1
00:00:09,090 --> 00:00:10,310
Hello, everybody.

2
00:00:10,310 --> 00:00:15,270
Welcome back to the continuation of the OpenSOC CTF Tools.

3
00:00:15,430 --> 00:00:18,630
Our next speaker, Tim Dot Zero, a.k.a.

4
00:00:18,630 --> 00:00:19,730
TJ, a.k.a.

5
00:00:19,730 --> 00:00:23,510
Tim Johnson, will be giving us a walkthrough of the Kibana tool.

6
00:00:23,810 --> 00:00:29,330
This product is near and dear to my heart, being an elastic engineer, and hopefully everybody enjoys it.

7
00:00:29,330 --> 00:00:34,290
If you have questions, hit us up in the text WORKSHOP TRACK 1, channel again.

8
00:00:34,290 --> 00:00:36,950
We will try to redirect you as best as possible.

9
00:00:36,950 --> 00:00:41,730
There's also the Recon InfoSec Discord channel that you can go into.

10
00:00:41,830 --> 00:00:49,050
There is actually a section that, unfortunately, I didn't write down, Tim, but ask for help, I think.

11
00:00:49,190 --> 00:00:52,350
Yeah, you can ask for help from other OpenSOC veterans.

12
00:00:52,850 --> 00:00:58,670
Yeah, so definitely take advantage of the Discord channels that are out there so you can get more directed help.

13
00:00:58,670 --> 00:01:04,130
At this point, I'm going to turn it over to TJ and sit back and relax.

14
00:01:05,590 --> 00:01:07,450
Hey, how's it going, everybody?

15
00:01:08,030 --> 00:01:10,970
We're very excited about OpenSOC this year.

16
00:01:10,970 --> 00:01:16,750
We got new scenarios, got some new tools for you to use, and we got some tools that you already know about.

17
00:01:16,750 --> 00:01:27,230
But for those of you who are attending DEF CON for the first time or participating in OpenSOC for the first time, we're going to get you familiar with those tools and show you what kind of weapons you have in your arsenal.

18
00:01:29,630 --> 00:01:34,370
Like he said, my name is TJ, aka Tim.0 on Twitter.

19
00:01:34,590 --> 00:01:37,430
You can hit us up anytime.

20
00:01:37,430 --> 00:01:43,790
We'll retweet you, we'll talk to you, we'll get in our Discord, and we'll try to help you out, try to make you better hunters.

21
00:01:44,110 --> 00:01:48,450
But without further ado, we're going to jump into some Kibana.

22
00:01:50,710 --> 00:01:57,090
So right when you log into Kibana, you're going to actually see this screen here.

23
00:01:58,850 --> 00:02:04,150
And it's no different than if you've used Greylog before or other tools like this.

24
00:02:04,250 --> 00:02:10,750
It's a UI for your Elasticsearch database on the back end, and it helps you visualize your Elasticsearch data.

25
00:02:11,590 --> 00:02:20,410
And here you'll be able to create indexes to filter out and look through all of your agents pushing logs to your Logstash server.

26
00:02:21,670 --> 00:02:23,230
And that's just a little background.

27
00:02:23,230 --> 00:02:28,090
I won't teach you about the tool because I don't work for Elastic, but I do love this tool.

28
00:02:29,170 --> 00:02:32,530
So first off, I'd like to tell everybody the disclaimer.

29
00:02:32,530 --> 00:02:35,550
Do not ever forget your time frame.

30
00:02:36,170 --> 00:02:38,450
You've got to pay attention to the time filter.

31
00:02:38,950 --> 00:02:45,450
So you're going to get intel drops, you're going to get information saying that a particular event happened at a particular time.

32
00:02:45,450 --> 00:02:48,770
And you've got to make sure that you're looking for events during that time.

33
00:02:50,350 --> 00:02:57,250
So right up here in the right corner here, you're going to see your... by default, it'll open up and load as last 15 minutes.

34
00:02:57,250 --> 00:03:04,270
And if you click that right there, it'll actually provide you, by default, some of the quick...

35
00:03:04,910 --> 00:03:06,390
Hey, I just want to look at the last week.

36
00:03:06,390 --> 00:03:07,950
Hey, I just want to look at the last month.

