[Autogenerated] For this last demo, we'll still be using the Linux terminal.
We'll begin by moving into the DNS analysis directory here.
We'll find a script called DNS entropy dot Z.
We can read through the script to see what it will be accomplishing.
I don't expect you to be an expert on the syntax here,
but it's good practice to try and understand what is
taking place when you run things.
The important thing is to understand that Zeek will
analyze each DNS conversation,
extract the queries and answers then generate a new log
file containing an entropy score.
OK?
I know this is a long command.
We're running Zeek inside a Docker container.
So it's a bit more complex than how you'd run it in a typical environment.
This command will create a temporary Docker container to run ZEC,
analyze the network traffic using the script file and then create the log files.
And if we do a listing now, we can see that logs have been generated.
Let's read the DNS entropy dot log file to see what type of data is created.
There is a lot of information here.
Zeek organizes the data into columns.
These are tab delimited and can be a bit complicated to
read through on the command line.
Typically, this data is forwarded into a visualization tool for easier analysis.
Let's try extracting out the query column and the associated entropy scores.
Then sorting to see the high values to do this.
We'll use a OCC is a command line tool used for manipulating data.
In this instance,
it lets us extract out specific columns of data in our desired order.
The sort command will then allow us to see the highest
entropy values listed at the bottom.
Most of the results contain subdomain queries for dirty
litter dot I am iron catt dot com.
This is encoded information that is being sent to whoever
owns the DNS server for the root domain.
Let's try that same tactic and look for the answers
with their associated entropy scores.
Once again,
the dirty litter dot I am iron catt dot com domain shows
up most often with encoded subdomains.