The following TQL queries are Bro-specific.
Note
Zeek (formerly Bro) logs are generated by Cloud Collector, which is being replaced by the Network Security Evidence Collector sensor (class
fireeye_nx).
MD5 hash for every file that crosses a monitored network segment
class=bro_files | groupby md5
MD5 hash for every file sourced from a network located in China
class:bro_files srccountry:"china" | groupby md5
Mimetype for every file
class:bro_files | groupby mimetype
All source countries for .exe files
class:bro_files mimetype:"application/x-dosexec" | groupby srccountry
All RAR files that were transferred
class:bro_files mimetype:"application/x-rar"
All source IP addresses and source countries in logged SSH connections
class:bro_ssh | groupby [srcipv4,srccountry]
Compliance – different IE versions within network
class:bro_http "msie" | groupby useragent
Compliance – vulnerable versions of Java?
class:bro_software "java" | groupby content
Identify inbound RDP activity from any external (nonroutable under RFC1918) address
dstport:3389 and not srcisp:"private ip address lan"
Identify RDP activity originating from a specific system to any destination
srcipv4:"10.0.0.1" dstport:3389 | groupby dstipv4
Identify SMB activity originating from a specific system to any destination port in a non-inclusive range
srcipv4:"10.0.0.1" dstport:(<5354-6000>) | groupby dstipv4
Identify all DNS connections originating from a specific system
dstipv4:"10.0.0.1" dstport:53 | groupby srcipv4
Identify large outbound transmissions of data
!dstisp:["private ip address lan"] sentbytes>10000000 | groupby [dstipv4,dstdomain,dstisp]