37
00:03:07,950 --> 00:03:10,210
Oh, this happened in the last 30 minutes.

38
00:03:10,790 --> 00:03:18,430
Obviously, because we're hunting on a non-live environment, we want to look pretty specific, right?

39
00:03:19,090 --> 00:03:23,410
So you're going to go in here and you can pick your time and your date here.

40
00:03:23,410 --> 00:03:29,690
And the cool thing about it, if you notice that I clicked a date, it zeroes out the start time.

41
00:03:30,790 --> 00:03:36,270
And if you click another date, it pulls it down to 2359 where it's the end of the day.

42
00:03:37,070 --> 00:03:44,370
That's a very useful tool there because you're going to be looking at a lot of different time frames and we want to make sure that you're getting the right data.

43
00:03:44,550 --> 00:03:48,310
So pay attention to your time frame because you don't want to hunt in the wrong place.

44
00:03:49,130 --> 00:03:54,730
Also, you'll go back and forth in between your hunts into different time frames.

45
00:03:54,850 --> 00:03:58,490
And this will actually show you some of the last ones you picked.

46
00:03:58,490 --> 00:04:02,610
So it makes it a lot easier on you to jump between one time frame and another.

47
00:04:04,510 --> 00:04:06,050
But we'll keep pushing.

48
00:04:07,570 --> 00:04:15,930
One of the things I like about Kibana is for the not so seasoned hunter.

49
00:04:15,930 --> 00:04:20,590
When I first started, Kibana was a great tool for me to try to learn and understand.

50
00:04:20,770 --> 00:04:26,250
Because you get to understand based on the data that you're given.

51
00:04:26,250 --> 00:04:28,030
You're looking at all your logs right here.

52
00:04:28,030 --> 00:04:32,110
So in the last 15 minutes, I'm looking at 131,000 logs.

53
00:04:32,110 --> 00:04:37,130
So I usually just start off by looking at some of the stuff that I'm seeing here.

54
00:04:37,570 --> 00:04:40,270
But you'll notice that you're getting logs from different sources.

55
00:04:40,270 --> 00:04:45,850
So here we got this type here showing that it's a log.

56
00:04:46,450 --> 00:04:51,530
But you might also filter that out and say, what other type of logs do I have here?

57
00:04:54,530 --> 00:05:02,890
And you open that up and you can see I use this little magnifying glass as you filter or you hover over some of these fields here.

58
00:05:02,890 --> 00:05:09,410
You can go and add and say I want to filter for that value and I want to take out that value.

59
00:05:09,470 --> 00:05:20,410
And you'll see that that value for the log type is actually filtered out and I'm only seeing now syslogs.

60
00:05:22,130 --> 00:05:26,350
So if you would, I like to call this the point-and-click hunt method.

61
00:05:26,350 --> 00:05:33,250
You can actually go through here and be like, well, I don't want to see DESPORT 3306 and take it out.

62
00:05:33,470 --> 00:05:36,770
And as you do that, you'll see your filters just pile up here.

63
00:05:37,510 --> 00:05:42,970
And if you want to, you can actually go and start adding your own filters from scratch.

64
00:05:57,670 --> 00:06:08,710
So you might not have a range of IPs or a specific IP that you know is just a distractor or maybe just noise or for your specific hunt, you don't want to see that traffic.

65
00:06:08,710 --> 00:06:14,750
So you can go in here and select that IP and say I don't want to see anything from that IP address.

66
00:06:15,150 --> 00:06:18,050
And you'll see my events drop because it took them out.

67
00:06:21,770 --> 00:06:23,990
Also, columns.

68
00:06:24,230 --> 00:06:29,990
Looking at this view here, you can see that right now all I see is the time and the source.

69
00:06:30,870 --> 00:06:38,470
But what if you want to see in a single view source IP or maybe the DESP IP?

70
00:06:38,470 --> 00:06:46,850
You can actually go through and here are all your columns that you could create based off of the fields in each of these logs.

71
00:06:52,540 --> 00:07:00,720
Another thing you can do is if you open up a log and you say, well, there's my DESP IP there.

72
00:07:00,720 --> 00:07:05,140
You see this small icon here that looks like a column.

