Drop Suricata/RITA — Zeek is the offensive analysis tool, IDS is not our job

BIGBROTHER_DESIGN.md

@@ -34,9 +34,9 @@ BigBrother is a **Shadow SOC** — it gives you the same network visibility a de
 The platform operates as two halves:
 
 - **The implant** (Pi or Debian host): captures everything (tcpdump full PCAP), extracts real-time metadata to SQLite (DNS, SNI, credentials, Kerberos, hosts, flows), orchestrates attacks (bettercap, Responder, mitmproxy), and stays hidden (stealth layer).
-- **The operator workstation**: runs the SOC analysis stack (Zeek, Suricata, RITA) against pulled PCAPs to get defender-grade protocol logs, IDS alerts, and behavioral analytics — then uses those findings to decide what to attack.
+- **The operator workstation**: runs Zeek against pulled PCAPs to get structured protocol logs (ssl.log, smb.log, http.log, kerberos.log, etc.) showing every service version, every cert, every vulnerability — then uses those findings to decide what to attack.
 
-Custom Python exists only where no existing tool covers the need. bettercap replaces all custom MITM modules. tcpdump replaces custom packet capture. Zeek/Suricata/RITA run offline on the operator's workstation. The implant captures and extracts; the workstation analyzes.
+Custom Python exists only where no existing tool covers the need. bettercap replaces all custom MITM modules. tcpdump replaces custom packet capture. Zeek runs offline on the operator's workstation for deep protocol analysis. The implant captures and extracts; the workstation analyzes.
 
 **Operational modes**: **Passive surveillance** runs unsupervised from deployment -- tcpdump captures everything, lightweight Python modules extract metadata (DNS queries, TLS SNI, credentials, Kerberos tickets, host inventory, traffic flows) into queryable SQLite databases. **Active surveillance** is operator-enabled -- bettercap for ARP/DNS/DHCP spoofing, Responder for hash capture, mitmproxy for HTTPS interception. Once enabled, runs unattended.
 
@@ -64,7 +64,7 @@ BigBrother is not an autonomous attack framework. The operator makes all decisio
 | Flow/beacon analysis | Engagement report generation |
 | MITM orchestration (bettercap) | GPU hash cracking (hashcat) |
 | Change/burn detection | Certificate chain analysis |
-| Auth flow tracking, SMB metadata | Network forensics (Zeek + RITA) |
+| Auth flow tracking, SMB metadata | Protocol analysis (Zeek logs) |
 
 ### Module Counts
 
@@ -822,13 +822,23 @@ The operator's workstation is the analysis brain. The Pi captures and extracts r
 
 ### Shadow SOC Analysis Stack
 
-Run these against PCAPs pulled from BigBrother. This gives you the same visibility a blue team SOC has, used offensively.
+The core offline tool is **Zeek**. Run it against pulled PCAPs and it produces structured protocol logs that tell you exactly what's vulnerable, what's misconfigured, and where to attack — without ever scanning the network.
 
-| Tool | What It Gives You (Offensively) |
+| Zeek Log | What It Tells You (Offensively) |
+|---|---|
+| **ssl.log** | Every TLS cert on the network: expired certs (users trained to click through warnings → MITM viable), self-signed certs (same), weak ciphers (RC4, 3DES), old TLS versions (1.0/1.1 → downgrade attacks), cert SANs (internal hostnames revealed) |
+| **smb.log** | SMB versions negotiated per host: SMBv1 = EternalBlue candidate, no signing = relay target, shares accessed, filenames transferred |
+| **http.log** | Every cleartext HTTP request: URLs, headers, user-agents, POST bodies. Find internal apps with no TLS, default admin panels, API endpoints with hardcoded tokens |
+| **kerberos.log** | Every Kerberos exchange: SPNs (Kerberoast targets), encryption types (RC4 = weak, easier to crack), auth failures (password spray opportunities) |
+| **dns.log** | Complements on-device dns_logger with response analysis: NXDOMAIN patterns, internal zone structure, DNS-based service discovery |
+| **conn.log** | Every connection: source, dest, port, protocol, duration, bytes. Map all communication patterns, find long-lived sessions, identify servers vs clients |
+| **files.log** | Every file transferred over HTTP/SMB/FTP: filename, size, MIME type, hash. Find sensitive documents moving in cleartext |
+| **x509.log** | Certificate chain details: CA hierarchy, key sizes, validity periods. Map the target's PKI |
+
+**Also on workstation:**
+
+| Tool | Purpose |
 |---|---|
-| **Zeek** (offline mode) | Protocol logs (conn.log, dns.log, http.log, ssl.log, smb.log, kerberos.log, files.log). Shows: every service version, every cert (expired, self-signed, weak), every SMB dialect, every HTTP header. Tells you exactly what's vulnerable without scanning. |
-| **Suricata** (offline mode) | IDS alerts against the TARGET's traffic. Finds: existing malware/C2, policy violations, vulnerable service fingerprints, cleartext credentials, anomalous protocols. You see what their SOC would see — or what they're missing. |
-| **RITA** (Real Intelligence Threat Analytics) | Ingests Zeek logs. Detects: C2 beacons, DNS tunneling, long connections, data exfil patterns. Finds existing compromises on the network before you even start attacking. |
 | **Wireshark/tshark** | Deep packet inspection, stream reconstruction, manual protocol analysis |
 | **NetworkMiner** | Automated file/image/credential extraction from PCAPs, OS fingerprinting |
 
