short task: list outbound connections made straight to IP addresses
Scaling up
- Querying weeks of logs quickly: compression, partitioning, parallelism
- The hunting notebook: documenting queries, results and decisions
- Turning a hunt into a permanent Zeek script and notice
- Capstone: find an unnoticed intrusion in a month of Zeek logs
Practice labs
- The least seen user agents: List the ten least seen user agents in http.log by stack counting.
- The user agent used by a single host: Find the user agent only one host on the network uses and extract the addresses it reached.
- Reconnaissance traces from half connections: Stack failed connections from the conn_state and history fields and single out the host doing reconnaissance.
- Outbound connections straight to an IP: List outbound connections with no preceding DNS query.
- From a file hash to the affected hosts: Find a given file hash in files.log and derive every host that received the file through conn.log.
- Match a DNS answer to the following connection: Match dns.log answers with later connections to give every outbound connection a domain and report those that do not match.
- Old versions in software.log: List the software seen on the network with versions and mark the unsupported ones.
- A hunt for suspicious certificates: Find self-signed, very short-lived or name-mismatched certificates in the ssl and x509 logs.
- Query weeks of logs quickly: Split a four-week compressed archive by date, query it in parallel and compare against the time of a single query.
- Make an entry in the hunt notebook: Write a hunt's query, result and decision into the notebook in a repeatable form.
- Turn the hunt into a Zeek script: Turn the direct-to-IP hunt into a lasting script raising a notice and test it with a capture.
- The unnoticed intrusion in a month of archive: Expose the unnoticed intrusion in a month of prepared Ilgıntepe Tekstil Zeek archive with three independent pieces of evidence.
About this course
In large Zeek log archives you track activity with stack counting, rarity and correlation, and turn your hunts into repeatable queries.
What you will learn
- Hunting techniques
- Correlating logs
- Scaling up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.