start	end	text
9090	15270	Hello, everybody. Welcome back to the continuation of the OpenSOC CTF Tools.
15430	23510	Our next speaker, Tim Dot Zero, a.k.a. TJ, a.k.a. Tim Johnson, will be giving us a walkthrough of the Kibana tool.
23810	29330	This product is near and dear to my heart, being an elastic engineer, and hopefully everybody enjoys it.
29330	34290	If you have questions, hit us up in the text WORKSHOP TRACK 1, channel again.
34290	41730	We will try to redirect you as best as possible. There's also the Recon InfoSec Discord channel that you can go into.
41830	49050	There is actually a section that, unfortunately, I didn't write down, Tim, but ask for help, I think.
49190	52350	Yeah, you can ask for help from other OpenSOC veterans.
52850	58670	Yeah, so definitely take advantage of the Discord channels that are out there so you can get more directed help.
58670	64130	At this point, I'm going to turn it over to TJ and sit back and relax.
65590	70970	Hey, how's it going, everybody? We're very excited about OpenSOC this year.
70970	76750	We got new scenarios, got some new tools for you to use, and we got some tools that you already know about.
76750	83570	But for those of you who are attending DEF CON for the first time or participating in OpenSOC for the first time,
83570	87230	we're going to get you familiar with those tools and show you what kind of weapons you have in your arsenal.
89630	94370	Like he said, my name is TJ, aka Tim.0 on Twitter.
94590	100370	You can hit us up anytime. We'll retweet you, we'll talk to you, we'll get in our Discord,
100370	103790	and we'll try to help you out, try to make you better hunters.
104110	108450	But without further ado, we're going to jump into some Kibana.
110710	117090	So right when you log into Kibana, you're going to actually see this screen here.
118850	124150	And it's no different than if you've used Greylog before or other tools like this.
124250	130750	It's a UI for your Elasticsearch database on the back end, and it helps you visualize your Elasticsearch data.
131590	140410	And here you'll be able to create indexes to filter out and look through all of your agents pushing logs to your Logstash server.
141670	148090	And that's just a little background. I won't teach you about the tool because I don't work for Elastic, but I do love this tool.
149170	155550	So first off, I'd like to tell everybody the disclaimer. Do not ever forget your time frame.
156170	165450	You've got to pay attention to the time filter. So you're going to get intel drops, you're going to get information saying that a particular event happened at a particular time.
165450	168770	And you've got to make sure that you're looking for events during that time.
170350	177250	So right up here in the right corner here, you're going to see your... by default, it'll open up and load as last 15 minutes.
177250	184270	And if you click that right there, it'll actually provide you, by default, some of the quick...
184910	190210	Hey, I just want to look at the last week. Hey, I just want to look at the last month. Oh, this happened in the last 30 minutes.
190790	198430	Obviously, because we're hunting on a non-live environment, we want to look pretty specific, right?
199090	203410	So you're going to go in here and you can pick your time and your date here.
203410	209690	And the cool thing about it, if you notice that I clicked a date, it zeroes out the start time.
210790	216270	And if you click another date, it pulls it down to 2359 where it's the end of the day.
217070	224370	That's a very useful tool there because you're going to be looking at a lot of different time frames and we want to make sure that you're getting the right data.
224550	228310	So pay attention to your time frame because you don't want to hunt in the wrong place.
229130	234730	Also, you'll go back and forth in between your hunts into different time frames.
234850	238490	And this will actually show you some of the last ones you picked.
238490	242610	So it makes it a lot easier on you to jump between one time frame and another.
244510	246050	But we'll keep pushing.
247570	255930	One of the things I like about Kibana is for the not so seasoned hunter.
255930	260590	When I first started, Kibana was a great tool for me to try to learn and understand.
260770	266250	Because you get to understand based on the data that you're given.
266250	268030	You're looking at all your logs right here.
268030	272110	So in the last 15 minutes, I'm looking at 131,000 logs.
272110	277130	So I usually just start off by looking at some of the stuff that I'm seeing here.
277570	280270	But you'll notice that you're getting logs from different sources.
280270	285850	So here we got this type here showing that it's a log.
286450	291530	But you might also filter that out and say, what other type of logs do I have here?
294530	302890	And you open that up and you can see I use this little magnifying glass as you filter or you hover over some of these fields here.
