Blue | Detect - Visibility

Network Monitoring

TCPDump

# View ASCII (-A) or HEX (-X) traffic
tcpdump -A
tcpdump -X

# View traffic with timestamps and 
# don't convert addresses and be verbose
tcpdump -tttt -n -vv

# Find top talkers after 1000 packets
# Potential DDoS
tcpdump -nn -c 1000 | awk '{print $3}' | cut -d. -f1-4 | sort -n | uniq -c | sort -nr

# Capture traffic on any interface from a target host
# and specific port and output to a file
tcpdump -w <FILENAME>.pcap -i any dst <TARGET IP ADDRESS> and port 80

# View traffic only between two hosts
tcpdump host 10.0.0.1 && host 10.0.0.2

# View all traffic except from a net or a host
tcpdump not net 10.10 && not host 192.168.1,2

# View host and either of two other hosts
tcpdump host 10.10.10.10 && \(10,10.10.20 or 10.10.10.30\)

# Save pcap file on rotating size
tcpdump -n -s65535 -c 1000 -w '%host_%Y-%m%d_%H:%M:%S.pcap'

# Save pcap file to a remote host
tcpdump -w - | ssh <REMOTE HOST ADDRESS> -p 50005 "cat - > /tmp/remotecapture.pcap"

# Grab traffic that contains the word pass
tcpdump -n -A -s0 | grep pass

# Grab many clear text protocol passwords
tcpdump -n -A -s0 port http or port ftp or port smtp or port imap or port pop3 | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20

# Get throughput
tcpdump -w - lpv -bert >/dev/null

# Filter out ipv6 traffic
tcpdump not ip6

# Filer out ipv4 traffic
tcpdump ip6

# Script to capture multiple interface 
# tcpdumps to files rotating every hour

#!/bin/bash
tcpdump -pni any -s65535 -G 3600 -w any%Y-%m%d_%H:%M:%S.pcap

# Script to move multiple tcpdump files to alternate location

#!/bin/bash
while true; do
    sleep 1;
    rsync -azvr -progress <USER NAME>@<IP ADDRESS>:<TRAFFIC DIRECTORY>/. <DESTINATION DIRECTORY/.
done

# Look for suspicious and self-signed SSL certificates
tcpdump -s 1500 -A '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01) and (tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)'

# Get SSL Certificate
openssl s_client -connect <URL>:443
openssl s_client -connect <SITE>:443 </dev/null 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <CERT>.pem

# Examine and verify the certificate and check for Self-Signed
openssl x509 -text -in <CERT>.pem
openssl x509 -in <CERT>.pem -noout -issuer -subject -startdate -enddate -fingerprint
openssl verify <CERT>.pem

# Extract Certificate Server Name
tshark -nr <PCAP FILE NAME> -Y "ssl.handshake.ciphersuites" -Vx | grep "ServerName:" | sort | uniq -c | sort -r

# Extract Certificate info for analysis
ssldump -Nr <FILE NAME>.pcap | awk 'BEGIN {c=0;} { if ($0 ~ /^[ ]+Certificate$/) {c=1; print "========================================";} if ($0 !~ /^ +/ ) {c=0;} if (c==1) print $0; }'

