The following TQL queries are for Bro files.
Identify HTTP requests and responses
has:uri has:useragent
Identify outbound file transfers grouped by country
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" | groupby dstcountry
Identify outbound file transfers (non-SSL) grouped by country
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" not service:ssl | groupby dstcountry
Identify outbound file transfers greater than 1MB grouped by country
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>1000000 | groupby dstcountry
Identify outbound file transfers greater than 1MB grouped by filename
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>"1000000" | groupby filename
Identify outbound file transfers greater than 10MB grouped by country
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>10000000 | groupby dstcountry
Identify outbound file transfers greater than 10MB grouped by filename
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>10000000 | groupby filename
Identify outbound file transfers greater than 100MB grouped by country
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>100000000 | groupby dstcountry
Identify outbound file transfers greater than 100MB grouped by filename
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" seenbytes>100000000 | groupby filename
Identify the most frequent non-text files (mimetype)
class:bro_files has:mimetype not mimetype:text* | groupby mimetype
Identify the most frequent non-text files (mimetype) transferred from outside to inside
class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") has:mimetype not mimetype:text* | groupby mimetype
Identify the most frequent application types transferred from outside to inside
class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") mimetype:application* | groupby mimetype
Identify all files with the listed mime types that were downloaded
class:bro_files AND (mimetype:["application/x-zip","application/x-ms-cab","application/zip","application/x-gzip","application/x-zip-compressed","application/x-7z-compressed","application/x-bzip2","application/x-tar","application/x-rar"])
Identify all files with the listed mime types transferred from outside to inside
class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") (mimetype:["application/x-zip","application/x-ms-cab","application/zip","application/x-gzip","application/x-zip-compressed","application/x-7z-compressed","application/x-bzip2","application/x-tar","application/x-rar"]) | groupby mimetype
Identify all files with the listed mime types transferred from inside to outside
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" (mimetype:["application/x-zip","application/x-ms-cab","application/zip","application/x-gzip","application/x-zip-compressed","application/x-7z-compressed","application/x-bzip2","application/x-tar","application/x-rar"]) | groupby mimetype
Identify all WinRAR archives (mimetype)
class:bro_files has:filename mimetype:"application/x-rar" | groupby filename
Identify all WinRAR archives (mimetype) transferred from outside to inside
class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") has:filename mimetype:"application/x-rar" | groupby filename
Identify all WinRAR archives (mimetype) transferred from outside to inside grouped by country
class:bro_files not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") has:filename mimetype:"application/x-rar" | groupby [srccountry,srcisp]
Identify all WinRAR archives (mimetype) transferred from inside to outside
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" has:filename mimetype:"application/x-rar" | groupby filename
Identify all WinRAR archives (mimetype) transferred from inside to outside grouped by country
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" has:filename mimetype:"application/x-rar" | groupby [dstcountry,dstisp]
Identify all executable files (mimetype)
class:bro_files (mimetype:"application/x-dosexec" OR mimetype:"application/x-msdos-program") | groupby filename
Identify all executable files (mimetype) transferred from outside to inside grouped by mimetype
class:bro_files not stisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") (mimetype:"application/x-dosexec" OR mimetype:"application/x-msdos-program") | groupby mimetype
Identify all executable files (mimetype) transferred from inside to outside grouped by mimetype
class:bro_files (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" (mimetype:"application/x-dosexec" OR mimetype:"application/x-msdos-program") | groupby mimetype
Identify WinRAR archives (mimetype) without “.rar” file extension
class:bro_files has:filename not filename:/\.rar$/ mimetype:"application/x-rar" not service:smtp | groupby filename
Identify executable files (mimetype) without “.exe” extension
class:bro_files has:filename not filename:/\.exe$/ (mimetype:"application/x-dosexec" OR mimetype:"application/x-msdos-program") not service:smtp | groupby filename