ShulkwiSEC Zeek conn.log Analysis
When to Use
- During network forensics investigations or active threat hunting to identify compromised hosts communicating with Command and Control (C2) infrastructure.
- To detect unusual network baseline deviations without relying entirely on deep packet inspection or payload signatures.
Prerequisites
- Forensic image or live access to the affected system(s)
- Forensic workstation with analysis tools (Autopsy, Volatility, Timeline Explorer)
- Chain of custody documentation initiated for evidence handling
- Write-blocker for disk forensics or memory acquisition tool (e.g., DumpIt, WinPmem)
Workflow
Phase 1: Understanding conn.log Structure
# head conn.log | zeek-cut -c ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state
Phase 2: Hunting for C2 Beaconing (Frequency Analysis)
# cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration | \
awk '{print $1, $2, $3}' | sort | uniq -c | sort -nr | head -n 20
Phase 3: Identifying Long-Connections (Data Exfil / Interactive Shells)
# cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes | \
awk '$4 > 3600 {print $0}' | sort -nrk 4
Phase 4: Detecting Odd Port-Service Mismatches
# cat conn.log | zeek-cut id.resp_p service | grep -E '^443\s+http$' | less
# cat conn.log | zeek-cut id.resp_p service | grep -E '^80\s+ssl$' | less
Decision Point 🔀
flowchart TD
A[Parse conn.log ] --> B{Anomalies Found ]}
B -->|Yes| C[Correlate Logs ]
B -->|No| D[Tune Heuristics ]
C --> E[Isolate Host ]
🔵 Blue Team Detection & Defense
- Automate Beacon Tracking (RITA / Zeek Detect): Threat Intelligence Feeds: Baseline Internal Traffic: Key Concepts
Concept Description
Output Format
Zeek Conn Log Analysis — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]
Findings Summary:
[Finding 1]: [Severity] — [Brief description]
[Finding 2]: [Severity] — [Brief description]
Detailed Results:
Phase 1: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Phase 2: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
1. [Immediate remediation step]
2. [Long-term hardening measure]
3. [Monitoring/detection improvement]
📚 Shared Resources
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
References
- Zeek Documentation: Logging Framework
- Active Countermeasures: RITA (Real Intelligence Threat Analytics)