n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v4.0: Shadow SOC framing — Zeek/Suricata/RITA offline analysis, innocuous MAC profiles, operator workstation as SOC analysis brain

Browse Source
This commit is contained in:
n0mad1k
2026-03-17 15:28:15 -04:00
parent 0a80f8bed8
commit 813e224b03
1 changed files with 58 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BIGBROTHER_DESIGN.md
+58 -15
View File
@@ -1,4 +1,4 @@
# BigBrother: Network Surveillance Orchestrator + Operator Jump Box
# BigBrother: Shadow SOC — Red Team Network Surveillance Platform
> **Version**: 4.0
> **Date**: 2026-03-17
@@ -29,14 +29,14 @@
## 1. Overview
BigBrother is an **orchestrator of proven tools** combined with lightweight custom metadata extraction, designed for authorized red team engagements. It deploys on Raspberry Pi (Zero 2W through Pi 4) or full Debian hosts, operating as an inline transparent bridge or passive tap.
BigBrother is a **Shadow SOC** — it gives you the same network visibility a defensive Security Operations Center has, but deployed covertly on a target network for red team operations. SOC-grade visibility, used offensively to find the best attack paths.
The v4.0 architecture follows a strict division of labor:
The platform operates as two halves:
- **On-device**: packet capture (tcpdump), lightweight metadata extraction to SQLite (DNS, SNI, credentials, hosts, flows), MITM orchestration (bettercap), stealth, connectivity, structured data aggregation
- **Offline on operator workstation**: file carving, email reconstruction, print job reconstruction, VoIP audio extraction, deep protocol analysis, report generation, GPU hash cracking
- **The implant** (Pi or Debian host): captures everything (tcpdump full PCAP), extracts real-time metadata to SQLite (DNS, SNI, credentials, Kerberos, hosts, flows), orchestrates attacks (bettercap, Responder, mitmproxy), and stays hidden (stealth layer).
- **The operator workstation**: runs the SOC analysis stack (Zeek, Suricata, RITA) against pulled PCAPs to get defender-grade protocol logs, IDS alerts, and behavioral analytics — then uses those findings to decide what to attack.
Custom Python exists only where no existing tool covers the need. bettercap replaces all custom ARP/DNS/DHCP/HTTP/SSL active modules. tcpdump replaces custom scapy packet capture. Processing-heavy operations move to the operator's workstation, run against PCAPs pulled from the device.
Custom Python exists only where no existing tool covers the need. bettercap replaces all custom MITM modules. tcpdump replaces custom packet capture. Zeek/Suricata/RITA run offline on the operator's workstation. The implant captures and extracts; the workstation analyzes.
**Operational modes**: **Passive surveillance** runs unsupervised from deployment -- tcpdump captures everything, lightweight Python modules extract metadata (DNS queries, TLS SNI, credentials, Kerberos tickets, host inventory, traffic flows) into queryable SQLite databases. **Active surveillance** is operator-enabled -- bettercap for ARP/DNS/DHCP spoofing, Responder for hash capture, mitmproxy for HTTPS interception. Once enabled, runs unattended.
@@ -816,17 +816,54 @@ class BettercapAPI:
---
## 10. Operator Workstation
## 10. Operator Workstation — Shadow SOC
Processing-heavy analysis runs on the operator's machine, not the Pi. The operator pulls structured data and PCAPs from BigBrother, then uses standard tools for deep analysis.
The operator's workstation is the analysis brain. The Pi captures and extracts real-time metadata. The workstation runs **SOC-grade analysis against pulled PCAPs** — giving you defender-level visibility to make better attack decisions.
### Analysis Tools
### Shadow SOC Analysis Stack
Run these against PCAPs pulled from BigBrother. This gives you the same visibility a blue team SOC has, used offensively.
