Zeek Exercises

Walkthrough summary

Zeek Exercises TryHackMe walkthrough with 14 answered prompts and lab methodology notes.

Sample prompts covered

• Investigate the dns-tunneling.pcap file. Investigate the dns.log file. What is the number of DNS records linked to the IPv6 address?
  Open the walkthrough page to inspect the full answer and command flow.
• Investigate the conn.log file. What is the longest connection duration?
  Open the walkthrough page to inspect the full answer and command flow.
• Investigate the dns.log file. Filter all unique DNS queries. What is the number of unique domain queries?
  Open the walkthrough page to inspect the full answer and command flow.
• There are a massive amount of DNS queries sent to the same domain. This is abnormal. Let's find out which hosts are involved in this activity. Investigate the conn.log file. What is the IP address of the source host?
  Open the walkthrough page to inspect the full answer and command flow.
• Investigate the logs. What is the suspicious source address? Enter your answer in defanged format.
  Open the walkthrough page to inspect the full answer and command flow.