Search proxy logs for beaconing hosts

mikefoti — Tue, 09 Sep 2014 22:08:53 GMT

I'm trying to search proxy logs for beaconing hosts. Let's define beaconing as:
- visiting the same url
- using the same HTTP Method
- at a regular interval (say 60 seconds +/- 5s)
- at least 9 times

| transaction client_ip URL Method minpause=55s maxpause=65s | where eventcount > 10

My first problem is the lack of a MINPUASE command.
Any suggestions?

Re: Search proxy logs for beaconing hosts

lguinn2 — Wed, 10 Sep 2014 16:31:59 GMT

Try this

yoursearchhere
| eventstats count as total_events by client_ip URL Method
| where total_events > 8
| sort client_ip URL Method _time
| streamstats current=f window=1 global=f last(_time) as prev_time by client_ip URL Method
| eval time_diff = _time - prev_time
| transaction client_ip URL Method maxpause=65s
| where time_diff >= 55 and eventcount > 8

This may not be exactly what you want, but perhaps it will give you some new ideas...

I used eventstats to eliminate as many client_ip's as I could, before creating the transactions. This should make the transaction command run faster. I also calculated the time difference between events so that I could use it later to implement the "minpause" idea.

topic Search proxy logs for beaconing hosts in Security

Search proxy logs for beaconing hosts

Re: Search proxy logs for beaconing hosts