73
00:07:05,680 --> 00:07:14,680
If you click that there, it automatically throws it up into the DESP IP column on this table.

74
00:07:15,460 --> 00:07:20,640
So now as you start narrowing down your hunts, you see the data that's pertinent to you.

75
00:07:20,640 --> 00:07:27,060
I'm looking for this specific actor talking to this specific network resource because it shouldn't be happening.

76
00:07:27,060 --> 00:07:34,680
Because the ultimate goal here, right, when you're hunting is to make this number as small as possible in your searches.

77
00:07:35,740 --> 00:07:40,400
Because you know for a fact that that's activity that should not be happening.

78
00:07:41,880 --> 00:07:50,180
Now, obviously, as you go, you're going to see some traffic that you need to deconflict and say, well, that is legit traffic and I don't want to see it.

79
00:07:50,400 --> 00:07:52,740
That's when I recommend building those filters.

80
00:07:52,740 --> 00:08:01,720
So as you go through, make sure you create filters for things that you don't find necessary in your searches.

81
00:08:04,020 --> 00:08:12,540
Moving on here, we're going to talk about how to query in Kibana.

82
00:08:12,540 --> 00:08:17,720
So, Kibana uses Lucene query language.

83
00:08:18,060 --> 00:08:22,940
If you're not familiar with it, there's lots of data out there on it.

84
00:08:22,940 --> 00:08:27,400
But the primary information you need to know about it is the operators that it uses.

85
00:08:29,020 --> 00:08:36,640
So, for example, let's say there's two specific IP addresses that you care about.

86
00:08:36,680 --> 00:08:39,640
And we'll look at these two here.

87
00:08:40,720 --> 00:08:46,980
So you want to know when and if these two machines here we're talking.

88
00:08:47,940 --> 00:08:57,240
So, what you can do is, you want to say source underscore IP.

89
00:09:10,950 --> 00:09:17,380
Source IP is that.

90
00:09:19,540 --> 00:09:25,400
And specifying that it has to match that operator.

91
00:09:25,400 --> 00:09:29,720
So you're saying it has to match this IP here.

92
00:09:29,720 --> 00:09:32,600
Otherwise, you don't want to see it.

93
00:09:39,510 --> 00:09:40,450
Boom.

94
00:09:40,450 --> 00:09:47,070
So you're saying those devices have never talked to each other in the last 15 minutes.

95
00:09:47,070 --> 00:09:53,990
Now, what if you say, well, I just want to know when this IP has talked to anybody.

96
00:09:54,510 --> 00:09:57,450
And when this IP, anybody's talked to it.

97
00:09:57,450 --> 00:09:58,590
Either or.

98
00:09:58,950 --> 00:10:04,290
So that's when you just drop change that and to an or operator.

99
00:10:07,290 --> 00:10:11,530
And now you're going to see that IP as the source.

100
00:10:14,100 --> 00:10:19,980
Somewhere down the line you'll see the other IP as the dest in a lot of the traffic.

101
00:10:21,360 --> 00:10:26,320
So, you just have to pay attention to some of your syntax.

102
00:10:26,720 --> 00:10:31,340
Again, there's a few things you want to consider.

103
00:10:31,760 --> 00:10:34,560
Lucene does use regex.

104
00:10:35,020 --> 00:10:43,680
So, what you might do is, maybe there's a file called evil file that you know about.

105
00:10:43,680 --> 00:10:52,580
You had an Intel drop and they say, hey, I need to go find, I know they clicked on a document and someone executed evil file.

106
00:10:53,260 --> 00:10:55,720
So, how would you search for that, right?

107
00:10:55,920 --> 00:11:02,840
Well, in Kibana, you can actually say, well, I just want to see anything called evil file.

108
00:11:03,980 --> 00:11:04,840
Okay.

109
00:11:05,040 --> 00:11:06,840
That's in the last 15 minutes.

110
00:11:06,900 --> 00:11:09,740
Maybe the last 24 hours.

111
00:11:19,210 --> 00:11:19,850
Nope.

112
00:11:19,850 --> 00:11:20,590
Nothing.

113
00:11:20,590 --> 00:11:21,450
Okay.

114
00:11:21,450 --> 00:11:25,390
So, what if I want to use regex?

