Re: TEMP files under /opt/zeek/spool/worker-*-*/extract_files

Justin Azoff <[email protected]> Tue, 31 Dec 2019 09:27:19 -0500
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAPfnCuhdPSUO40gXC_ftuGTXtiX1SsMrj03j6M1Uex2vHLaf0w@mail.gmail.com>
--===============0625548806==
Content-Type: multipart/alternative; boundary="00000000000013f3ec059b00c477"

--00000000000013f3ec059b00c477
Content-Type: text/plain; charset="UTF-8"

Those aren't TEMP files as far as zeek is concerned.  Those are being
extracted by the BZAR script:
https://github.com/mitre-attack/bzar/blob/master/scripts/bzar_files.bro

they just happen to be from c:\windows\TEMP\ on the server.

You should be analyzing those files, or if you don't want them at all the
bzar script has BZAR::file_extract_option or some other ways of filtering
things to turn that feature off.

On Mon, Dec 30, 2019 at 4:35 PM Scot Harris <[email protected]> wrote:

> While running some system checks, I noted that on the two zeek 3.0 boxes I
> have in a cluster that drive space was being taken up in the following
> directory:
>
>
>
> /opt/zeek/spool/worker-3-1/extract_files.
>
>
>
> These files not large but numerous.
>
>
>
> total 15884720
>
> -rw-rw-r-- 1 zeek zeek        50 Dec 30 16:26
> CZi12w40mQqZt08H24_FWsM9w4uCR965XUybc__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-93.txt
>
> -rw-rw-r-- 1 zeek zeek       326 Dec 30 16:26
> CZi12w40mQqZt08H24_FEJBtK3MwBWHCM3ET__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110812.bat
>
> -rw-rw-r-- 1 zeek zeek        44 Dec 30 16:26
> CZi12w40mQqZt08H24_FzgNR24m7uP0dbeI54__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-92.txt
>
> -rw-rw-r-- 1 zeek zeek       315 Dec 30 16:26
> CZi12w40mQqZt08H24_FlcyIJ91gLM90QJhe__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110811.bat
>
> -rw-rw-r-- 1 zeek zeek        23 Dec 30 16:26
> CZi12w40mQqZt08H24_FXnI1p4BopgQQE4jye__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-91.txt
>
> -rw-rw-r-- 1 zeek zeek       285 Dec 30 16:26
> CZi12w40mQqZt08H24_FXROsS11QBGTbOJGNd__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110810.bat
>
> -rw-rw-r-- 1 zeek zeek        19 Dec 30 16:25
> CZi12w40mQqZt08H24_FZ3vCj4O7BqZZYdgT__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-90.txt
>
> -rw-rw-r-- 1 zeek zeek       330 Dec 30 16:25
> CZi12w40mQqZt08H24_FozvDx13eGGG5Sssyc__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110793.bat
>
> -rw-rw-r-- 1 zeek zeek        77 Dec 30 16:25
> CZi12w40mQqZt08H24_FIwGEp2TW6WJ8IbEcd__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-89.txt
>
> -rw-rw-r-- 1 zeek zeek       313 Dec 30 16:25
> CZi12w40mQqZt08H24_FWm9sG44On6hV5AoWj__10.1.24.161_c$Windows_TEMP_fstmp_fs_action_110781.bat
>
> -rw-rw-r-- 1 zeek zeek        10 Dec 30 16:25
> CZi12w40mQqZt08H24_Fo3rTB2pdq5ooABUCa__10.1.24.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-88.txt
>
>
>
> Can these files be purged periodically?
>
>
>
> Seeing this on both the master box and the cluster node.
>
>
>
> Thank you.
>
>
>
>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek



-- 
Justin

--00000000000013f3ec059b00c477
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Those aren&#39;t TEMP files as far as zeek is concerned.=
=C2=A0 Those are being extracted by the BZAR script:=C2=A0<a href=3D"https:=
//github.com/mitre-attack/bzar/blob/master/scripts/bzar_files.bro">https://=
github.com/mitre-attack/bzar/blob/master/scripts/bzar_files.bro</a><div><br=
></div><div>they just happen to be from c:\windows\TEMP\ on the server.</di=
v><div><br></div><div>You should be analyzing those files, or if you don&#3=
9;t want them at all the bzar script has=C2=A0<span style=3D"color:rgb(36,4=
1,46);font-family:SFMono-Regular,Consolas,&quot;Liberation Mono&quot;,Menlo=
,monospace;font-size:12px;white-space:pre">BZAR::file_extract_option</span>=
=C2=A0or some other ways of filtering things to turn that feature off.</div=
></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr"=
>On Mon, Dec 30, 2019 at 4:35 PM Scot Harris &lt;<a href=3D"mailto:SHARRIS@=
hollywoodfl.org">[email protected]</a>&gt; wrote:<br></div><blockquot=
e class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px s=
olid rgb(204,204,204);padding-left:1ex">





<div lang=3D"EN-US">
<div class=3D"gmail-m_-7380747925791475038WordSection1">
<p class=3D"MsoNormal">While running some system checks, I noted that on th=
e two zeek 3.0 boxes I have in a cluster that drive space was being taken u=
p in the following directory:<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">/opt/zeek/spool/worker-3-1/extract_files.<u></u><u><=
/u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">These files not large but numerous.<u></u><u></u></p=
>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">total 15884720<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 50 Dec 30 16:26 CZi12w40mQqZt08H24_FWsM9w4uCR965XUybc__10.1.24=
.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-93.txt<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 326 Dec 30 16:26 CZi12w40mQqZt08H24_FEJBtK3MwBWHCM3ET__10.1.24.161_c=
$Windows_TEMP_fstmp_fs_action_110812.bat<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 44 Dec 30 16:26 CZi12w40mQqZt08H24_FzgNR24m7uP0dbeI54__10.1.24=
.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-92.txt<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 315 Dec 30 16:26 CZi12w40mQqZt08H24_FlcyIJ91gLM90QJhe__10.1.24.161_c=
$Windows_TEMP_fstmp_fs_action_110811.bat<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 23 Dec 30 16:26 CZi12w40mQqZt08H24_FXnI1p4BopgQQE4jye__10.1.24=
.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-91.txt<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 285 Dec 30 16:26 CZi12w40mQqZt08H24_FXROsS11QBGTbOJGNd__10.1.24.161_=
c$Windows_TEMP_fstmp_fs_action_110810.bat<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 19 Dec 30 16:25 CZi12w40mQqZt08H24_FZ3vCj4O7BqZZYdgT__10.1.24.=
161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-90.txt<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 330 Dec 30 16:25 CZi12w40mQqZt08H24_FozvDx13eGGG5Sssyc__10.1.24.161_=
c$Windows_TEMP_fstmp_fs_action_110793.bat<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 77 Dec 30 16:25 CZi12w40mQqZt08H24_FIwGEp2TW6WJ8IbEcd__10.1.24=
.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-89.txt<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 313 Dec 30 16:25 CZi12w40mQqZt08H24_FWm9sG44On6hV5AoWj__10.1.24.161_=
c$Windows_TEMP_fstmp_fs_action_110781.bat<u></u><u></u></p>
<p class=3D"MsoNormal">-rw-rw-r-- 1 zeek zeek=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 10 Dec 30 16:25 CZi12w40mQqZt08H24_Fo3rTB2pdq5ooABUCa__10.1.24=
.161_c$Windows_TEMP_fstmp_fs_smbfile_10.1.24.161-88.txt<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Can these files be purged periodically?<u></u><u></u=
></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Seeing this on both the master box and the cluster n=
ode.<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal">Thank you.<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
</div>
</div>

_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi=
nfo/zeek</a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div=
 dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">Justin</div></div>

--00000000000013f3ec059b00c477--

--===============0625548806==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============0625548806==--