Tshark

# Get list of network interfaces
tshark -D

# Listen on multiple network interfaces
tshark -i ethl -i eth2 -i eth3

# Save to pcap and disable name resolution
```bash
tshark -nn -w <FILE NAME>.pcap

# Get absolute date and time stamp
tshark -t a

# Get arp or icmp traffic
tshark arp or icmp

# Capture traffic between to [hosts] and/or [nets]
tshark "host <HOST 1> && host <HOST 2>"
tshark -n "net <NET 1> && net <NET 2>"

# Filter just host and IPs (or not your IP)
tshark -r <FILE NAME>.pcap -q -z hosts,ipv4
tshark not host <YOUR IP ADDRESS>

# Not ARP and not UDP
tshark not arp and not (udp.port == 53)

# Replay a pcap file
tshark -r <FILE NAME>.pcap

# Replay a pcap and just grab hosts and IPs
tshark -r <FILE NAME>.pcap -q -z hosts

# Setup a capture session(duration=60sec)
tshark -n -a files:10 -a filesize:100 -a duration:60 -w <FILE NAME>.pcap

# Grab src/dst IPs only
tshark -n -e ip.src -e ip.dst -T fields -E separator=, -R ip

# Grab IP of src DNS and DNS query
tshark -n -e ip.src -e dns.qry.name -E separator=';' -T fields port 53

# Grab HTTP URL host and request
tshark -R http.request -T fields -E separator=';' -e http.host -e http.request.uri

# Grab just HTTP host requests
tshark -n -R http.request -T fields -e http.host

# Grab top talkers by IP dst
tshark -n -c 150 | awk '{print $4}' | sort -n | uniq -c | sort -nr

# Grab top stats of protocols
tshark -q -z io,phs -r <FILE NAME>.pcap

tshark -r <PCAP FILE>.cap -R http.request -T fields -e http.host -e http.request.uri | sed -e 's/?.*$//' | sed -e 's#^(.*)t(.*)$#http://12#' | sort | uniq -c | sort -rn | head

tshark -n -c 100 -e ip.src -R "dns.flags.response eq 1" -T fields port 53

tshark -n -e http.request.uri -R http.request -T fields | grep exe

tshark -n -c 1000 -e http.host -R http.request -T fields port 80 | sort | uniq -c | sort -r

Snort

# Run test on snort config file
snort -T -c /<PATH TO SNORT>/snort/snort.conf

# Use snort(v=verbose,d=dump packet payload)
snort -dv -r <LOG FILE NAME>.log

# Replay a log file and match icmp traffic
snort -dvr packet.log icmp

# Logs in ASCII
snort -K ascii -l <LOG DIRECTORY>

# Logs in binary
snort -l <LOG DIRECTORY>

# Sent events to console
snort -q -A console -i eth0 -c /etc/snort/snort.conf
snort -c snort.conf -l /tmp/so/console -A console

# Create a single snort rule and save
echo alert any any <SNORT RULE> > one.rule

# Test single rule
snort -T -c one.rule

# Run single rule and output to console and logs dir
mkdir ./logs
snort -vd -c one.rule -r <PCAP FILE NAME>.pcap -A console -l logs

Network Capture (PCAP) Tools

EditCap

# Use to edit a pcap file (split into 1000 packets)
editcap -F pcap -c 1000 orignal.pcap out_split.pcap

# Use to edit a pcap file (split into 1 hour each packets)
editcap -F pcap -t+3600 orignal.pcap out_split.pcap

MergeCap

# Use to merge multiple pcap files
mergecap -w merged_cap.pcap cap1.pcap cap2.pcap cap3.pcap

Honey Techniques

Windows

Honey Ports Windows:

Reference guide from SecurityWeekly.

Create new TCP firewall block rule on anything connecting on port 3333.

echo @echo off for /L %%i in (1,1,1) do @for /f "tokens=3" %%j in ('netstat -nao ^| find ^":3333^"') do@for /f "tokens=1 delims=:" %%k in ("%%j") do netsh advfirewall firewall add rulename="HONEY TOKEN RULE" dir=in remoteip=%%k localport=any protocol=TCP action=block >> <BATCH FILE NAME>.bat

Run batch script: <BATCH FILE NAME>.bat

Windows honey ports PowerShell script

Reference guide from Pwdrkeg.

Download PowerShell script:

"%ProgramFiles%\Internet Explorer\iexplore.exe" https://github.com/Pwdrkeg/honeyport/blob/master/honeyport.ps1

Run PowerShell script: honeyport.ps1

Honey hashes for Windows – Also for detecting Mimikatz use

Reference guide from SANS.

Create fake honey hash. Note enter a fake password and keep command prompts open to keep password in memory:

runas /user:yourdomain.com\fakeadministratoraccount /netonly cmd.exe

Query for remote access attempts:

wevtutil qe System /q:"*[System[(EventID=20274)]]" /f:text /rd:true /c:1 /r:remotecomputername

Query for failed login attempts:

wevtutil qe Security /q:"*[System[(EventID=4624 or EventID=4625)]]" /f:text /rd:true /c:5 /r:remotecomputername

(Optional) Run queries in infinite loop with 30s pause:

for /L %i in (1,0,2) do (Insert Step 2) & (Insert Step 3) & timeout 30

Linux

Honey ports Linux

Reference guide from SecurityWeekly.