115
00:11:25,390 --> 00:11:29,470
Well, because evil might be capitalized, or file might be capitalized.

116
00:11:30,030 --> 00:11:49,590
So, what you would do here, you specify here that you're throwing in some regex, and then here, wildcard, here, wildcard, and then do your search.

117
00:11:51,880 --> 00:11:54,760
Now, the problem is, there is no evil file.

118
00:11:56,320 --> 00:12:03,960
So, but what if you wanted everything in the last hour with the word file?

119
00:12:04,400 --> 00:12:05,240
Okay.

120
00:12:12,300 --> 00:12:17,760
So now, if you pull down here, it's referencing FileBeat.

121
00:12:19,780 --> 00:12:25,520
And mostly, you're going to see FileBeat because that is the agent that's pushing these logs to you.

122
00:12:25,520 --> 00:12:26,360
Okay.

123
00:12:26,360 --> 00:12:30,060
Well, let's take out FileBeat because I know that's my agent.

124
00:12:30,060 --> 00:12:31,540
I don't need to look at that.

125
00:12:31,660 --> 00:12:33,720
So, I go and filter that out.

126
00:12:34,460 --> 00:12:37,260
The negative sign magnifying glass.

127
00:12:41,230 --> 00:12:46,570
So, now, is there anything else referencing file?

128
00:12:46,690 --> 00:12:48,490
Program files.

129
00:12:48,730 --> 00:12:54,530
Oh, I didn't specify that I wanted it to end in file that wasn't plural.

130
00:12:56,390 --> 00:12:58,670
So, that's some of the things you've got to pay attention to.

131
00:12:58,670 --> 00:13:02,590
If you're really good with regular expressions, that can be helpful.

132
00:13:02,950 --> 00:13:10,470
Also, you can come in and specify that... because right now, I just said lowercase F, right?

133
00:13:10,610 --> 00:13:16,130
But what if you want to tell in regex, it could be also uppercase F.

134
00:13:19,380 --> 00:13:27,400
And as you notice, I'm getting pretty specific with the regex and already my events in the last hour have dropped down to 12,000.

135
00:13:28,300 --> 00:13:37,580
And our goal at the end of the day is to make our events as little as possible so you can start narrowing down the bad.

136
00:13:41,690 --> 00:13:42,130
Alright.

137
00:13:42,130 --> 00:13:43,970
So, another useful tool.

138
00:13:44,810 --> 00:13:52,220
So, sometimes you're going to come across logs that don't have the data that you're looking for.

139
00:13:53,940 --> 00:13:56,900
I see destip with an empty field here.

140
00:13:56,940 --> 00:13:59,260
Sometimes you're going to see message fields with an empty field.

141
00:13:59,260 --> 00:14:01,980
Sometimes you're going to see file paths with an empty field.

142
00:14:02,840 --> 00:14:07,520
Sometimes that's something worth looking at, but sometimes you're like, I really need to know the file path.

143
00:14:07,520 --> 00:14:09,020
I really need to know the destip.

144
00:14:09,020 --> 00:14:13,040
So, we'll use destip as the example here.

145
00:14:13,120 --> 00:14:15,500
So, I'll pick a source IP.

146
00:14:24,620 --> 00:14:33,200
So, what I'm saying here is I want to know when this system talks to anybody.

147
00:14:33,380 --> 00:14:42,060
Because if I just search that there, I will still see this log with no destination IP.

148
00:14:43,660 --> 00:14:49,000
But, I want something with some data.

149
00:14:49,000 --> 00:14:55,080
So, what I'll do here is an exist operator.

150
00:15:04,320 --> 00:15:14,900
And now I'm saying I want to know when that IP is the source and the destip has content in the field.

151
00:15:15,420 --> 00:15:17,200
So, let me update that up.

152
00:15:17,400 --> 00:15:18,440
So, what does that tell me?

153
00:15:18,440 --> 00:15:26,900
That tells me that system never talked to anybody or there's no log of that system talking to anybody in the last hour.

154
00:15:27,180 --> 00:15:31,820
We can go back a week and let's see if we find anything.

155
00:15:31,820 --> 00:15:32,820
Nope.

