Search
Searching, Filtering, and Correlation: Threat Hunting with Brim
4 min read

Searching, Filtering, and Correlation: Threat Hunting with Brim

Raúl Vázquez González's Picture
Raúl Vázquez González in brim threat-hunting network-analysis tryhackme

Searching, Filtering, and Correlation: Threat Hunting with Brim

Using Brim capabilities to identify malicious activities

Introduction

Threat hunting is a crucial component of cybersecurity, helping professionals detect, investigate, and mitigate advanced persistent threats (APTs) within networks. In this write-up, we explore how Brim, a tool designed for network traffic analysis, can be leveraged to investigate various security incidents. By walking through several tasks in the TryHackMe Brim Room, we demonstrate how Brim’s powerful searching, filtering, and correlation capabilities can aid in identifying malicious activities, such as CobaltStrike malware infections and crypto mining operations.

TASK 3: The Basics

  • Question 1: Process the “sample.pcap” file and look at the details of the first DNS log that appears on the dashboard. What is the “qclass_name”?

1_d6-aHchi-zhTgaf3SW-yPA.png

Answer: C_INTERNET

  • Question 2: Look at the details of the first NTP log that appears on the dashboard. What is the “duration” value?

1_glwFCnNFEdNk1QU9whCIHQ.png

Answer: 0.005

  • Question 3: Look at the details of the STATS packet log visible on the dashboard. What is the “reassem_tcp_size”?

1_g7-GK--fiH1gnBLSYDvzvQ.png

Answer: 540

TASK 4: Default Queries

  • Question 4: Investigate the files. What is the name of the detected GIF file?

I opened the file located in /home/ubuntu/Desktop/Exercise-Files/task4-sample-b.pcap, then I went to Queries > File Activity.

1_p1CJ0lCpTCJXMsI7jyJ2_Q.png

Answer: cat01_with_hidden_text.gif

  • Question 5: Investigate the conn logfile. What is the number of identified city names?

In the general view, I investigated a conn connection to check the naming corresponding to the city data field. Then, I created a query searching for connections and showing only the city fields with contents:

_path=="conn" | cut geo.resp.city | !geo.resp.city==""

1_Wfnoe4q09en5fQaLiKW6yw.png

Answer: 2

  • Question 6: Investigate the Suricata alerts. What is the signature ID of the alert category “Potential Corporate Privacy Violation”?

In the general view, I investigated a Suricata alert (named “alert”) to check the naming corresponding to the signature ID and the category (to identify the requested one). Then, I created a query searching for alerts and showing only those fields:

event_type=="alert" | cut alert.category, alert.signature_id

1_vA0QpzTBUylZ1j_DdDJGPA.png

Answer: 2,012,887

TASK 6: Exercise — Threat Hunting with Brim | Malware C2 Detection

  • Question 7: What is the name of the file downloaded from the CobaltStrike C2 connection?

1_MpDJiz1m_QTeP_BRotdaHA.png

Answer: 4564.exe

  • Question 8: What is the number of CobaltStrike connections using port 443?

Using a query that filters by responding port 443 and responding IP 104.168.44.45 (identified as CobaltStrike’s), counting unique coincidences and sorting by number, I got the amount of connections done by CobaltStrike using that port.

_path=="conn" | cut id.resp_p, id.resp_h | id.resp_p==443 id.resp_h==104.168.44.45 | sort | uniq -c | sort -r count

1_jLd34wBtflFp6soc_dIaPA.png

Answer: 328

  • Question 9: There is an additional C2 channel in use in the given case. What is the name of the secondary C2 channel?

I went back to the query searching for HTTP activity using:

_path=="http" | cut id.orig_h, id.resp_h, id.resp_p, method, host, uri | uniq -c | sort value.id.resp_p

I found another suspicious domain called olerantand.top. After checking it against VirusTotal, it seemed to be malicious, and in the Relations tab, it displayed two of the IPs included in the results query. In addition, one of the referring files indicated the name of the secondary C2 channel: IcedID. This name was also found in a comment in the community tab.

1_DSIh8mOjW1Gs59Xb-6dcKA.png

1_YYaK3AopLBV1vWonBjQ9fQ.png

1_U_CacRTGZq97l90cE_L9jA.png

Answer: IcedID

TASK 7: Exercise — Threat Hunting with Brim | Crypto Mining

  • Question 10: How many connections used port 19999?
_path=="conn" | cut id.resp_p, service | id.resp_p==19999 | sort | uniq -c | sort -r count

1_GYKJ4XR6JkvD7pv-RkSENA.png

Answer: 22

  • Question 11: What is the name of the service used by port 6666?

1_nskMZXza9cF_uTSm-IBM4w.png

Answer: irc

  • Question 12: What is the amount of total bytes transferred to “101.201.172.235:8888”?
_path=="conn" | put total_bytes := orig_bytes + resp_bytes | id.resp_p==8888 AND id.resp_h==101.201.172.235 | sort -r total_bytes | cut uid, id, total_bytes

1_KUcSGnDMEIucyRjeMfHZ2A.png

Answer: 3,729

  • Question 13: What is the detected MITRE tactic ID?
event_type=="alert" | cut alert.category, alert.metadata.mitre_technique_name, alert.metadata.mitre_tactic_id, alert.metadata.mitre_tactic_name | sort | uniq -c | sort value.alert.metadata.mitre_technique_name

1_tU1FGPAKpWIQMfmiwabfdg.png

Answer: TA0040

Conclusion

In this article, we’ve seen how Brim can streamline the process of threat hunting through efficient data analysis and query-based investigations. From identifying DNS queries and Suricata alerts to detecting malware communication channels and cryptojacking activities, Brim provides security analysts with the tools needed to respond quickly to potential threats.

You may also like

SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
7 min read

SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion

A Complete Write-Up Demonstrating Real SOC Investigation Methodology

Raúl Vázquez González's Picture
Raúl Vázquez González in soc soc-analyst mitre-attck blue-team incident-response threat-hunting splunk
SOC Alert: Conti Ransomware Investigation
16 min read

SOC Alert: Conti Ransomware Investigation

Simulating Real-World SOC Triage, Threat Hunting, and Incident Reporting Through a Conti Ransomware Investigation

Raúl Vázquez González's Picture
Raúl Vázquez González in soc splunk ransomware incident-response threat-hunting
Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
11 min read

Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night

Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration

Raúl Vázquez González's Picture
Raúl Vázquez González in ransomware threat-hunting splunk tryhackme aws

Latest Posts

Building a Tier 1 SOC Dashboard in Splunk
9 min read

Building a Tier 1 SOC Dashboard in Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
7 min read

Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González

Explore Tags

active-directory allowlist aws azure-security blue-team bluetooth books brim btlo certification certifications chmod cloud-security compliance cyber-security-awareness cyberchef cybercrime cybersecurity cybersecurity-lab dashboards data-filtering data-protection ddos detection-engineering dfir dfir tryhackme digital-forensics elastic elastic-search elastic-stack elk ez-tools file-permissions firewall homelab incident-response infosec intrusion-detection kerberos linux-hardening linux-security log-analysis malware-analysis mitm mitre mitre-attck network-analysis network-forensics network-security networking networkminer nmap opencti osint packet-analysis pcap-analysis phishing powershell programming python ransomware regex security-audit siem snort soc soc-analyst soc-lab spl splunk sql sysmon threat-detection threat-hunting threat-intelligence tryhackme ufw virustotal volatility web-security windows-forensics wireshark xdr