Man or Machine?
This one is simple. There's a pcap which contains 100 SSH connections.
Only 1 of the connections was human driven. The rest weren't. All we want to know is the source port number for that 1 connection. You ONLY have 2 attempts, so don't bruteforce guess!
All the connections used the same client, server, and configurations. If everything is the same and the payload contents are encrypted, what else could you compare?
Lets run the pcap through the ssh protocols
@load base/protocols/ssh
@load base/frameworks/notice
redef exit_only_after_terminate = F;
event zeek_init(){
}
.
├── 100-ssh.pcap
├── conn.log
├── main.zeek
├── packet_filter.log
└── ssh.log
Looking for interesting metrics in the log output. ssh.log doesn't show much. However in the conn.log we find the following line.
1580833725.124151 CgvmB23cju7ppajiwf 127.0.0.1 54712 127.0.0.1 22 tcp ssh 53.446830 7173 3274189 SF - - 0 ShAdDaFf 20466 1071413 34606 5073721 - 1:vp2K1lvIUDDpljQ8WIBn+8DF/Xs=
We find this entry had substantially more
orig_ip_bytes
The solution
54712
Last modified 2yr ago