Expert 5: Large-Scale PCAP Analysis - Memproses Traffic GB-scale dengan Zeek

cd ~ && mkdir forensics-exp5 && cd forensics-exp5

# 1. Zeek log structure
echo "=== Zeek Log Files ==*"
cat << 'ZEEK'
Zeek menghasilkan log terpisah untuk setiap protokol:
  conn.log        → Semua koneksi TCP/UDP/ICMP (summary)
  http.log        → HTTP requests & responses
  dns.log         → DNS queries
  ssl.log         → TLS/SSL certificates & handshake
  ftp.log         → FTP credentials (username/password!)
  smtp.log        → Email traffic
  files.log       → File transfers over protocols
  notice.log      → Anomaly detection alerts
  weird.log       → Protocol violations & errors
ZEEK

# 2. Simulasi output Zeek
python3 << 'PYEOF'
print("=== conn.log (Connection Summary) ==*")
conns = [
    ("192.168.1.10:49152", "142.250.80.78:80", "tcp", "80", "SF", 4500),
    ("192.168.1.10:33333", "203.0.113.5:4444", "tcp", "1000000", "SF", 104857600),  # 🚩 100MB transfer!
    ("192.168.1.10:53", "8.8.8.8:53", "udp", "100", "SF", 500),
    ("10.0.0.5:80", "203.0.113.5:54321", "tcp", "50000", "RSTO", 25000),
]
print(f"{'Source':<25} {'Dest':<25} {'Proto':<8} {'Bytes':<12} {'State':<8}")
print("-"*80)
for src, dst, proto, bytes_sent, state, orig_bytes in conns:
    sus = " 🚩" if int(bytes_sent) > 1000000 else ""
    print(f"{src:<25} {dst:<25} {proto:<8} {bytes_sent:<12} {state:<8}{sus}")
PYEOF

# 3. Simulasi notice.log (Zeek anomaly detection)
echo ""
echo "=== notice.log (Anomaly Alerts) ==*"
cat << 'NOTICE'
#fields	ts	uid	id.orig_h	id.resp_h	note	msg
2026-06-18T08:00:00	C1	192.168.1.10	203.0.113.5	SSH::BruteForce	SSH brute force detected (15 attempts in 30s)
2026-06-18T08:05:00	C2	192.168.1.10	203.0.113.5	Conn::DataExfil	Data transfer > 100MB to external IP
2026-06-18T08:06:00	C3	192.168.1.10	8.8.8.8	DNS::Tunneling	DNS query with high entropy subdomain
2026-06-18T08:10:00	C4	192.168.1.10	203.0.113.5	Weird::Activity	Protocol violation on port 4444
NOTICE

# 4. YARA rule untuk deteksi PCAP
echo ""
echo "=== YARA Rule - PCAP Detection ==*"
cat << 'YARA'
rule DetectExfiltration {
    meta:
        description = "Detect data exfiltration pattern in PCAP"
        author = "TDCTF Security Academy"
    strings:
        $creditcard = /[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}/
        $password = /password[\s:=]+[^\s]{4,30}/i
        $http_post = "POST /upload"
        $large_body = "Content-Length: 1"
    condition:
        ($http_post and $creditcard) or 
        ($http_post and $password) or
        #filesize > 100MB
}
YARA

# 5. Pipeline analisis skala besar
echo ""
echo "=== Large-Scale Pipeline ==*"
cat << 'PIPELINE'
Untuk PCAP > 1GB, workflow yang efisien:

1. INDEX
   $ zeek -r traffic.pcap /usr/share/zeek/policy/*.zeek
   → Menghasilkan 10+ log file (.log)

2. FILTER & REDUCE
   $ cat conn.log | zeek-cut ts proto service orig_bytes | sort -k3 -rn | head -20
   → Top connections by bytes transferred

3. DETECT (Zeek intelligence)
   $ zeek -C -r traffic.pcap intelligence/notice.zeek
   → Otomatis mendeteksi C2, malware, phishing domains

4. CORRELATE
   $ cat notice.log weird.log | python3 correlate.py
   → Gabungkan multiple source untuk deteksi akurat

5. VISUALIZE
   $ zkg install zeek-elasticsearch
   → Kirim log ke Elasticsearch → Kibana dashboard
PIPELINE