156
00:15:33,620 --> 00:15:44,880
So, that might be worth looking into because you've now got a log of this system talking, but what is it doing?

157
00:15:44,880 --> 00:15:46,440
So, that might be worth investigating.

158
00:15:46,440 --> 00:15:49,840
Obviously, if Intel provides that kind of content.

159
00:15:50,920 --> 00:15:52,520
Let's push here.

160
00:15:55,550 --> 00:15:58,350
Let's talk about what else you could search.

161
00:15:58,550 --> 00:16:01,630
So, important artifacts, right?

162
00:16:01,630 --> 00:16:04,390
Hashes, imp hashes.

163
00:16:05,110 --> 00:16:15,290
The way that, and I forgot to tell you this at the beginning, but Kibana is actually showing you the same data that Greylog is showing you.

164
00:16:15,290 --> 00:16:30,750
As you can see by the index here, there's one single index, which on other instances of your ELK stack, you might see multiple index patterns that are saying that I'm getting logs from multiple different sources.

165
00:16:30,750 --> 00:16:37,150
But for the OpenSock range, this tool is actually pointing to the same data that Greylog is pointing to.

166
00:16:37,150 --> 00:16:44,550
So , disclaimer, if you use Greylog, if you use Kibana, you can choose what you feel more comfortable with.

167
00:16:46,350 --> 00:16:50,950
What you find easier to use, but they're both showing the same data.

168
00:16:52,030 --> 00:17:03,170
So, but I will say the way that Greylog is parsing this data is different than how Kibana is getting this data parsed in.

169
00:17:03,170 --> 00:17:14,830
So, you have to consider, if you're looking for an imp hash, there's a possibility, there's a field for it in Greylog, and there's a possibility that there's not a field for it here.

170
00:17:15,290 --> 00:17:16,610
They do exist.

171
00:17:17,130 --> 00:17:19,990
So, why are imp hashes important?

172
00:17:20,750 --> 00:17:22,930
Well, find out.

173
00:17:25,520 --> 00:17:37,200
So, what I'm doing here is I'm actually just looking for any imp hash and find out what field that data is in, because there is no imp hash field.

174
00:17:44,010 --> 00:17:46,290
So, I've got a few hits on it.

175
00:17:46,670 --> 00:17:51,610
Right now, no source and destination IPs, but let's go ahead and expand a log and see what we're looking at.

176
00:17:54,570 --> 00:18:06,350
So, we've got a driver called agent.exe and remote IPs, and we've got an imp hash for this file.

177
00:18:06,350 --> 00:18:15,490
Now, if you deem this file to be bad at any point, then you now got the imp hash for it and you can find every execution of it.

178
00:18:15,490 --> 00:18:24,750
So, that's another quick artifact, but all I did was search the word imp hash, and I found all the logs that have imp hashes associated with it.

179
00:18:24,750 --> 00:18:32,570
Now, you're going to have to do some more digging and filtering because, obviously, you're going to find a file with an imp hash that could be legit.

180
00:18:32,970 --> 00:18:34,730
So, just something to consider.

181
00:18:35,630 --> 00:18:39,270
That's just a plain text query there.

182
00:18:40,790 --> 00:18:49,920
Also, more basic, if you're looking for event IDs, everybody knows what a 4624 is.

183
00:18:50,740 --> 00:19:00,720
And if you don't, get your event IDs out, Google a sheet of the top event IDs to keep an eye on.

184
00:19:00,720 --> 00:19:08,800
Microsoft has a sheet from severity levels that's important to look at.

185
00:19:09,540 --> 00:19:18,820
But if you look here, I just looked for all the 4624s for this week, and I'm now looking at all the logons.

186
00:19:18,980 --> 00:19:20,120
Successful logons.

187
00:19:20,120 --> 00:19:21,940
You've got security IDs.

188
00:19:23,100 --> 00:19:30,020
And something I failed to mention, you want to pay attention to the message column here.

189
00:19:30,020 --> 00:19:36,300
So, what I like to do is keep the... I'm going to pull this out here.

190
00:19:36,300 --> 00:19:40,680
Go down to the message field and actually filter out for that column.

191
00:19:41,100 --> 00:19:53,540
Because now, I can just scroll down and start looking through and saying, hey, this is some stuff, but I don't care about S100, Sid.

