From b6d9d7a738983be1c360d2920c9be27b3c1f62cb Mon Sep 17 00:00:00 2001 From: n0mad1k Date: Tue, 17 Mar 2026 15:32:12 -0400 Subject: [PATCH] =?UTF-8?q?Drop=20Suricata/RITA=20=E2=80=94=20Zeek=20is=20?= =?UTF-8?q?the=20offensive=20analysis=20tool,=20IDS=20is=20not=20our=20job?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- BIGBROTHER_DESIGN.md | 71 ++++++++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 33 deletions(-) diff --git a/BIGBROTHER_DESIGN.md b/BIGBROTHER_DESIGN.md index 9994855..40789ef 100644 --- a/BIGBROTHER_DESIGN.md +++ b/BIGBROTHER_DESIGN.md @@ -34,9 +34,9 @@ BigBrother is a **Shadow SOC** — it gives you the same network visibility a de The platform operates as two halves: - **The implant** (Pi or Debian host): captures everything (tcpdump full PCAP), extracts real-time metadata to SQLite (DNS, SNI, credentials, Kerberos, hosts, flows), orchestrates attacks (bettercap, Responder, mitmproxy), and stays hidden (stealth layer). -- **The operator workstation**: runs the SOC analysis stack (Zeek, Suricata, RITA) against pulled PCAPs to get defender-grade protocol logs, IDS alerts, and behavioral analytics — then uses those findings to decide what to attack. +- **The operator workstation**: runs Zeek against pulled PCAPs to get structured protocol logs (ssl.log, smb.log, http.log, kerberos.log, etc.) showing every service version, every cert, every vulnerability — then uses those findings to decide what to attack. -Custom Python exists only where no existing tool covers the need. bettercap replaces all custom MITM modules. tcpdump replaces custom packet capture. Zeek/Suricata/RITA run offline on the operator's workstation. The implant captures and extracts; the workstation analyzes. +Custom Python exists only where no existing tool covers the need. bettercap replaces all custom MITM modules. tcpdump replaces custom packet capture. Zeek runs offline on the operator's workstation for deep protocol analysis. The implant captures and extracts; the workstation analyzes. **Operational modes**: **Passive surveillance** runs unsupervised from deployment -- tcpdump captures everything, lightweight Python modules extract metadata (DNS queries, TLS SNI, credentials, Kerberos tickets, host inventory, traffic flows) into queryable SQLite databases. **Active surveillance** is operator-enabled -- bettercap for ARP/DNS/DHCP spoofing, Responder for hash capture, mitmproxy for HTTPS interception. Once enabled, runs unattended. @@ -64,7 +64,7 @@ BigBrother is not an autonomous attack framework. The operator makes all decisio | Flow/beacon analysis | Engagement report generation | | MITM orchestration (bettercap) | GPU hash cracking (hashcat) | | Change/burn detection | Certificate chain analysis | -| Auth flow tracking, SMB metadata | Network forensics (Zeek + RITA) | +| Auth flow tracking, SMB metadata | Protocol analysis (Zeek logs) | ### Module Counts @@ -822,13 +822,23 @@ The operator's workstation is the analysis brain. The Pi captures and extracts r ### Shadow SOC Analysis Stack -Run these against PCAPs pulled from BigBrother. This gives you the same visibility a blue team SOC has, used offensively. +The core offline tool is **Zeek**. Run it against pulled PCAPs and it produces structured protocol logs that tell you exactly what's vulnerable, what's misconfigured, and where to attack — without ever scanning the network. -| Tool | What It Gives You (Offensively) | +| Zeek Log | What It Tells You (Offensively) | +|---|---| +| **ssl.log** | Every TLS cert on the network: expired certs (users trained to click through warnings → MITM viable), self-signed certs (same), weak ciphers (RC4, 3DES), old TLS versions (1.0/1.1 → downgrade attacks), cert SANs (internal hostnames revealed) | +| **smb.log** | SMB versions negotiated per host: SMBv1 = EternalBlue candidate, no signing = relay target, shares accessed, filenames transferred | +| **http.log** | Every cleartext HTTP request: URLs, headers, user-agents, POST bodies. Find internal apps with no TLS, default admin panels, API endpoints with hardcoded tokens | +| **kerberos.log** | Every Kerberos exchange: SPNs (Kerberoast targets), encryption types (RC4 = weak, easier to crack), auth failures (password spray opportunities) | +| **dns.log** | Complements on-device dns_logger with response analysis: NXDOMAIN patterns, internal zone structure, DNS-based service discovery | +| **conn.log** | Every connection: source, dest, port, protocol, duration, bytes. Map all communication patterns, find long-lived sessions, identify servers vs clients | +| **files.log** | Every file transferred over HTTP/SMB/FTP: filename, size, MIME type, hash. Find sensitive documents moving in cleartext | +| **x509.log** | Certificate chain details: CA hierarchy, key sizes, validity periods. Map the target's PKI | + +**Also on workstation:** + +| Tool | Purpose | |---|---| -| **Zeek** (offline mode) | Protocol logs (conn.log, dns.log, http.log, ssl.log, smb.log, kerberos.log, files.log). Shows: every service version, every cert (expired, self-signed, weak), every SMB dialect, every HTTP header. Tells you exactly what's vulnerable without scanning. | -| **Suricata** (offline mode) | IDS alerts against the TARGET's traffic. Finds: existing malware/C2, policy violations, vulnerable service fingerprints, cleartext credentials, anomalous protocols. You see what their SOC would see — or what they're missing. | -| **RITA** (Real Intelligence Threat Analytics) | Ingests Zeek logs. Detects: C2 beacons, DNS tunneling, long connections, data exfil patterns. Finds existing compromises on the network before you even start attacking. | | **Wireshark/tshark** | Deep packet inspection, stream reconstruction, manual protocol analysis | | **NetworkMiner** | Automated file/image/credential extraction from PCAPs, OS fingerprinting | @@ -839,25 +849,24 @@ Day 1-7: BigBrother runs passive on target network Day 7: Operator pulls PCAPs + metadata to workstation └── scripts/operator/pull_data.sh - Run Shadow SOC analysis: - └── scripts/operator/run_zeek.sh → Zeek logs (conn, dns, http, ssl, smb, kerberos, files) - └── scripts/operator/run_suricata.sh → IDS alerts on target traffic - └── scripts/operator/run_rita.sh → Beacon/C2/exfil detection from Zeek logs + Run Zeek offline: + └── scripts/operator/run_zeek.sh → protocol logs from PCAPs - Review findings: - - Zeek ssl.log: "10.0.1.5 presents expired cert, TLS 1.0, RC4 cipher" → vulnerable - - Zeek smb.log: "10.0.1.10 negotiates SMBv1" → EternalBlue candidate - - Zeek http.log: "10.0.1.102 → 10.0.1.5:1433 cleartext SQL" → db_interceptor confirmed - - Suricata: "ET POLICY SMBv1 Negotiate" → confirms SMBv1 in use - - Suricata: "ET MALWARE Known C2 beacon to 185.x.x.x" → target already compromised - - RITA: "10.0.1.108 beacons to external IP every 3600s ± 120s" → possible existing implant - - Zeek kerberos.log: "SVC_BACKUP requests TGS for CIFS/DC01" → Kerberoastable SPN + Review Zeek findings for attack paths: + - ssl.log: "10.0.1.5 — expired cert, TLS 1.0, RC4" → users click through warnings, MITM viable + - smb.log: "10.0.1.10 negotiates SMBv1, no signing" → relay target, possible EternalBlue + - http.log: "10.0.1.102 → 10.0.1.5:1433 cleartext SQL" → db_interceptor already has creds + - http.log: "10.0.1.101 → 10.0.1.1:80 HTTP Basic auth" → router creds in the clear + - kerberos.log: "SVC_BACKUP requests TGS for CIFS/DC01, RC4 encryption" → weak, crackable + - conn.log: "10.0.1.108 → 185.x.x.x every 3600s, 2KB each" → possible existing C2 (report finding) + - files.log: "payroll.xlsx transferred via SMB cleartext from 10.0.1.106" → sensitive data exposure -Day 8: Use Shadow SOC intel to pick targets + activate attack modules - - Zeek showed SMBv1 on NAS → target for EternalBlue or relay - - Suricata showed cleartext SQL → db_interceptor already capturing creds - - RITA found existing beacon → document for client report (huge finding) - - Kerberos log showed service accounts → kerberos_harvester already has the hashes +Day 8: Use Zeek intel to pick targets + activate attack modules + - SMBv1 + no signing on NAS → ntlm_relay target + - Cleartext SQL → already captured via db_interceptor + - RC4 Kerberos service account → kerberos_harvester already has the hash, weak encryption = fast crack + - Expired cert on internal app → mitmproxy won't cause additional warnings + - Existing beacon → document for client report (huge finding, free) ``` ### Content Extraction Tools @@ -874,24 +883,20 @@ Day 8: Use Shadow SOC intel to pick targets + activate attack modules | Script | Purpose | |---|---| | `pull_data.sh` | rsync over Tailscale/WG: creds DB, DNS logs, host inventory, PCAPs | -| `run_zeek.sh` | Run Zeek offline against PCAPs → generate protocol logs | -| `run_suricata.sh` | Run Suricata offline against PCAPs → IDS alerts on target traffic | -| `run_rita.sh` | Run RITA against Zeek logs → beacon/C2/exfil detection | +| `run_zeek.sh` | Run Zeek offline against PCAPs → protocol logs (ssl, smb, http, kerberos, dns, conn, files, x509) | | `extract_files.sh` | tshark + NetworkMiner batch file extraction from PCAPs | | `extract_print_jobs.sh` | Filter TCP/9100 from PCAPs, reconstruct with pcl2pdf/Ghostscript | | `extract_emails.sh` | Filter SMTP from PCAPs, reconstruct with tshark | | `crack_hashes.sh` | Export from credential_db in hashcat format, run against wordlists | -| `generate_report.py` | Pull SQLite DBs + Zeek/Suricata findings, generate engagement report (Markdown + HTML) | +| `generate_report.py` | Pull SQLite DBs + Zeek findings, generate engagement report (Markdown + HTML) | ### Workstation Requirements - Linux or macOS (Windows works but scripts assume bash) - Tailscale installed (same tailnet as implant) -- **Zeek** installed (offline PCAP analysis) -- **Suricata** installed with ET ruleset (offline IDS) -- **RITA** installed (beacon/C2 analytics from Zeek logs) +- **Zeek** installed (offline PCAP → protocol logs) - hashcat with GPU (NVIDIA recommended) -- 100GB+ free disk for PCAP analysis + Zeek/Suricata output +- 100GB+ free disk for PCAP analysis + Zeek output - Wireshark, tshark, NetworkMiner installed ---