From 28af1f5a2e4fcfd68d9e528e9e49305375cf6072 Mon Sep 17 00:00:00 2001 From: "Andrew D. Pease" <7442091+peasead@users.noreply.github.com> Date: Mon, 1 Apr 2019 09:13:42 -0500 Subject: [PATCH 1/3] updated for Zeek 2.6.x --- implementations/bzar/bzar_dce-rpc.bro | 3 +-- implementations/bzar/bzar_smb.bro | 17 ++++++----------- 2 files changed, 7 insertions(+), 13 deletions(-) diff --git a/implementations/bzar/bzar_dce-rpc.bro b/implementations/bzar/bzar_dce-rpc.bro index 884da853..d4bdcbd4 100755 --- a/implementations/bzar/bzar_dce-rpc.bro +++ b/implementations/bzar/bzar_dce-rpc.bro @@ -220,8 +220,7 @@ export } #end export - -event dce_rpc_response(c: connection, fid: count, opnum: count, stub_len: count) &priority=3 +event dce_rpc_response(c: connection, fid: count, ctx_id: count, opnum: count, stub_len: count) &priority=3 { # priority==3 ... We want to execute before writing to dce_rpc.log # because default Bro script deletes 'c$dce_rpc' after writing to log diff --git a/implementations/bzar/bzar_smb.bro b/implementations/bzar/bzar_smb.bro index d7327142..4285b02a 100755 --- a/implementations/bzar/bzar_smb.bro +++ b/implementations/bzar/bzar_smb.bro @@ -36,7 +36,6 @@ export # overwritten in its entirety, or just a smaller sub-section is # overwritten, which would be an interesting diagnostic to detect. - redef SMB::write_cmd_log = T &redef; redef SMB::logged_file_actions += { SMB::FILE_WRITE, } &redef; redef record SMB::FileInfo += @@ -119,7 +118,7 @@ function smb_full_path_and_file_name ( s : SMB::State ) : string # SMB1 Event Handlers # -event smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: string, svc: string) &priority=3 +event smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: string, service: string) &priority=3 { # Check if SMB Tree Path is an Admin File Share @@ -135,8 +134,7 @@ event smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: str } } - -event smb1_nt_create_andx_request(c: connection, hdr: SMB1::Header, name: string) &priority=3 +event smb1_nt_create_andx_request(c: connection, hdr: SMB1::Header, file_name: string) &priority=3 { # Copied this snippet from Bro default handler: # policy/protocols/smb/smb1-main.bro#smb1_write_andx_request. @@ -248,8 +246,7 @@ event smb2_tree_connect_request(c: connection, hdr: SMB2::Header, path: string) } } - -event smb2_create_request(c: connection, hdr: SMB2::Header, name: string) &priority=3 +event smb2_create_request(c: connection, hdr: SMB2::Header, request: SMB2::CreateRequest) &priority=3 { # Copied this snippet from Bro default handler: # policy/protocols/smb/smb1-main.bro#smb1_write_andx_request. @@ -261,18 +258,16 @@ event smb2_create_request(c: connection, hdr: SMB2::Header, name: string) &prior c$smb_state$current_file$path = c$smb_state$current_tree$path; } - -event smb2_write_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, offset: count, data_len: count) &priority=3 +event smb2_write_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, offset: count, length: count) &priority=3 { # Keep track of the number of bytes in the Write Response. # priority==3 ... We want to execute before writing to smb_files.log c$smb_state$current_file$data_offset_req = offset; - c$smb_state$current_file$data_len_req = data_len; + c$smb_state$current_file$data_len_req = length; } - -event smb2_write_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, offset: count, data_len: count) &priority=-7 +event smb2_write_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, offset: count, length: count) { # NOTE: Preference would be to