[Bro] Exfil Framework Released

[Kellogg, Brian D (OLN)]

Here's some quick additions to the app-exfil-conn.bro script.


##! Watch all TCP,UDP,ICMP flows for Data Exfil

module Exfil;

export {
    ## Defines which subnets are monitored for data exfiltration
    global watched_subnets_conn: set[subnet] = [10.0.0.0/8] &redef;
    ## Defines which subnet/host sources to ignore
    global ignored_orig_conn: set[subnet] = [10.1.1.1/32, 10.3.4.0/24] &redef;
    ## Defines which subnet/host destinations to ignore
    global ignored_resp_conn: set[subnet] = [110.1.143.77/32, 9.3.4.0/24] &redef;
    ## Defines whether connections with local destinations should be monitored for data exfiltration
    global ignore_local_dest_conn: bool = T &redef;
    ## Defines the thresholds and polling interval for the exfil framework. See main.bro for more details.
    global settings_conn: Settings &redef;
}

event connection_established (c: connection) {

    if (ignore_local_dest_conn == T && Site::is_local_addr(c$id$resp_h) == T)
        return;

    if (c$id$orig_h !in watched_subnets_conn )
        return;

    if (c$id$orig_h in ignored_orig_conn )
        return;

    if (c$id$resp_h in ignored_resp_conn )
        return;

    Exfil::watch_connection(c , settings_conn);

}

-----Original Message-----
From: bro-bounces at bro.org [mailto:bro-bounces at bro.org] On Behalf Of Robert Rotsted
Sent: Wednesday, September 10, 2014 3:14 PM
To: Bro Mailing List
Subject: [Bro] Exfil Framework Released

Hi all,

As announced at BroCon, Reservoir Labs just released the Exfil Framework on Github.

The Exfil Framework is a suite of Bro scripts that detect file uploads in TCP connections. The Exfil Framework can detect file uploads in most TCP sessions including sessions that have encrypted payloads (SCP,SFTP,HTTPS).

The scripts are located at:
https://github.com/reservoirlabs/bro-scripts/tree/master/exfil-detection-framework

Feel free to reach out to me if you have any questions, comments or suggestions for improvement.

Best,

Bob

--
Bob Rotsted
Senior Engineer
Reservoir Labs, Inc.
_______________________________________________
Bro mailing list
bro at bro-ids.org
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro