Analyzing 2019-06-17-password-protected-Word-doc-causes-Dridex-infection.pcap using so-import-pcap

Brad Duncan has another great writeup over on the SANS Internet Storm Center today!  Let's download Brad's pcap and then analyze it using so-import-pcap!

sudo so-import-pcap ~/Downloads/2019-06-17-password-protected-Word-doc-causes-Dridex-infection.pcap

As soon as so-import-pcap completes, we can log into Squert and Kibana to review NIDS alerts and Bro logs.  The first two screenshots are from Squert and are thus NIDS alerts only.  We then pivot to Kibana where we see not only NIDS alerts but also Bro logs.

Squert Views Tab (NIDS Alerts)

Squert Summary Tab (NIDS Alerts)

Kibana Overview Dashboard showing NIDS Alerts and Bro logs

Bro Notices Dashboard showing Invalid SSL certificates

SSL Dashboard showing details of those SSL certs

If we filter the Connections Dashboard for dst port 443 and NOT ssl, we find some interesting connections

Here is the detail for those interesting connections

And if we pivot to full packet capture, we can see the full TCP stream for one of those connections

Analyzing 2019-06-17-Rig-EK-sends-AZORult-and-follow-up-malware.pcap using so-import-pcap

Brad Duncan has a great writeup over on the SANS Internet Storm Center today.  Let's download Brad's pcap and then analyze it using so-import-pcap!

sudo so-import-pcap ~/Downloads/2019-06-17-Rig-EK-sends-AZORult-and-follow-up-malware.pcap

As soon as so-import-pcap completes, we can log into Squert and Kibana to review NIDS alerts and Bro logs.  The first three screenshots are from Squert and are thus NIDS alerts only.  We then pivot to Kibana where we see not only NIDS alerts but also Bro logs.

Squert Views Tab (NIDS Alerts)

Squert Summary Tab (NIDS Alerts)

Squert NIDS Alerts

Kibana Overview Dashboard

Kibana NIDS Dashboard

Kibana Notices Dashboard

Kibana HTTP Dashboard

Pivot to full packet capture to see the full EXE

securityonion-samples-mta - 20190514-1ubuntu1securityonion1 now available for Security Onion!

securityonion-samples-mta - 20190514-1ubuntu1securityonion1 is now available.  This is simply a rebuild of the previous package with no additional changes:
https://blog.securityonion.net/2019/05/securityonion-samples-mta-20150103.html

Please note that these samples contain network traffic from real malware and so they may get flagged by content inspection devices.  If your Security Onion box(es) go through a firewall, proxy, or other network security device that does content inspection, you may need to add an exception for ppa.launchpad.net.

Thanks
Thanks to Brad Duncan for the PCAPs he posts at https://www.malware-traffic-analysis.net/!
Thanks to Davide Pistore and Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Conference
Please mark your calendar! Security Onion Conference 2019 will be on Friday, October 4, 2019 and registration will open July 18! CFP is open now and we want to hear from you!
https://blog.securityonion.net/2019/04/security-onion-conference-2019-cfp.html

Training
We have 4-day Security Onion Training classes coming up in Costa Mesa CA and Columbia MD!  Use promotional code earlybird for 10% off the Columbia MD classes for a limited time.  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

securityonion-samples-mta - 20150103-0ubuntu0securityonion3 now available for Security Onion 16.04!

securityonion-samples-mta - 20150103-0ubuntu0securityonion3 is now available for Security Onion 16.04 and should resolve the following issues:

securityonion-samples-mta: Add 2018 samples #1279
https://github.com/Security-Onion-Solutions/security-onion/issues/1279

Thanks
Thanks to Brad Duncan for providing the pcap samples!
Thanks to David Szili and Wes Lambert for testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!