zeek-conn-log-analysis

Zeek conn.log Analysis

When to Use

• During network forensics investigations or active threat hunting to identify compromised hosts communicating with Command and Control (C2) infrastructure.
• To detect unusual network baseline deviations without relying entirely on deep packet inspection or payload signatures.

Prerequisites

• Forensic image or live access to the affected system(s)
• Forensic workstation with analysis tools (Autopsy, Volatility, Timeline Explorer)
• Chain of custody documentation initiated for evidence handling
• Write-blocker for disk forensics or memory acquisition tool (e.g., DumpIt, WinPmem)

Workflow

Phase 1: Understanding conn.log Structure

# head conn.log | zeek-cut -c ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state

Phase 2: Hunting for C2 Beaconing (Frequency Analysis)

# cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration | \
awk '{print $1, $2, $3}' | sort | uniq -c | sort -nr | head -n 20

Phase 3: Identifying Long-Connections (Data Exfil / Interactive Shells)

# cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes | \
awk '$4 > 3600 {print $0}' | sort -nrk 4

Phase 4: Detecting Odd Port-Service Mismatches

# cat conn.log | zeek-cut id.resp_p service | grep -E '^443\s+http$' | less

# cat conn.log | zeek-cut id.resp_p service | grep -E '^80\s+ssl$' | less

Decision Point 🔀

flowchart TD
    A[Parse conn.log ] --> B{Anomalies Found ]}
    B -->|Yes| C[Correlate Logs ]
    B -->|No| D[Tune Heuristics ]
    C --> E[Isolate Host ]

🔵 Blue Team Detection & Defense

• Automate Beacon Tracking (RITA / Zeek Detect): Threat Intelligence Feeds: Baseline Internal Traffic: Key Concepts | Concept | Description | |---------|-------------|

Output Format

Zeek Conn Log Analysis — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]