302890	309410	You can go and add and say I want to filter for that value and I want to take out that value.
309470	320410	And you'll see that that value for the log type is actually filtered out and I'm only seeing now syslogs.
322130	326350	So if you would, I like to call this the point-and-click hunt method.
326350	333250	You can actually go through here and be like, well, I don't want to see DESPORT 3306 and take it out.
333470	336770	And as you do that, you'll see your filters just pile up here.
337510	342970	And if you want to, you can actually go and start adding your own filters from scratch.
357670	368710	So you might not have a range of IPs or a specific IP that you know is just a distractor or maybe just noise or for your specific hunt, you don't want to see that traffic.
368710	374750	So you can go in here and select that IP and say I don't want to see anything from that IP address.
375150	378050	And you'll see my events drop because it took them out.
381770	389990	Also, columns. Looking at this view here, you can see that right now all I see is the time and the source.
390870	398470	But what if you want to see in a single view source IP or maybe the DESP IP?
398470	406850	You can actually go through and here are all your columns that you could create based off of the fields in each of these logs.
412540	420720	Another thing you can do is if you open up a log and you say, well, there's my DESP IP there.
420720	425140	You see this small icon here that looks like a column.
425680	434680	If you click that there, it automatically throws it up into the DESP IP column on this table.
435460	440640	So now as you start narrowing down your hunts, you see the data that's pertinent to you.
440640	447060	I'm looking for this specific actor talking to this specific network resource because it shouldn't be happening.
447060	454680	Because the ultimate goal here, right, when you're hunting is to make this number as small as possible in your searches.
455740	460400	Because you know for a fact that that's activity that should not be happening.
461880	470180	Now, obviously, as you go, you're going to see some traffic that you need to deconflict and say, well, that is legit traffic and I don't want to see it.
470400	472740	That's when I recommend building those filters.
472740	481720	So as you go through, make sure you create filters for things that you don't find necessary in your searches.
484020	492540	Moving on here, we're going to talk about how to query in Kibana.
492540	502940	So, Kibana uses Lucene query language. If you're not familiar with it, there's lots of data out there on it.
502940	507400	But the primary information you need to know about it is the operators that it uses.
509020	516640	So, for example, let's say there's two specific IP addresses that you care about.
516680	519640	And we'll look at these two here.
520720	526980	So you want to know when and if these two machines here we're talking.
527940	537240	So, what you can do is, you want to say source underscore IP.
550950	557380	Source IP is that.
559540	565400	And specifying that it has to match that operator.
565400	569720	So you're saying it has to match this IP here.
569720	572600	Otherwise, you don't want to see it.
579510	587070	Boom. So you're saying those devices have never talked to each other in the last 15 minutes.
587070	593990	Now, what if you say, well, I just want to know when this IP has talked to anybody.
594510	598590	And when this IP, anybody's talked to it. Either or.
598950	604290	So that's when you just drop change that and to an or operator.
607290	611530	And now you're going to see that IP as the source.
614100	619980	Somewhere down the line you'll see the other IP as the dest in a lot of the traffic.
621360	626320	So, you just have to pay attention to some of your syntax.
626720	631340	Again, there's a few things you want to consider.
631760	634560	Lucene does use regex.
635020	643680	So, what you might do is, maybe there's a file called evil file that you know about.
643680	652580	You had an Intel drop and they say, hey, I need to go find, I know they clicked on a document and someone executed evil file.
653260	655720	So, how would you search for that, right?
655920	662840	Well, in Kibana, you can actually say, well, I just want to see anything called evil file.
663980	669740	Okay. That's in the last 15 minutes. Maybe the last 24 hours.
679210	681450	Nope. Nothing. Okay.
681450	689470	So, what if I want to use regex? Well, because evil might be capitalized, or file might be capitalized.
690030	709590	So, what you would do here, you specify here that you're throwing in some regex, and then here, wildcard, here, wildcard, and then do your search.
711880	714760	Now, the problem is, there is no evil file.
716320	723960	So, but what if you wanted everything in the last hour with the word file?
724400	737760	Okay. So now, if you pull down here, it's referencing FileBeat.
739780	745520	And mostly, you're going to see FileBeat because that is the agent that's pushing these logs to you.