192
00:19:54,140 --> 00:19:55,940
I don't care about that.

193
00:19:57,460 --> 00:20:00,500
So, let's see how we can filter that out.

194
00:20:03,620 --> 00:20:05,280
So, not.

195
00:20:07,240 --> 00:20:08,440
Excuse me.

196
00:20:09,160 --> 00:20:10,360
And not.

197
00:20:36,710 --> 00:20:37,830
There we go.

198
00:20:37,830 --> 00:20:45,830
I just took out all the S100s, and now I can start seeing some other security IDs that have logged in.

199
00:20:45,870 --> 00:20:50,550
And if you want, you can go down and start narrowing down the system names.

200
00:20:50,550 --> 00:20:52,050
There's your host names there.

201
00:20:52,050 --> 00:20:55,070
And you can say, I don't care about ACC1.

202
00:20:55,070 --> 00:20:56,430
That guy's a good guy.

203
00:20:56,430 --> 00:20:58,090
Let me keep moving.

204
00:20:58,370 --> 00:21:00,050
But I do care about...

205
00:21:01,010 --> 00:21:02,210
Let's maybe say...

206
00:21:04,170 --> 00:21:05,790
Who we got here?

207
00:21:06,330 --> 00:21:07,890
Under host name.

208
00:21:08,910 --> 00:21:11,290
Oh, that's ACC101 again.

209
00:21:11,410 --> 00:21:13,110
But you get the drift, right?

210
00:21:13,110 --> 00:21:17,330
I'll filter out for ACC... that was the username, but same difference.

211
00:21:19,890 --> 00:21:22,550
So, I've now filtered out for ACC1.

212
00:21:22,550 --> 00:21:28,030
I said, I want to see 4624s, but I don't care about S100.

213
00:21:29,650 --> 00:21:31,650
That's how you would do that there.

214
00:21:32,170 --> 00:21:40,970
You can get a little bit more complex here and start looking at data paths and file paths and image path names.

215
00:21:41,570 --> 00:21:43,030
So, let's look at...

216
00:21:43,550 --> 00:21:45,590
Let me pull this out here.

217
00:21:46,250 --> 00:21:47,530
Flip to a new one.

218
00:21:50,370 --> 00:21:50,850
And...

219
00:21:51,830 --> 00:21:52,890
I want to see...

220
00:21:54,110 --> 00:21:55,590
Let's just look at...

221
00:21:56,650 --> 00:21:58,150
System on here.

222
00:21:59,450 --> 00:22:01,430
Let's just look at Beats logs.

223
00:22:02,190 --> 00:22:03,970
So, I'm going to say, I want to see...

224
00:22:09,710 --> 00:22:10,870
Here we go.

225
00:22:11,190 --> 00:22:13,290
Something to keep in mind, Beats, right?

226
00:22:13,370 --> 00:22:17,010
Beats are the agents that are actually shipping the logs to your log stash.

227
00:22:17,830 --> 00:22:24,410
Now, keep in mind, Winlogbeat, Windows event logs, security, application, then you've got your PowerShell logs.

228
00:22:24,410 --> 00:22:28,250
Everybody knows PowerShell is always good, but you might want to look at it anyway.

229
00:22:28,490 --> 00:22:29,290
Hint, hint.

230
00:22:29,630 --> 00:22:34,810
So, what I'm going to do here is go ahead and filter out and say, I just want to see Winlogbeat logs.

231
00:22:39,240 --> 00:22:40,000
And then...

232
00:22:47,140 --> 00:22:50,180
I want to search for a specific event ID.

233
00:22:51,020 --> 00:22:55,000
Or, you know, better yet, let's see if we can start filtering for different file paths.

234
00:22:55,000 --> 00:22:58,740
So, let's find the file path field.

235
00:23:15,350 --> 00:23:16,510
Here we go.

236
00:23:16,670 --> 00:23:18,290
Very minimal logs, right?

237
00:23:18,290 --> 00:23:20,150
Where the file path exists.

238
00:23:20,410 --> 00:23:22,670
So, here's the file path.

239
00:23:22,670 --> 00:23:25,330
I've got users, I've got folders here.