Run a while loop to create TCP firewall rules to block any hosts connecting on port 2222:

while [ 1 ] ; echo "started" ; do IP=`nc -v -l -p 2222 2>&1 1> /dev/null | grep from | cut -d[ -f 3 | cut -d] -f 1´; iptables -A INPUT -p tcp -s ${IP} -j DROP ; done

Linux honey ports Python script

Reference guide form GCHetrick.

Download Python script:

wget https://github.com/gchetrick/honeyports/blob/master/honeyports-0.5.py

Run Python script:

python honeyports-0.5.py -p <CHOOSE AN OPEN PORT> -h <HOST IP ADDRESS>

Detect rogue scanning with Labrea Tarpit:

apt-get install labrea
labrea -z -s -o -b -v -i eth0 2>&1| tee -a log.txt

Netcat

# Use netcat to listen for scanning threats
nc -v -k -l 80
nc -v -k -l 443
nc -v -k -l 3389

Passive DNS monitoring

# Use dnstop to monitor DNS requests at any sniffer location
apt-get update
apt-get install dnstop
dnstop -l 3 <INTERFACE NAME>

# Step 1 -- Hit 2 key to show query names


# Use dnstop to monitor DNS requests from a pcap file
dnstop -l 3 <PCAP FILE NAME> | <OUTPUT FILE NAME>.txt

Log Auditing

Windows

:: Increase Log size to support increased auditing
reg add HKLM\Software\Policies\Microsoft\Windows\Eventlog\Application /v MaxSize /t REG_DWORD /d 0x19000
reg add HKLM\Software\Policies\Microsoft\Windows\Eventlog\Security /v MaxSize /t REG_DWORD /d 0x64000
reg add HKLM\Software\Policies\Microsoft\Windows\EventLog\System /v MaxSize /t REG_DWORD /d 0x19000

:: Check settings of Security log
wevtutil gl Security

:: Check settings of audit policies
auditpol /get /category:*

:: Set Log Auditing on for Success and/or Failure on All Categories
auditpol /set /category:* /success:enable /failure:enable

:: Set Log Auditing on for Success and/or Failure on Subcategories
auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable
auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable
auditpol /set /subcategory:"Other System Events" /success:enable /failure:enable
auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
auditpol /set /subcategory:"Registry" /success:enable /failure:enable
auditpol /set /subcategory:"SAM" /success:enable /failure:enable
auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable
auditpol /set /subcategory:"Handle Manipulation" /success:enable /failure:enable
auditpol /set /subcategory:"File Share" /success:enable /failure:enable
auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable
auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable
auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable
auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable
auditpol /set /subcategory:"Sensitive Privilege Use" /success:enable /failure:enable
auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:enable /failure:enable
auditpol /set /subcategory:"Other Privilege Use Events" /success:enable /failure:enable
auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable
auditpol /set /subcategory:"DPAPI Activity" /success:enable /failure:enable
auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"Authorization Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"Filtering Platform Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"Other Policy Change Events" /success:enable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Replication" /success:enable /failure:enable
auditpol /set /subcategory:"Detailed Directory Service Replication" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
auditpol /set /subcategory:"Other Account Logan Events" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable

PowerShell commands:

# Check for list of available logs, size, retention limit
Get-Eventlog -list

# Partial list of Key Security Log Auditing events to monitor
Get-Eventlog -newest 5 -logname application | Format-List

# Show log from remote system
Show-Eventlog -computername <SERVER NAME>

# Get a specific list of events based on Event ID
Get-Eventlog Security | ? { $_.Eventid -eq 4800}
Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4774}

# Account Logon - Audit Credential Validation Last 14 Days
Get-Eventlog Security 4768,4771,4772,4769,4770,4649,4778,4779,4800,4801,4802,4803,5378,5632,5633 -after ((get-date).addDays(-14))

# Account - Logon/Logoff
Get-Eventlog Security 4625,4634,4647,4624,4625,4648,4675,6272,6273,6274,6275,6276,6277,6278,6279,6280,4649,4778,4779,4800,4801,4802,4803,5378,5632,5633,4964 -after ((get-date).addDays(-1))

