Hunting Malware with Suricata Metadata
summary
Suricata is used as a metadata engine to speed detection by producing HTTP/DNS/TLS logs, JA3 and community ID, file identifications and file extraction to /var/log/suricata, and alerts that tie to flows. Demos replay PCAPs on SELKS, hunt DryDex where three alerts map to one flow for a single PE download, inspect SMTP exfil and an RTF template-injection that fetches nv.exe, and show Arkime, Kibana and EveBox pivoting. File extraction requires enabling file-store and a simple rule; it works but can fail on file-permission misconfiguration.
AI-written summary · about
chapters (19)
- 0:00Introduction and OISF
- 3:54Suricata Features Overview
- 7:34Roadmap and Conferences
- 8:32SELKS and Toolset
- 10:42Rule Management
- 12:58Offline PCAP Analysis
- 17:00Exploring EVE JSON Data
- 20:02Analyzing Alerts and TLS
- 23:30File Identification
- 25:26Signature ID Investigation
- 27:36Pivoting on Flow ID
- 30:51File Information and Hashes
- 33:44TLS Metadata Analysis
- 37:00Commodity Stealer Analysis
- 41:07File Extraction Techniques
- 46:19Using EveBox for Alerting
- 49:14Advanced Malware Analysis
- 56:07Conclusion
- 57:37Security Onion Integration
related talks
40mLeveraging Suricata in the Enterprise: Shifting from Events to Insights
40mHunt and Gather: Developing Effective Threat Hunting Techniques
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
30mSpotting Threats with Elastic SIEM
33mBasic Malware Analysis for Incident Responders
29mHunting and Stopping Threats with Elastic Security
01h 03mEffects Malware hunting in Cloud environment
27mCollect All the Data; Protect All the Things