@@ -839,25 +849,24 @@ Day 1-7:  BigBrother runs passive on target network
 Day 7:    Operator pulls PCAPs + metadata to workstation
           └── scripts/operator/pull_data.sh
 
-          Run Shadow SOC analysis:
+          Run Zeek offline:
-          └── scripts/operator/run_zeek.sh        → Zeek logs (conn, dns, http, ssl, smb, kerberos, files)
+          └── scripts/operator/run_zeek.sh → protocol logs from PCAPs
-          └── scripts/operator/run_suricata.sh    → IDS alerts on target traffic
-          └── scripts/operator/run_rita.sh         → Beacon/C2/exfil detection from Zeek logs
 
-          Review findings:
+          Review Zeek findings for attack paths:
-          - Zeek ssl.log: "10.0.1.5 presents expired cert, TLS 1.0, RC4 cipher" → vulnerable
+          - ssl.log: "10.0.1.5 — expired cert, TLS 1.0, RC4" → users click through warnings, MITM viable
-          - Zeek smb.log: "10.0.1.10 negotiates SMBv1" → EternalBlue candidate
+          - smb.log: "10.0.1.10 negotiates SMBv1, no signing" → relay target, possible EternalBlue
-          - Zeek http.log: "10.0.1.102 → 10.0.1.5:1433 cleartext SQL" → db_interceptor confirmed
+          - http.log: "10.0.1.102 → 10.0.1.5:1433 cleartext SQL" → db_interceptor already has creds
-          - Suricata: "ET POLICY SMBv1 Negotiate" → confirms SMBv1 in use
+          - http.log: "10.0.1.101 → 10.0.1.1:80 HTTP Basic auth" → router creds in the clear
-          - Suricata: "ET MALWARE Known C2 beacon to 185.x.x.x" → target already compromised
+          - kerberos.log: "SVC_BACKUP requests TGS for CIFS/DC01, RC4 encryption" → weak, crackable
-          - RITA: "10.0.1.108 beacons to external IP every 3600s ± 120s" → possible existing implant
+          - conn.log: "10.0.1.108 → 185.x.x.x every 3600s, 2KB each" → possible existing C2 (report finding)
-          - Zeek kerberos.log: "SVC_BACKUP requests TGS for CIFS/DC01" → Kerberoastable SPN
+          - files.log: "payroll.xlsx transferred via SMB cleartext from 10.0.1.106" → sensitive data exposure
 
-Day 8:    Use Shadow SOC intel to pick targets + activate attack modules
+Day 8:    Use Zeek intel to pick targets + activate attack modules
-          - Zeek showed SMBv1 on NAS → target for EternalBlue or relay
+          - SMBv1 + no signing on NAS → ntlm_relay target
-          - Suricata showed cleartext SQL → db_interceptor already capturing creds
+          - Cleartext SQL → already captured via db_interceptor
-          - RITA found existing beacon → document for client report (huge finding)
+          - RC4 Kerberos service account → kerberos_harvester already has the hash, weak encryption = fast crack
-          - Kerberos log showed service accounts → kerberos_harvester already has the hashes
+          - Expired cert on internal app → mitmproxy won't cause additional warnings
+          - Existing beacon → document for client report (huge finding, free)
 ```
 
 ### Content Extraction Tools
@@ -874,24 +883,20 @@ Day 8:    Use Shadow SOC intel to pick targets + activate attack modules
 | Script | Purpose |
 |---|---|
 | `pull_data.sh` | rsync over Tailscale/WG: creds DB, DNS logs, host inventory, PCAPs |
-| `run_zeek.sh` | Run Zeek offline against PCAPs → generate protocol logs |
+| `run_zeek.sh` | Run Zeek offline against PCAPs → protocol logs (ssl, smb, http, kerberos, dns, conn, files, x509) |
-| `run_suricata.sh` | Run Suricata offline against PCAPs → IDS alerts on target traffic |
-| `run_rita.sh` | Run RITA against Zeek logs → beacon/C2/exfil detection |
 | `extract_files.sh` | tshark + NetworkMiner batch file extraction from PCAPs |
 | `extract_print_jobs.sh` | Filter TCP/9100 from PCAPs, reconstruct with pcl2pdf/Ghostscript |
 | `extract_emails.sh` | Filter SMTP from PCAPs, reconstruct with tshark |
 | `crack_hashes.sh` | Export from credential_db in hashcat format, run against wordlists |
-| `generate_report.py` | Pull SQLite DBs + Zeek/Suricata findings, generate engagement report (Markdown + HTML) |
+| `generate_report.py` | Pull SQLite DBs + Zeek findings, generate engagement report (Markdown + HTML) |
 
 ### Workstation Requirements
 
 - Linux or macOS (Windows works but scripts assume bash)
 - Tailscale installed (same tailnet as implant)
-- **Zeek** installed (offline PCAP analysis)
+- **Zeek** installed (offline PCAP → protocol logs)
-- **Suricata** installed with ET ruleset (offline IDS)
-- **RITA** installed (beacon/C2 analytics from Zeek logs)
 - hashcat with GPU (NVIDIA recommended)
-- 100GB+ free disk for PCAP analysis + Zeek/Suricata output
+- 100GB+ free disk for PCAP analysis + Zeek output
 - Wireshark, tshark, NetworkMiner installed
 
 ---