{"id":2431,"date":"2026-03-10T19:26:00","date_gmt":"2026-03-10T19:26:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=2431"},"modified":"2026-03-10T15:26:38","modified_gmt":"2026-03-10T15:26:38","slug":"zeek-excercises","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=2431","title":{"rendered":"Zeek Excercises"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/zeekbroexercises<\/a>
Created by: tryhackme

More Zeek sounds exciting to me! I had a blast with the other room: https:\/\/tryhackme.com\/room\/zeekbro<\/a>!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“”Investigate the\u00a0dns-tunneling.pcap<\/strong>\u00a0file.\u00a0Investigate the\u00a0dns.log<\/strong>\u00a0file. What is the number of DNS records linked to the IPv6 address?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“Investigate the\u00a0conn.log<\/strong>\u00a0file. What is the longest connection duration?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Investigate the\u00a0dns.log<\/strong>\u00a0file. Filter all unique DNS queries. What is the number of unique domain queries?”

This was kind of tricky!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

So we can assume there is a lot of “cisco-update.com” in this so let’s exclude that. Doing so, we see there are 5 others and then including cisco-update.com will make it a total of 6(the answer).<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“There are a massive amount of DNS queries sent to the same domain. This is abnormal. Let’s find out which hosts are involved in this activity. Investigate the\u00a0conn.log<\/strong>\u00a0file. What is the IP address of the source host?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 3, Phishing!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Investigate the logs. What is the suspicious source address? Enter your answer in\u00a0defanged format<\/strong>.”

They want this in the defanged format, which would be 10[.]6[.]27[.]102<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Investigate the\u00a0http.log<\/strong>\u00a0file. Which domain address were\u00a0the malicious files\u00a0downloaded from?\u00a0Enter your answer in\u00a0defanged format.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Investigate the malicious document in VirusTotal. What kind of file is associated with the malicious document?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Investigate the extracted malicious\u00a0.exe<\/strong>\u00a0file. What is the given file name in Virustotal?”

If you try to find the md5 hash of the file, you will be unable to find it. That is because we need to run one of the zeek scripts.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I decided to use the file-extract-demo.zeek. Doing so, we see the extracted formats of the file. Obtaining this, we can run md5sum to obtain the md5 hash value to look up on virustotal.com!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“Investigate the malicious\u00a0.exe<\/strong>\u00a0file in VirusTotal. What is the contacted domain name?\u00a0Enter your answer in\u00a0defanged format<\/strong>.”

We can use the previous commands to assist with this. Stay in \/extract_files dir. We are looking at the third extracted log.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“Investigate the\u00a0http.log\u00a0file. What is the request name of the downloaded malicious\u00a0.exe<\/strong>\u00a0file?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Investigate the malicious\u00a0.exe<\/strong>\u00a0file in VirusTotal. What is the contacted domain name?\u00a0Enter your answer in\u00a0defanged format<\/strong>.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Investigate the\u00a0http.log\u00a0file. What is the request name of the downloaded malicious\u00a0.exe<\/strong>\u00a0file?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to the last task, task 4 Log4J!

“Investigate the\u00a0log4shell.pcapng file\u00a0with\u00a0detection-log4j.zeek\u00a0script.\u00a0Investigate the\u00a0signature.log\u00a0file. What is the number of signature hits?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

We see 3.<\/p>\n\n\n\n

“Investigate the http.log<\/strong> file. Which tool is used for scanning?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Investigate the\u00a0http.log<\/strong>\u00a0file. What is the extension of the exploit file?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Investigate the\u00a0log4j.log\u00a0file.\u00a0Decode the base64 commands. What is the name of the created file?”<\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/zeekbroexercisesCreated by: tryhackme More Zeek sounds exciting to me! I had a blast with the other room: https:\/\/tryhackme.com\/room\/zeekbro! “”Investigate the\u00a0dns-tunneling.pcap\u00a0file.\u00a0Investigate the\u00a0dns.log\u00a0file. What is the number of DNS records linked to the IPv6 address?” “Investigate the\u00a0conn.log\u00a0file. What is the longest connection duration?” “Investigate the\u00a0dns.log\u00a0file. Filter all unique DNS queries. What is the number of unique domain […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2431","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/2431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2431"}],"version-history":[{"count":2,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/2431\/revisions"}],"predecessor-version":[{"id":2463,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/2431\/revisions\/2463"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}