745520	751540	Okay. Well, let's take out FileBeat because I know that's my agent. I don't need to look at that.
751660	753720	So, I go and filter that out.
754460	757260	The negative sign magnifying glass.
761230	768490	So, now, is there anything else referencing file? Program files.
768730	774530	Oh, I didn't specify that I wanted it to end in file that wasn't plural.
776390	782590	So, that's some of the things you've got to pay attention to. If you're really good with regular expressions, that can be helpful.
782950	790470	Also, you can come in and specify that... because right now, I just said lowercase F, right?
790610	796130	But what if you want to tell in regex, it could be also uppercase F.
799380	807400	And as you notice, I'm getting pretty specific with the regex and already my events in the last hour have dropped down to 12,000.
808300	817580	And our goal at the end of the day is to make our events as little as possible so you can start narrowing down the bad.
821690	823970	Alright. So, another useful tool.
824810	832220	So, sometimes you're going to come across logs that don't have the data that you're looking for.
833940	836900	I see destip with an empty field here.
836940	841980	Sometimes you're going to see message fields with an empty field. Sometimes you're going to see file paths with an empty field.
842840	849020	Sometimes that's something worth looking at, but sometimes you're like, I really need to know the file path. I really need to know the destip.
849020	853040	So, we'll use destip as the example here.
853120	855500	So, I'll pick a source IP.
864620	873200	So, what I'm saying here is I want to know when this system talks to anybody.
873380	882060	Because if I just search that there, I will still see this log with no destination IP.
883660	889000	But, I want something with some data.
889000	895080	So, what I'll do here is an exist operator.
904320	914900	And now I'm saying I want to know when that IP is the source and the destip has content in the field.
915420	917200	So, let me update that up.
917400	926900	So, what does that tell me? That tells me that system never talked to anybody or there's no log of that system talking to anybody in the last hour.
927180	932820	We can go back a week and let's see if we find anything. Nope.
933620	944880	So, that might be worth looking into because you've now got a log of this system talking, but what is it doing?
944880	949840	So, that might be worth investigating. Obviously, if Intel provides that kind of content.
950920	952520	Let's push here.
955550	958350	Let's talk about what else you could search.
958550	964390	So, important artifacts, right? Hashes, imp hashes.
965110	975290	The way that, and I forgot to tell you this at the beginning, but Kibana is actually showing you the same data that Greylog is showing you.
975290	990750	As you can see by the index here, there's one single index, which on other instances of your ELK stack, you might see multiple index patterns that are saying that I'm getting logs from multiple different sources.
990750	997150	But for the OpenSock range, this tool is actually pointing to the same data that Greylog is pointing to.
997150	1004550	So, disclaimer, if you use Greylog, if you use Kibana, you can choose what you feel more comfortable with.
1006350	1010950	What you find easier to use, but they're both showing the same data.
1012030	1023170	So, but I will say the way that Greylog is parsing this data is different than how Kibana is getting this data parsed in.
1023170	1034830	So, you have to consider, if you're looking for an imp hash, there's a possibility, there's a field for it in Greylog, and there's a possibility that there's not a field for it here.
1035290	1042930	They do exist. So, why are imp hashes important? Well, find out.
1045520	1057200	So, what I'm doing here is I'm actually just looking for any imp hash and find out what field that data is in, because there is no imp hash field.
1064010	1071610	So, I've got a few hits on it. Right now, no source and destination IPs, but let's go ahead and expand a log and see what we're looking at.
1074570	1086350	So, we've got a driver called agent.exe and remote IPs, and we've got an imp hash for this file.
1086350	1095490	Now, if you deem this file to be bad at any point, then you now got the imp hash for it and you can find every execution of it.
1095490	1104750	So, that's another quick artifact, but all I did was search the word imp hash, and I found all the logs that have imp hashes associated with it.
1104750	1112570	Now, you're going to have to do some more digging and filtering because, obviously, you're going to find a file with an imp hash that could be legit.
1112970	1119270	So, just something to consider. That's just a plain text query there.
1120790	1129920	Also, more basic, if you're looking for event IDs, everybody knows what a 4624 is.
1130740	1140720	And if you don't, get your event IDs out, Google a sheet of the top event IDs to keep an eye on.