| Tool | What It Gives You (Offensively) |
|---|---|
| **Zeek** (offline mode) | Protocol logs (conn.log, dns.log, http.log, ssl.log, smb.log, kerberos.log, files.log). Shows: every service version, every cert (expired, self-signed, weak), every SMB dialect, every HTTP header. Tells you exactly what's vulnerable without scanning. |
| **Suricata** (offline mode) | IDS alerts against the TARGET's traffic. Finds: existing malware/C2, policy violations, vulnerable service fingerprints, cleartext credentials, anomalous protocols. You see what their SOC would see — or what they're missing. |
| **RITA** (Real Intelligence Threat Analytics) | Ingests Zeek logs. Detects: C2 beacons, DNS tunneling, long connections, data exfil patterns. Finds existing compromises on the network before you even start attacking. |
| **Wireshark/tshark** | Deep packet inspection, stream reconstruction, manual protocol analysis |
| **NetworkMiner** | Automated file/image/credential extraction from PCAPs, OS fingerprinting |
### Shadow SOC Workflow
```
Day 1-7: BigBrother runs passive on target network
Day 7: Operator pulls PCAPs + metadata to workstation
└── scripts/operator/pull_data.sh
Run Shadow SOC analysis:
└── scripts/operator/run_zeek.sh → Zeek logs (conn, dns, http, ssl, smb, kerberos, files)
└── scripts/operator/run_suricata.sh → IDS alerts on target traffic
└── scripts/operator/run_rita.sh → Beacon/C2/exfil detection from Zeek logs
Review findings:
- Zeek ssl.log: "10.0.1.5 presents expired cert, TLS 1.0, RC4 cipher" → vulnerable
- Zeek smb.log: "10.0.1.10 negotiates SMBv1" → EternalBlue candidate
- Zeek http.log: "10.0.1.102 → 10.0.1.5:1433 cleartext SQL" → db_interceptor confirmed
- Suricata: "ET POLICY SMBv1 Negotiate" → confirms SMBv1 in use
- Suricata: "ET MALWARE Known C2 beacon to 185.x.x.x" → target already compromised
- RITA: "10.0.1.108 beacons to external IP every 3600s ± 120s" → possible existing implant
- Zeek kerberos.log: "SVC_BACKUP requests TGS for CIFS/DC01" → Kerberoastable SPN
Day 8: Use Shadow SOC intel to pick targets + activate attack modules
- Zeek showed SMBv1 on NAS → target for EternalBlue or relay
- Suricata showed cleartext SQL → db_interceptor already capturing creds
- RITA found existing beacon → document for client report (huge finding)
- Kerberos log showed service accounts → kerberos_harvester already has the hashes
```
### Content Extraction Tools
| Tool | Purpose |
|---|---|
| **Wireshark/tshark** | PCAP analysis, protocol dissection, stream following |
| **NetworkMiner** | Automated file extraction, credential extraction, OS fingerprinting from PCAPs |
| **Zeek** | Offline protocol analysis, connection logs, file extraction, SSL cert logs |
| **pcl2pdf / Ghostscript** | Reconstruct print jobs from TCP/9100 traffic in PCAPs |
| **hashcat + GPU** | Crack NTLMv2, Kerberos TGS, AS-REP, WPA handshakes |
| **john** | CPU cracking fallback |
@@ -837,19 +874,25 @@ Processing-heavy analysis runs on the operator's machine, not the Pi. The operat
| Script | Purpose |
|---|---|
| `pull_data.sh` | rsync over Tailscale/WG: creds DB, DNS logs, host inventory, PCAPs |
| `run_zeek.sh` | Run Zeek offline against PCAPs → generate protocol logs |
| `run_suricata.sh` | Run Suricata offline against PCAPs → IDS alerts on target traffic |
| `run_rita.sh` | Run RITA against Zeek logs → beacon/C2/exfil detection |
| `extract_files.sh` | tshark + NetworkMiner batch file extraction from PCAPs |
| `extract_print_jobs.sh` | Filter TCP/9100 from PCAPs, reconstruct with pcl2pdf/Ghostscript |
| `extract_emails.sh` | Filter SMTP from PCAPs, reconstruct with tshark |
| `crack_hashes.sh` | Export from credential_db in hashcat format, run against wordlists |
| `generate_report.py` | Pull SQLite DBs from BigBrother, generate engagement report (Markdown + HTML) |
| `generate_report.py` | Pull SQLite DBs + Zeek/Suricata findings, generate engagement report (Markdown + HTML) |
### Workstation Requirements
- Linux or macOS (Windows works but scripts assume bash)
- Tailscale installed (same tailnet as implant)
- **Zeek** installed (offline PCAP analysis)
- **Suricata** installed with ET ruleset (offline IDS)
- **RITA** installed (beacon/C2 analytics from Zeek logs)
- hashcat with GPU (NVIDIA recommended)
- 50GB+ free disk for PCAP analysis
- Wireshark, tshark, NetworkMiner, Zeek installed
- 100GB+ free disk for PCAP analysis + Zeek/Suricata output
- Wireshark, tshark, NetworkMiner installed
---