Skip to content

Instantly share code, notes, and snippets.

@defensivedepth

defensivedepth/gist:fd33cc6e7bbd8826ce7e4b27c4841aec

Created March 19, 2021 14:01
Show Gist options
  • Save defensivedepth/fd33cc6e7bbd8826ce7e4b27c4841aec to your computer and use it in GitHub Desktop.
Save defensivedepth/fd33cc6e7bbd8826ce7e4b27c4841aec to your computer and use it in GitHub Desktop.
Download ZIP
Security Onion 2 - Hunt query for HTTP over non-HTTP ports
Raw
gistfile1.txt
# Security Onion 2 - Hunt query for HTTP over non-HTTP ports grouped by port, http method, virtual host, uri & user agent
event.dataset:http AND NOT destination.port: "80" AND NOT destination.port: "8080" | groupby destination.port http.method http.virtual_host http.uri http.useragent
@femaven
Copy link

femaven commented Mar 23, 2021

Hmm, thanks for the explanation. I’ll have have to take a look at why this rule is hitting on Zscaler Private Access initial connections on 443.

@defensivedepth
Copy link
Author

Looks like it may initially be doing an HTTP CONNECT over 443 - https://help.zscaler.com/zia/what-proxy-mode

...sends the HTTP CONNECT method request directly to the ZIA Public Service Edge, before it initiates the SSL handshake

This is not part of a standard TLS/SSL handshake, so it is being classified as HTTP traffic, which is why you are seeing it show up.

The good news is - you have learned something new about your network! :)

@femaven
Copy link

femaven commented Mar 23, 2021

Thanks for looking helping me figure it out!

@defensivedepth
Copy link
Author

defensivedepth commented Mar 23, 2021 •
edited
Loading

np! Defenders have to stick together! :)

Also, had help from the team to find that zscaler link, wasn't just me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment