Bro file TQL queries

Prev Next

The following TQL queries are for Bro files.

Identify HTTP requests and responses
has:uri has:useragent
    Identify outbound file transfers grouped by country
    class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" | groupby dstcountry
      Identify outbound file transfers (non-SSL) grouped by country
      class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" not service:ssl | groupby dstcountry
        Identify outbound file transfers greater than 1MB grouped by country
        class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>1000000 | groupby dstcountry
          Identify outbound file transfers greater than 1MB grouped by filename
          class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>"1000000" | groupby filename
            Identify outbound file transfers greater than 10MB grouped by country
            class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>10000000 | groupby dstcountry
              Identify outbound file transfers greater than 10MB grouped by filename
              class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>10000000 | groupby filename
                Identify outbound file transfers greater than 100MB grouped by country
                class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>100000000 | groupby dstcountry
                  Identify outbound file transfers greater than 100MB grouped by filename
                  class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>100000000 | groupby filename
                    Identify the most frequent non-text files (mimetype)
                    class:bro_files has:mimetype not mimetype:text* | groupby mimetype
                      Identify the most frequent non-text files (mimetype) transferred from outside to inside
                      class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") has:mimetype not mimetype:text* | groupby mimetype
                        Identify the most frequent application types transferred from outside to inside
                        class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") mimetype:application* | groupby mimetype
                          Identify all files with the listed mime types that were downloaded
                          class:bro_files AND (mimetype:["application/x-zip","application/x-ms-cab","application/zip","application/x-gzip","application/x-zip-compressed","application/x-7z-compressed","application/x-bzip2","application/x-tar","application/x-rar"])
                            Identify all files with the listed mime types transferred from outside to inside
                            class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") (mimetype:["application/x-zip","application/x-ms-cab","application/zip","application/x-gzip","application/x-zip-compressed","application/x-7z-compressed","application/x-bzip2","application/x-tar","application/x-rar"]) | groupby mimetype
                              Identify all files with the listed mime types transferred from inside to outside
                              class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" (mimetype:["application/x-zip","application/x-ms-cab","application/zip","application/x-gzip","application/x-zip-compressed","application/x-7z-compressed","application/x-bzip2","application/x-tar","application/x-rar"]) | groupby mimetype
                                Identify all WinRAR archives (mimetype)
                                class:bro_files has:filename mimetype:"application/x-rar" | groupby filename
                                  Identify all WinRAR archives (mimetype) transferred from outside to inside
                                  class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") has:filename mimetype:"application/x-rar" | groupby filename
                                    Identify all WinRAR archives (mimetype) transferred from outside to inside grouped by country
                                    class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") has:filename mimetype:"application/x-rar" | groupby [srccountry,srcisp]
                                      Identify all WinRAR archives (mimetype) transferred from inside to outside
                                      class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" has:filename mimetype:"application/x-rar" | groupby filename
                                        Identify all WinRAR archives (mimetype) transferred from inside to outside grouped by country
                                        class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" has:filename mimetype:"application/x-rar" | groupby [dstcountry,dstisp]
                                          Identify all executable files (mimetype)
                                          class:bro_files (mimetype:"application/x-dosexec" OR mimetype:"application/x-msdos-program") | groupby filename
                                            Identify all executable files (mimetype) transferred from outside to inside grouped by mimetype
                                            class:bro_files not stisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") (mimetype:"application/x-dosexec" OR mimetype:"application/x-msdos-program") | groupby mimetype
                                              Identify all executable files (mimetype) transferred from inside to outside grouped by mimetype
                                              class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" (mimetype:"application/x-dosexec" OR mimetype:"application/x-msdos-program") | groupby mimetype
                                                Identify WinRAR archives (mimetype) without “.rar” file extension
                                                class:bro_files has:filename not filename:/\.rar$/ mimetype:"application/x-rar" not service:smtp | groupby filename
                                                  Identify executable files (mimetype) without “.exe” extension
                                                  class:bro_files has:filename not filename:/\.exe$/ (mimetype:"application/x-dosexec" OR mimetype:"application/x-msdos-program") not service:smtp | groupby filename