240
00:23:25,330 --> 00:23:29,570
But I want to just know where this user here might have looked at...

241
00:23:30,990 --> 00:23:36,170
Or what files this user has actually executed, or file created, right?

242
00:23:36,170 --> 00:23:39,450
So, let's say I want to filter by file create.

243
00:23:39,450 --> 00:23:40,910
So, I go here.

244
00:23:42,630 --> 00:23:48,470
And I can either say in a specific path, or I can say a specific user.

245
00:23:48,470 --> 00:23:52,890
But I want to know when anything, let's say, created in this AppData path here.

246
00:24:18,080 --> 00:24:20,360
So, I'm going to do a regex here.

247
00:24:28,350 --> 00:24:28,910
Say...

248
00:24:28,910 --> 00:24:30,190
Anything.

249
00:24:31,350 --> 00:24:34,190
And then close my regex.

250
00:24:34,250 --> 00:24:35,370
Anything.

251
00:24:38,960 --> 00:24:43,940
And then, because it's regex, you've got to escape your characters.

252
00:24:47,380 --> 00:24:53,680
And we'll take out... for simplicity.

253
00:25:11,570 --> 00:25:13,070
There we go.

254
00:25:13,270 --> 00:25:15,190
That's a hefty one there.

255
00:25:15,330 --> 00:25:19,970
But, I'm down to 32 events in the last 15 minutes, right?

256
00:25:19,970 --> 00:25:28,510
That, right there, is I've now narrowed down every time a file was created by Claudia Davis, or maybe not by Claudia Davis, just in her path.

257
00:25:30,490 --> 00:25:32,210
In the AppData path.

258
00:25:32,210 --> 00:25:33,510
And what's in AppData?

259
00:25:33,510 --> 00:25:34,410
Temp folders.

260
00:25:34,410 --> 00:25:35,950
So, keep that in mind.

261
00:25:35,950 --> 00:25:36,930
Keep going.

262
00:25:39,550 --> 00:25:41,410
So, something else you can do.

263
00:25:42,410 --> 00:25:51,270
And, if you come across a query, like this hefty one here, that maybe sometimes, oh, I want to just swap out the user and use that search over again.

264
00:25:51,310 --> 00:25:53,430
You could just copy and paste it to a text file.

265
00:25:53,430 --> 00:25:58,410
Or, you can get real fancy with it and go and start saving some of your searches.

266
00:25:58,410 --> 00:26:04,110
And so, Claudia Davis file create.

267
00:26:04,110 --> 00:26:04,910
Great.

268
00:26:06,370 --> 00:26:08,390
So, you confirm that.

269
00:26:08,890 --> 00:26:15,150
And, at any given time, you start opening up a fresh Kibana page.

270
00:26:17,170 --> 00:26:20,950
You can go in and say, where's my search?

271
00:26:20,950 --> 00:26:22,030
Oh, there we go.

272
00:26:22,030 --> 00:26:23,410
Claudia Davis.

273
00:26:23,410 --> 00:26:29,310
Because now I want to look at James Brown, or I want to look at Kanye West.

274
00:26:29,410 --> 00:26:34,550
So, that's some of the things you want to start doing as you go, because you're going to use these queries over again.

275
00:26:34,550 --> 00:26:39,310
If not, you're going to use the shell of it for a different file path for a different user.

276
00:26:39,510 --> 00:26:42,370
And that's something that might be useful for you down the line.

277
00:26:44,410 --> 00:26:48,230
Now, there's some other stuff you can do with visualizations.

278
00:26:48,230 --> 00:27:00,430
So, you can actually pull in a visualization and save search as a visualization, or you can create your own.

279
00:27:00,650 --> 00:27:03,850
A lot of times I like to create tables and look at time frames.

280
00:27:03,850 --> 00:27:18,230
They're real good for looking at live data, but you can also look at over a span of time and say, hey, I want to see how many times this system has used SMB, or I want to see how many times Quad4 protocol was used.

281
00:27:18,430 --> 00:27:24,710
And then you can actually just have it on a table, throw it in a visualization, and pop it up any time you want to start.

282
00:27:26,390 --> 00:27:31,190
Just keep in mind, hey, this came across during this time frame that I'm already inspecting.

