Bro does awesome things with network data. One of those things is performing an analysis of files on the wire, including hashing. WLS does hashing of executed files and loaded DLLs, and tracks each hash that has been seen on the host, setting “NewHash=True” for the first instance.

I wanted to track PE files that have been seen on the wire (downloaded) then executed for the first time with some basic statistics. The resulting Splunk search looks for all Bro file analysis logs of PE files that contain an MD5, matches that with WLS logs containing the same MD5, does a distinct host count, and reports the unique hash data with the distinct host count. If you have Bro monitoring internal and external traffic you’ll also see things such as managed anti-virus updates or patches. The WLS file metadata optionally includes the Zone field, which can come in handy for differentiating the source of the files.

Internet Explorer Zone Number Mapping

Value	Setting
0	My Computer
1	Local Intranet Zone
2	Trusted sites Zone
3	Internet Zone
4	Restricted Sites Zone

Here’s the current Splunk search I’m using for alerting:

`wlslogs` NewHash=True [ search sourcetype=bro_files PE MD5 | dedup md5 | rename md5 as MD5 | fields MD5] | eval CallingProcess=coalesce(Process,CreatorProcessName) | eventstats dc(host) as hostCount by MD5 | dedup MD5 | table hostCount, CallingProcess, BaseFileName, CompanyName, InternalName, FileDescription, Signed, FileVersion, ProductVersion, Zone | sort -hostCount

• `wlslogs`
  • A macro that limits the logs to indexes where WLS data is contained
• NewHash=True
  • Only logs where NewHash is set to True
• [ search sourcetype=bro_files PE MD5 | dedup md5 | rename md5 as MD5 | fields MD5]
  • sourcetype=bro_files
    • Only “bro_files” data
  • PE MD5
    • Bro logs containing the keywords “PE” and “MD5”
  • dedup md5
    • Remove duplicate hashes
  • rename md5 as MD5
    • Splunk is case-sensitive for field names, so rename the Bro field to what WLS uses
  • fields MD5
    • Only output the MD5 field(s)
• eval CallingProcess=coalesce(Process,CreatorProcessName)
  • The fields differ slightly in the logs where we might find an MD5 (new process vs. loading DLL); this will return the first non-null of Process and CreatorProcessName
• eventstats dc(host) as hostCount by MD5
  • Count the distinct number of hosts where this MD5 has been seen
• dedup MD5
  • Remove duplicate WLS MD5 logs
• table hostCount, CallingProcess, BaseFileName, CompanyName, InternalName, FileDescription, Signed, FileVersion, ProductVersion, Zone
  • Make a table of the useful fields
• sort -hostCount
  • Sort by hostCount in decending order

Example output

---

For more information on WLS, click “WLS Information” at the top, or here: WLS Information

If you’d like additional information about WLS, send me a note via the contact form. WLS is currently available to US entities, but does require a signed license agreement.