Unit 8: Scans, beacons and leaks · Lesson 4 of 6 · 18 min
Hunting in flow records
Use firewall flow records, not packets, to find a beacon and an upload across a whole afternoon.
mission
- You are
- The analyst at a site without packet capture.
- Situation
- Most networks keep flow records, not packets: one row per connection with addresses, port and byte counts. They cover far more time for far less storage.
- Goal
- Find the beacon and the biggest upload using only the flow table.
- Hand in
- The destination with identical repeated flows and the destination of the largest upload.
One flow record
- 1
15:20:10start - 2
10.10.0.57 to 198.51.100.200:443who to whom, on which port - 3
2113400bytes out - 4
5200bytes in - 5
41.8 sduration
Sort by bytes out
Click the bytes_out column header twice to sort largest first.
you should see One flow sent about 2 MB and received almost nothing. Every other flow sends a few kB.
defender tip Uploads that dwarf their downloads are rare in normal office traffic. Ratio is often a better alert than size alone.
Look for repeats
Type 203.0.113 in the filter, then sort by start time.
you should see Rows a minute apart with exactly the same byte counts every time.
Compare with a busy but normal host
Filter for 10.20.0.40, the intranet. It also has many flows.
you should see Many flows, but irregular times and different sizes. Busy is not the same as suspicious.
Weighing what leaves
Turn the pattern into an alert
A beacon shows up in flows as many small sessions to one destination at a fixed interval. An upload shows up as one session with bytes out far larger than bytes in.
you should see Two flow alert rules you could add to the SIEM.
What a defender takes away
- 1Flow records cover days of traffic cheaply. Start hunts there.
- 2Identical repeated rows mean a program. Lopsided bytes out mean an upload.
- 3Use flows to pick the hour, then go to packets or host logs for detail.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.