APT Low-and-Slow

#!/bin/bash
# Long-window (30-day) threat hunting queries for APT behavior
ZEEK_ARCHIVE="${1:-/opt/zeek/logs}"

echo "=== 30-day cumulative exfiltration by src→dst pair ==="
# Find all conn.log files from last 30 days
find "$ZEEK_ARCHIVE" -name "conn.log*" -newer "$ZEEK_ARCHIVE/$(date -d '30 days ago' +%Y-%m-%d)" \
    -not -name "*.lock" 2>/dev/null | \
    xargs -I{} zcat -f {} 2>/dev/null | \
    awk 'NF>8 && !/^#/' | \
    awk -F'\t' '
        $5 !~ /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/ &&
        $9 ~ /[0-9]/ {
            key = $3"\t"$5
            bytes[key] += $9+0
            conns[key]++
        }
        END {
            for (k in bytes)
                if (bytes[k] > 1000000000)   # >1GB over 30 days
                    printf "%.1fGB  %d_conns  %s\n", bytes[k]/1073741824, conns[k], k
        }' | sort -rn | head -20

echo ""
echo "=== 30-day Kerberoasting: slow one-per-day pattern ==="
find "$ZEEK_ARCHIVE" -name "kerberos.log*" -newer "$ZEEK_ARCHIVE/$(date -d '30 days ago' +%Y-%m-%d)" \
    2>/dev/null | xargs -I{} zcat -f {} 2>/dev/null | \
    awk 'NF>8 && !/^#/' | \
    awk -F'\t' '$7=="TGS" {print $3"\t"$6}' | \
    sort -u | awk -F'\t' '{print $1}' | sort | uniq -c | sort -rn | \
    awk '$1 > 5 {print "SLOW_KERBEROAST: " $1 " unique days with TGS from " $2}'

echo ""
echo "=== Low-frequency beaconing (4+ hour interval) ==="
# Similar to beaconing detection but extend the gap filter and lower count threshold
find "$ZEEK_ARCHIVE" -name "conn.log*" \
    -newer "$ZEEK_ARCHIVE/$(date -d '7 days ago' +%Y-%m-%d)" \
    2>/dev/null | xargs -I{} zcat -f {} 2>/dev/null | \
    awk '!/^#/' | \
    awk -F'\t' '$5 !~ /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/ {
        print $1"\t"$3"\t"$5"\t"$6
    }' | python3 -c "
import sys, math
from collections import defaultdict
flows = defaultdict(list)
for line in sys.stdin:
    parts = line.strip().split('\t')
    if len(parts) >= 4:
        try:
            flows[(parts[1], parts[2], parts[3])].append(float(parts[0]))
        except: pass

for (src, dst, port), ts in flows.items():
    ts.sort()
    if len(ts) < 5: continue
    # Look for 4-24 hour intervals
    ivs = [ts[i+1]-ts[i] for i in range(len(ts)-1)
           if 3600*3 <= ts[i+1]-ts[i] <= 3600*24]
    if len(ivs) < 3: continue
    mean = sum(ivs)/len(ivs)
    cv = math.sqrt(sum((x-mean)**2 for x in ivs)/len(ivs))/mean if mean > 0 else 999
    if cv < 0.20:
        print(f'SLOW_BEACON cv={cv:.3f} n={len(ts)} int={mean/3600:.1f}h {src}→{dst}:{port}')
" | head -20