# Account Management - Audit Application Group Management
Get-Eventlog Security 4783,4784,4785,4786,4787,4788,4789,4790,4741,4742,4743,4744,4745,4746,4747,4748,4749,4750,4751,4752,4753,4759,4760,4761,4762,4782,4793,4727,4728,4729,4730,4731,4732,4733,4734,4735,4737,4754,4755,4756,4757,4758,4764,4720,4722,4723,4724,4725,4726,4738,4740,4765,4766,4767,4780,4781,4794,5376,5377 -after ((get-date).addDays(-1))

# Detailed Tracking - Audit DPAPI Activity, Process Termination, RPC Events
Get-EventLog Security 4692,4693,4694,4695,4689,5712 -after ((get-date).addDays(-1))

# Domain Service Access - Audit Directory Service Access
Get-EventLog Security 4662,5136,5137,5138,5139,5141 -after ((get-date).addDays(-1))

# Object Access - Audit File Share, File System, SAM, Registry, Certifications
Get-EventLog Security 4671,4691,4698,4699,4700,4701,4702,5148,5149,5888,5889,5890,4657,5039,4659,4660,4661,4663,4656,4658,4690,4874,4875,4880,4881,4882,4884,4885,4888,4890,4891,4892,4895,4896,4898,5145,5140,5142,5143,5144,5168,5140,5142,5143,5144,5168,5140,5142,5143,5144,5168,4664,4985,5152,5153,5031,5140,5150,5151,5154,5155,5156,5157,5158,5159 -after ((get-date).addDays(-1))

# Policy Change - Audit Policy Change, Microsoft Protection Service, Windows Filtering Platform
Get-EventLog Security 4715,4719,4817,4902,4904,4905,4906,4907,4908,4912,4713,4716,4717,4718,4739,4864,4865,4866,4867,4704,4705,4706,4707,4714,4944,4945,4946,4947,4948,4949,4950,4951,4952,4953,4954,4956,4957,4958,5046,5047,5048,5449,5450,4670 -after ((get-date).addDays(-1))

# Privilege Use - Audit Non-Sensitive/Sensitive Privilege Use
Get-EventLog Security 4672,4673,4674 -after ((get-date).addDays(-1))

# System - Audit Security State Change, Security System Extension, System Integrity, System Events
Get-Eventlog Security 5024,5025,5027,5028,5029,5030,5032,5033,5034,5035,5037,5058,5059,6400,6401,6402,6403,6404,6405,6406,6407,4608,4609 ,4616, 4621, 4610, 4611, 4614,4622,4697,4612,4615,4618,4816,5038,5056,5057,5060,5061,5062,6281 -after ((get-date).addDays(-1))

# Add Microsoft IIS cmdlet
add-pssnapin WebAdministration
Import-Module WebAdministration

# Get IIS Website info
Get-IISSite

# Get IIS Log Path Location
(Get-WebConfigurationProperty '/system.applicationHost/sites/siteDefaults' -Name 'logfile.directory').Value

# Set variable for IIS Log Path (default path)
$LogDirPath = "C:\inetpub\logs\LogFiles\W3SVCl"

# Get IIS HTTP log file list from Last 7 days
Get-ChildItem -Path C:\inetpub\logs\LogFiles\w3svcl -recurse | Where Object {$_.lastwritetime -lt (get-date).addDays(-7)}

# View IIS Logs (Using $LogDirPath variable set above)
Get-Content $LogDirPath\*.log |%{$_ -replace '#Fields: ', ''} |?{$_ -notmatch '^#'} | ConvertFrom-Csv -Delimiter ' '

# View IIS Logs
Get-Content <IIS LOG FILE NAME>.log |%{$_ -replace '#Fields: ', ''} |?{$_ -notmatch '^#'} | ConvertFrom-Csv -Delimiter ' '

# Find in IIS logs IP address 192.168.*·* pattern
Select-String -Path $LogDirPath\*.log -Pattern '192.168.*.*'

# Find in IIS logs common SQL injection patterns
Select-String -Path $LogDirPath\*.log '(@@version)|(sqlmap)|(Connect\(\))|(cast\()|(char\()|(bchar\()|(sys databases)|(\(select)|(convert\()|(Connect\()|(count\()|(sys objects)'

Linux

# Authentication logs in Ubuntu
tail /var/log/auth.log
grep -i "fail" /var/log/auth.log

# User login logs in Ubuntu
tail /var/

# Look at samba activity
grep -i samba /var/log/syslog

# Look at cron activity
grep -i cron /var/log/syslog

# Look at sudo activity
grep -i sudo /var/log/auth.log

# Look in Apache Logs for 404 errors
grep 404 <LOG FILE NAME> | grep -v -E "favicon.ico|robots.txt"

# Look at Apache Logs for files requested
head access_log | awk '{print $7}'

# Monitor for new created files every 5min
watch -n 300 -d ls -lR /<WEB DIRECTORY>

# Look where traffic is coming from
cat <LOG FILE NAME> | fgrep -v <YOUR DOMAIN> | cut -d\" -f4 | grep -v ^-

# Monitor for TCP connections every 5 seconds
netstat -ac 5 | grep tcp

# Install audit framework and review syscalls/events
apt-get install auditd
auditctl -a exit,always -S execve
ausearch -m execve

# Get audit report summary
aureport

Network Monitoring#

TCPDump#

Tshark#

Snort#

Network Capture (PCAP) Tools#

EditCap#

MergeCap#

Honey Techniques#

Windows#

Linux#

Netcat#

Passive DNS monitoring#

Log Auditing#

Windows#

Linux#

Network Monitoring

TCPDump

Tshark

Snort

Network Capture (PCAP) Tools

EditCap

MergeCap

Honey Techniques

Windows

Linux

Netcat

Passive DNS monitoring

Log Auditing

Windows

Linux