1140720	1148800	Microsoft has a sheet from severity levels that's important to look at.
1149540	1158820	But if you look here, I just looked for all the 4624s for this week, and I'm now looking at all the logons.
1158980	1161940	Successful logons. You've got security IDs.
1163100	1170020	And something I failed to mention, you want to pay attention to the message column here.
1170020	1176300	So, what I like to do is keep the... I'm going to pull this out here.
1176300	1180680	Go down to the message field and actually filter out for that column.
1181100	1193540	Because now, I can just scroll down and start looking through and saying, hey, this is some stuff, but I don't care about S100, Sid.
1194140	1195940	I don't care about that.
1197460	1200500	So, let's see how we can filter that out.
1203620	1205280	So, not.
1207240	1208440	Excuse me.
1209160	1210360	And not.
1236710	1245830	There we go. I just took out all the S100s, and now I can start seeing some other security IDs that have logged in.
1245870	1252050	And if you want, you can go down and start narrowing down the system names. There's your host names there.
1252050	1260050	And you can say, I don't care about ACC1. That guy's a good guy. Let me keep moving. But I do care about...
1261010	1262210	Let's maybe say...
1264170	1265790	Who we got here?
1266330	1267890	Under host name.
1268910	1277330	Oh, that's ACC101 again. But you get the drift, right? I'll filter out for ACC... that was the username, but same difference.
1279890	1282550	So, I've now filtered out for ACC1.
1282550	1288030	I said, I want to see 4624s, but I don't care about S100.
1289650	1291650	That's how you would do that there.
1292170	1300970	You can get a little bit more complex here and start looking at data paths and file paths and image path names.
1301570	1303030	So, let's look at...
1303550	1305590	Let me pull this out here.
1306250	1307530	Flip to a new one.
1310370	1310850	And...
1311830	1312890	I want to see...
1314110	1315590	Let's just look at...
1316650	1318150	System on here.
1319450	1321430	Let's just look at Beats logs.
1322190	1323970	So, I'm going to say, I want to see...
1329710	1337010	Here we go. Something to keep in mind, Beats, right? Beats are the agents that are actually shipping the logs to your log stash.
1337830	1344410	Now, keep in mind, Winlogbeat, Windows event logs, security, application, then you've got your PowerShell logs.
1344410	1348250	Everybody knows PowerShell is always good, but you might want to look at it anyway.
1348490	1349290	Hint, hint.
1349630	1354810	So, what I'm going to do here is go ahead and filter out and say, I just want to see Winlogbeat logs.
1359240	1360000	And then...
1367140	1370180	I want to search for a specific event ID.
1371020	1375000	Or, you know, better yet, let's see if we can start filtering for different file paths.
1375000	1378740	So, let's find the file path field.
1395350	1396510	Here we go.
1396670	1400150	Very minimal logs, right? Where the file path exists.
1400410	1405330	So, here's the file path. I've got users, I've got folders here.
1405330	1409570	But I want to just know where this user here might have looked at...
1410990	1416170	Or what files this user has actually executed, or file created, right?
1416170	1419450	So, let's say I want to filter by file create.
1419450	1420910	So, I go here.
1422630	1428470	And I can either say in a specific path, or I can say a specific user.
1428470	1432890	But I want to know when anything, let's say, created in this AppData path here.
1458080	1460360	So, I'm going to do a regex here.
1468350	1468910	Say...
1468910	1470190	Anything.
1471350	1474190	And then close my regex.
1474250	1475370	Anything.
1478960	1483940	And then, because it's regex, you've got to escape your characters.
1487380	1493680	And we'll take out... for simplicity.
1511570	1513070	There we go.
1513270	1515190	That's a hefty one there.
1515330	1519970	But, I'm down to 32 events in the last 15 minutes, right?
1519970	1525930	That, right there, is I've now narrowed down every time a file was created by Claudia Davis,
1525930	1528510	or maybe not by Claudia Davis, just in her path.
1530490	1532210	In the AppData path.
1532210	1534410	And what's in AppData? Temp folders.
1534410	1536930	So, keep that in mind. Keep going.
1539550	1541410	So, something else you can do.
1542410	1547690	And, if you come across a query, like this hefty one here, that maybe sometimes,
1547690	1551270	oh, I want to just swap out the user and use that search over again.
