The following TQL queries are Bro HTTP queries.
Identify most frequent useragent strings
class:bro_http (srcisp:["YOUR COMPANY ISP NAME","private ip address lan"] not [dstisp:"YOUR COMPANY ISP NAME","private ip address lan"] | groupby useragent 100
Identify least frequent useragent strings
class:bro_http ([srcisp:["YOUR COMPANY ISP NAME","private ip address lan]) not (dstisp:["YOUR COMPANY ISP NAME", not ["YOUR COMPANY ISP NAME","private ip address lan"]) | groupby < useragent 1000
Identify non-protocol compliant traffic such as SSL on an unusual port
dstport:[8080,80,443] !class:bro_http | groupby [class,dstport,protocol]
Identify evidence of SQL injection
tags:http::uri_sqli
Identify domains that contain a common string "domain.com" and resolve to IP addresses in a specific country (example provided: china [cn])
srcisp:"private ip address lan" domain:"domain.com" dstcountrycode:cn | groupby [dstipv4,domain] 500
Identify internal systems that are communicating with domains in a specific country
srcisp:"private ip address lan" domain:"domain.com" dstcountrycode:cn | groupby [srcipv4,dstipv4,domain] 500
Identify WinZIP, CAB, GZIP, 7ZIP, BZIP2, TAR, WinRAR archives downloaded via HTTP
class:bro_http (srcisp:["YOUR COMPANY ISP NAME","private ip address lan"]) not (dstisp:["YOUR COMPANY ISP NAME","private ip address lan"]) (rcvdmimetype:["application/x-zip","application/x-ms-cab","application/zip","application/x-gzip","application/x-zip-compressed","application/x-7z-compressed","application/x-bzip2","application/x-tar","application/x-rar"]) httpmethod:"get" | groupby rcvdmimetype
Identify WinRAR archives downloaded via HTTP grouped by HTTP method
class:bro_http (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" (rcvdmimetype:"application/x-rar") | groupby httpmethod
Identify WinRAR archives downloaded via HTTP grouped by URI
class:bro_http (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" (rcvdmimetype:"application/x-rar") | groupby uri
Identify executable files downloaded via HTTP grouped by URI
class:bro_http (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" (rcvdmimetype:"application/x-dosexec" OR rcvdmimetype:"application/x-msdos-program") httpmethod:get | groupby uri
Identify executable files downloaded directly (non-proxied)
rcvdmimetype:application* srcisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" not dstisp:"YOUR COMPANY ISP NAME" class:bro_http not srcipv4:"$proxy_external_ips" not domain:"YOURCOMPANY.COM" | groupby rcvdmimetype
Identify most frequently requested domains (non-proxied) HTTP-only
srcisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" not dstisp:"YOUR COMPANY ISP NAME" class:bro_http not srcipv4:"$proxy_external_ips" not domain:"YOURCOMPANY.COM" | groupby domain
Identify most frequently requested domains (non-proxied) HTTP-only grouped by country and destination IP address
srcisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" not dstisp:"YOUR COMPANY ISP NAME" class:bro_http not srcipv4:"$proxy_external_ips" not domain:"YOURCOMPANY.COM" | groupby [dstcountry,dstisp]
Identify most frequently requested domains where domain name provided is IP address
srcisp:"YOUR COMPANY ISP NAME" class:bro_http domain:/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ | groupby [domain,dstcountry] 100Identify most common domains observed by Trellix appliances
class:bro_http domain:(class:fireeye) | groupby domain
Identify connections to external IP addresses on high-level ports (above 10000) grouped by destination IP address, port, domain
class:bro_http !dstisp:["private ip address lan","target corporation"] dstport>10000 | groupby [dstipv4,dstport,domain,dstdomain]
Identify zero-depth file downloads such as “/1.exe” grouped by URI
class:bro_http domain=/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/ uri:/\/[^\/]+(exe|zip|rar|scr|7z|php)/ | groupby uri