Intermediate Lab

Objective

Use Arkime (formerly Moloch) and Driftnet.io to analyze network traffic, extract JA4T fingerprints, and identify suspicious network activity. Utilize JA4DB for fingerprint lookup to gain insights into the observed traffic.

Tools Required

• Arkime: An open-source large scale packet capture and search tool. We'll use demo.arkime.com.
• Driftnet.io: An online network traffic analysis tool.
• JA4DB: An online database of JA4T fingerprints.

Prerequisites

• Completion of the Beginner Lab or equivalent experience.
• Familiarity with web-based network analysis tools.
• Internet access to use demo.arkime.com and driftnet.io.

Lab Steps

Step 1: Accessing Arkime Demo

1. Visit Arkime Demo:

• Open your web browser and navigate to demo.arkime.com.
• You may need to register for an account or log in if required.

2. Understanding Arkime Interface:

• Familiarize yourself with the dashboard, including the Sessions, SPI View, and Connections sections.

Step 2: Searching for JA4T Fingerprints in Arkime

1. Access Sessions:

• Click on the Sessions tab to view captured network sessions.

2. Apply a Filter for TCP SYN Packets:

• In the search bar, enter the following filter to find TCP SYN packets:

tcpflags == syn && !tcpflags == ack

• Click Search to apply the filter.

3. View Session Details:

• Click on a session from the list to view detailed information.

4. Locate JA4T Fingerprints:

• In the session details, look for fields related to TCP options, window size, and TTL.
• Arkime may display the JA4T fingerprint directly or provide the necessary information to construct it.

Step 3: Analyzing Traffic with Arkime's SPI View

1. Navigate to SPI View:

• Click on the SPI View tab to see aggregated data.

2. Group by JA4T Fingerprint:

• In the Fields dropdown, select relevant fields such as TCP Options, Window Size, and TTL.
• This will group sessions based on these attributes.

3. Identify Common Fingerprints:

• Observe the most common fingerprints and note any anomalies.

Step 4: Using Driftnet.io for Further Analysis

1. Visit Driftnet.io:

• Open a new browser tab and navigate to Driftnet.io.

2. Upload a PCAP File (Optional):

• If you have a PCAP file from previous captures, you can upload it for analysis.
• Alternatively, explore the sample data provided by Driftnet.io.

3. Analyze Network Traffic:

• Driftnet.io will display images and data extracted from the network traffic.
• Review the extracted content for any suspicious or unexpected items.

4. Identify Suspicious Activity:

• Look for unusual images or data that might indicate malicious activity.

Step 5: Cross-Referencing with JA4DB

1. Extract JA4T Fingerprints:

• From Arkime or Driftnet.io, collect the JA4T fingerprints identified.

2. Access JA4DB:

• Go to JA4DB in your web browser.

3. Search for Fingerprints:

• Enter each JA4T fingerprint into the search bar.
• Review the results to determine if the fingerprints are associated with known clients or potential threats.

4. Document Findings:

• Note any fingerprints that are not found in JA4DB or are associated with malicious activity.

Step 6: Identifying Suspicious Network Activity

1. Compare Fingerprints:

• Look for fingerprints that deviate from common patterns observed in your analysis.

2. Investigate Anomalies:

• For fingerprints not found in JA4DB, consider them as potential unknown clients or threats.
• Analyze the associated sessions in Arkime for further details such as source IP, destination IP, and payload data.

3. Correlate with Driftnet.io Findings:

• If Driftnet.io revealed any suspicious content, correlate it with the sessions and fingerprints identified in Arkime.

Step 7: Document and Report

1. Create a Detailed Report:

• Summarize the steps taken and tools used.
• Present your findings, including any suspicious fingerprints and associated network activity.
• Include screenshots where applicable.

2. Security Implications:

• Discuss the potential risks identified.
• Recommend actions for monitoring or mitigating threats.