1551310	1553430	You could just copy and paste it to a text file.
1553430	1558410	Or, you can get real fancy with it and go and start saving some of your searches.
1558410	1564110	And so, Claudia Davis file create.
1564110	1564910	Great.
1566370	1568390	So, you confirm that.
1568890	1575150	And, at any given time, you start opening up a fresh Kibana page.
1577170	1580950	You can go in and say, where's my search?
1580950	1583410	Oh, there we go. Claudia Davis.
1583410	1589310	Because now I want to look at James Brown, or I want to look at Kanye West.
1589410	1592830	So, that's some of the things you want to start doing as you go,
1592830	1594550	because you're going to use these queries over again.
1594550	1599310	If not, you're going to use the shell of it for a different file path for a different user.
1599510	1602370	And that's something that might be useful for you down the line.
1604410	1608230	Now, there's some other stuff you can do with visualizations.
1608230	1617270	So, you can actually pull in a visualization and save search as a visualization,
1618570	1620430	or you can create your own.
1620650	1623850	A lot of times I like to create tables and look at time frames.
1623850	1626390	They're real good for looking at live data,
1626390	1629510	but you can also look at over a span of time and say,
1629510	1633330	hey, I want to see how many times this system has used SMB,
1633330	1638230	or I want to see how many times Quad4 protocol was used.
1638430	1641210	And then you can actually just have it on a table,
1641210	1644710	throw it in a visualization, and pop it up any time you want to start.
1646390	1651190	Just keep in mind, hey, this came across during this time frame that I'm already inspecting.
1651430	1653290	And then you can use that.
1653290	1658270	And I'll just show you a quick one here, because you can get pretty caught up in it.
1662800	1664460	We're going to do the count here.
1680790	1683170	We're going to aggregate it on a term.
1684650	1691810	In the field, we're going to add, let's say, IP source.
1692190	1694230	Excuse me, source IP.
1698450	1699810	There it is.
1700310	1703050	And we're going to say you want to see the top five.
1703950	1707210	You can call that source, you can label it, whatever you want.
1708750	1710090	Hit play.
1710410	1711530	There you go.
1711530	1717450	What this is showing you here is just the log counts for each of these sources here.
1717530	1722790	That's a super quick way to start seeing, in this time frame, who was talking the most.
1722790	1726830	Is that data exfil? Is that port scanning?
1726830	1729210	Is that some of the stuff you want to start paying attention to?
1729210	1730750	Look at the count of the logs.
1730750	1732850	That's a low-level hunt that you can do.
1733290	1738170	But you can go in and you can use the same concept and throw in protocols.
1738170	1740230	You can make a bar graph out of it.
1740230	1742030	You can make a pie graph out of it.
1742030	1745390	But I like to use them more for live hunts.
1745790	1749710	But for this exercise, you're probably going to spend most of your time in Discover.
1759150	1760190	All right.
1760850	1767750	I think I kind of gave you the low-level, or high-level rather, rundown of everything.
1767750	1769170	I don't want to take up more of your time.
1769170	1771070	You've got a lot of tools to learn today.
1771450	1775510	And there's a lot of time you can go spend playing with Kibana.
1776170	1780370	There's a couple of videos out there that you can do.
1780370	1786030	I can give you all some resources if you just hit me up in the Open Sock Discord channel.
1786030	1787630	We've got a Kibana channel.
1787630	1792730	And then also, there's some more advanced Kibana users out there.
1792730	1797170	I'm definitely not the know-all, but I've seen my way around it.
1797490	1804350	But we've got an Ask for Help channel over in the Open Sock Discord willing to answer any questions.
1804350	1810450	A lot of the Open Sock veterans that have played Open Sock before have used Kibana before.
1810450	1817270	They've got some tips and tricks, and they can get you sorted out.
1817270	1819590	So, thank you for your time today.
1819590	1823630	If you need anything, again, just hit us up on the Discord, and we'll talk soon.
1825950	1827250	Thanks a lot, TJ.
1827250	1828610	That was a great talk.
1829050	1834130	As he pointed out, check out the Recon Iposec Discord channel if you're looking for Open Sock questions.
1834350	1837330	They're over there to assist you as needed.
1837730	1839190	I appreciate it. Thanks again.