283
00:27:31,430 --> 00:27:33,290
And then you can use that.

284
00:27:33,290 --> 00:27:38,270
And I'll just show you a quick one here, because you can get pretty caught up in it.

285
00:27:42,800 --> 00:27:44,460
We're going to do the count here.

286
00:28:00,790 --> 00:28:03,170
We're going to aggregate it on a term.

287
00:28:04,650 --> 00:28:11,810
In the field, we're going to add, let's say, IP source.

288
00:28:12,190 --> 00:28:14,230
Excuse me, source IP.

289
00:28:18,450 --> 00:28:19,810
There it is.

290
00:28:20,310 --> 00:28:23,050
And we're going to say you want to see the top five.

291
00:28:23,950 --> 00:28:27,210
You can call that source, you can label it, whatever you want.

292
00:28:28,750 --> 00:28:30,090
Hit play.

293
00:28:30,410 --> 00:28:31,530
There you go.

294
00:28:31,530 --> 00:28:37,450
What this is showing you here is just the log counts for each of these sources here.

295
00:28:37,530 --> 00:28:42,790
That's a super quick way to start seeing, in this time frame, who was talking the most.

296
00:28:42,790 --> 00:28:43,950
Is that data exfil?

297
00:28:43,950 --> 00:28:46,830
Is that port scanning?

298
00:28:46,830 --> 00:28:49,210
Is that some of the stuff you want to start paying attention to?

299
00:28:49,210 --> 00:28:50,750
Look at the count of the logs.

300
00:28:50,750 --> 00:28:52,850
That's a low-level hunt that you can do.

301
00:28:53,290 --> 00:28:58,170
But you can go in and you can use the same concept and throw in protocols.

302
00:28:58,170 --> 00:29:00,230
You can make a bar graph out of it.

303
00:29:00,230 --> 00:29:02,030
You can make a pie graph out of it.

304
00:29:02,030 --> 00:29:05,390
But I like to use them more for live hunts.

305
00:29:05,790 --> 00:29:09,710
But for this exercise, you're probably going to spend most of your time in Discover.

306
00:29:19,150 --> 00:29:20,190
All right.

307
00:29:20,850 --> 00:29:27,750
I think I kind of gave you the low-level, or high-level rather, rundown of everything.

308
00:29:27,750 --> 00:29:29,170
I don't want to take up more of your time.

309
00:29:29,170 --> 00:29:31,070
You've got a lot of tools to learn today.

310
00:29:31,450 --> 00:29:35,510
And there's a lot of time you can go spend playing with Kibana.

311
00:29:36,170 --> 00:29:40,370
There's a couple of videos out there that you can do.

312
00:29:40,370 --> 00:29:46,030
I can give you all some resources if you just hit me up in the Open Sock Discord channel.

313
00:29:46,030 --> 00:29:47,630
We've got a Kibana channel.

314
00:29:47,630 --> 00:29:52,730
And then also, there's some more advanced Kibana users out there.

315
00:29:52,730 --> 00:29:57,170
I'm definitely not the know-all, but I've seen my way around it.

316
00:29:57,490 --> 00:30:04,350
But we've got an Ask for Help channel over in the Open Sock Discord willing to answer any questions.

317
00:30:04,350 --> 00:30:10,450
A lot of the Open Sock veterans that have played Open Sock before have used Kibana before.

318
00:30:10,450 --> 00:30:17,270
They've got some tips and tricks, and they can get you sorted out.

319
00:30:17,270 --> 00:30:19,590
So, thank you for your time today.

320
00:30:19,590 --> 00:30:23,630
If you need anything, again, just hit us up on the Discord, and we'll talk soon.

321
00:30:25,950 --> 00:30:27,250
Thanks a lot, TJ.

322
00:30:27,250 --> 00:30:28,610
That was a great talk.

323
00:30:29,050 --> 00:30:34,130
As he pointed out, check out the Recon Iposec Discord channel if you're looking for Open Sock questions.

324
00:30:34,350 --> 00:30:37,330
They're over there to assist you as needed.

325
00:30:37,730 --> 00:30:38,510
I appreciate it.

326
00:30:38,510 --> 00:30:39,190
Thanks again.