detect 'smb2_write_response' # event (instead of 'smb2_write_request'), because it From 58db33455861de90f195d27a68f6a6e946170c3a Mon Sep 17 00:00:00 2001 From: "Andrew D. Pease" <7442091+peasead@users.noreply.github.com> Date: Tue, 9 Apr 2019 10:31:35 -0500 Subject: [PATCH 2/3] fixed @load base/procotols/smb from @load policy/protocols/smb --- implementations/bzar/main.bro | 46 +++++++++++++++++------------------ 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/implementations/bzar/main.bro b/implementations/bzar/main.bro index 711d5c56..d24d2c1c 100755 --- a/implementations/bzar/main.bro +++ b/implementations/bzar/main.bro @@ -7,7 +7,7 @@ # Approved for public release. Distribution unlimited. Case number 18-2489. # -@load policy/protocols/smb +@load base/protocols/smb @load base/protocols/dce-rpc @load base/frameworks/files @load base/frameworks/notice @@ -57,7 +57,7 @@ export const ignore_resp_h : set[addr] = {127.0.0.1,} &redef; # Enable/Disable File Extraction - const file_extract_option = T &redef; + const file_extract_option = T &redef; } #end export @@ -67,9 +67,9 @@ event bro_init() # 1- SumStats Analytics for ATT&CK Lateral Movement and Execution # # Description: - # Use SumStats to raise a Bro/Zeek Notice event if an SMB Lateral Movement - # indicator (e.g., SMB File Write to a Windows Admin File Share: ADMIN$ or - # C$ only) is observed together with a DCE-RPC Execution indicator against + # Use SumStats to raise a Bro/Zeek Notice event if an SMB Lateral Movement + # indicator (e.g., SMB File Write to a Windows Admin File Share: ADMIN$ or + # C$ only) is observed together with a DCE-RPC Execution indicator against # the same (targeted) host, within a specified period of time. # # Relevant ATT&CK Technique(s): @@ -79,13 +79,13 @@ event bro_init() # Relevant Indicator(s) Detected by Bro/Zeek: # (a) smb1_write_andx_response::c$smb_state$path contains ADMIN$ or C$ # (b) smb2_write_request::c$smb_state$path contains ADMIN$ or C$ * - # (c) dce_rpc_response::c$dce_rpc$endpoint + c$dce_rpc$operation contains + # (c) dce_rpc_response::c$dce_rpc$endpoint + c$dce_rpc$operation contains # any of the following: (see BZAR::rpc_execution set). - # - # NOTE: Preference would be to detect 'smb2_write_response' - # event (instead of 'smb2_write_request'), because it - # would confirm the file was actually written to the - # remote destination. Unfortuantely, Bro/Zeek does + # + # NOTE: Preference would be to detect 'smb2_write_response' + # event (instead of 'smb2_write_request'), because it + # would confirm the file was actually written to the + # remote destination. Unfortuantely, Bro/Zeek does # not have an event for that SMB message-type yet. # # Globals (defined in main.bro above): @@ -106,7 +106,7 @@ event bro_init() { return result["attack_lm_ex"]$sum; }, - $threshold_crossed(key:SumStats::Key, result:SumStats::Result) = + $threshold_crossed(key:SumStats::Key, result:SumStats::Result) = { local r = result["attack_lm_ex"]; @@ -114,7 +114,7 @@ event bro_init() # at least one SMB_WRITE was observed if ( r$max == 1000 && r$min == 1 ) - { + { local s = fmt("Detected activity against host %s, total score %.0f within timeframe %s", key$host, r$sum, bzar1_epoch); # Raise Notice @@ -129,9 +129,9 @@ event bro_init() # 2- SumStats Analytics for ATTACK Lateral Movement (Multiple Attempts) # # Description: - # Use SumStats to raise a Bro/Zeek Notice event if multiple SMB Lateral + # Use SumStats to raise a Bro/Zeek Notice event if multiple SMB Lateral # Movement indicators (e.g., multiple attempts to connect to a Windows Admin - # File Share: ADMIN$ or C$ only) are observed originating from the same host, + # File Share: ADMIN$ or C$ only) are observed originating from the same host, # regardless of write-attempts and regardless of whether or not any connection # is successful --just connection attempts-- within a specified period of time. # @@ -160,7 +160,7 @@ event bro_init() { return result["attack_t1077"]$sum; }, - $threshold_crossed(key:SumStats::Key, result:SumStats::Result) = + $threshold_crossed(key:SumStats::Key, result:SumStats::Result) = { local s = fmt("Detected T1077 Admin File Share activity from host %s, total attempts %.0f within timeframe %s", key$host, result["attack_t1077"]$sum, bzar2_epoch); @@ -175,15 +175,15 @@ event bro_init() # 3- SumStats Analytics for ATTACK Discovery # # Description: - # Use SumStats to raise a Bro/Zeek Notice event if multiple instances of - # DCE-RPC Discovery indicators are observed originating from the same host, + # Use SumStats to raise a Bro/Zeek Notice event if multiple instances of + # DCE-RPC Discovery indicators are observed originating from the same host, # within a specified period of time. # # Relevant ATT&CK Technique(s): # T1016 System Network Configuration Discovery - # T1018 Remote System Discovery - # T1033 System Owner/User Discovery - # T1069 Permission Groups Discovery + # T1018 Remote System Discovery + # T1033 System Owner/User Discovery + # T1069 Permission Groups Discovery # T1082 System Information Discovery # T1083 File & Directory Discovery # T1087 Account Discovery @@ -191,7 +191,7 @@ event bro_init() # T1135 Network Share Discovery # # Relevant Indicator(s) Detected by Bro/Zeek: - # (a) dce_rpc_response::c$dce_rpc$endpoint + c$dce_rpc$operation contains + # (a) dce_rpc_response::c$dce_rpc$endpoint + c$dce_rpc$operation contains # any of the following: (see BZAR::rpc_dicsovery set). # # Globals (defined in main.bro above): @@ -212,7 +212,7 @@ event bro_init() { return result["attack_discovery"]$sum; }, - $threshold_crossed(key:SumStats::Key, result:SumStats::Result) = + $threshold_crossed(key:SumStats::Key, result:SumStats::Result) = { local s = fmt("Detected activity from host %s, total attempts %.0f within timeframe %s", key$host, result["attack_discovery"]$sum, bzar3_epoch); From 899dd7f5ea27689682eee4a67bd1c2c04fac5bfb Mon Sep 17 00:00:00 2001 From: "Andrew D. Pease" <7442091+peasead@users.noreply.github.com> Date: Tue, 9 Apr 2019 10:38:52 -0500 Subject: [PATCH 3/3] updated to include 2.5.5 compatibility with @if directive --- implementations/bzar/main.bro | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/implementations/bzar/main.bro b/implementations/bzar/main.bro index d24d2c1c..d6ee10f7 100755 --- a/implementations/bzar/main.bro +++ b/implementations/bzar/main.bro @@ -1,17 +1,27 @@ # # File: main.bro # Created: 20180701 -# Updated: 20190225 +# Updated: 20190409 # # Copyright 2018 The MITRE Corporation. All Rights Reserved. # Approved for public release. Distribution unlimited. Case number 18-2489. # -@load base/protocols/smb -@load base/protocols/dce-rpc -@load base/frameworks/files -@load base/frameworks/notice -@load base/frameworks/sumstats +@if ( ver <= 2.5.5 ) + @load policy/protocols/smb + @load base/protocols/dce-rpc + @load base/frameworks/files + @load base/frameworks/notice + @load base/frameworks/sumstats +@endif + +@if ( ver >= 2.6 ) + @load base/protocols/smb + @load base/protocols/dce-rpc + @load base/frameworks/files + @load base/frameworks/notice + @load base/frameworks/sumstats +@endif module BZAR;