Brim | TryHackMe — Walkthrough [2025]

Brim is an open-source desktop app for analyzing pcap files and log files.It focuses on searching, filtering, and correlation using Zeek logs and Suricata alerts.

Room Link: https://tryhackme.com/room/brim

Task 2: What is Brim?

I learned that Brim:

• Supports pcap files (from Wireshark, tcpdump, tshark) and Zeek log files.
• Provides a GUI, making it easier than Zeek (CLI only).
• Cannot sniff live traffic (unlike Wireshark/Zeek).
• Best suited for medium-to-large pcap files (not huge multi-GB ones).

Comparison:

• Wireshark → best for packet-level details.
• Zeek → best for event correlation + scripting.
• Brim → in-between, GUI + correlation, but less packet-level power.

Task 3: The Basics

Step 1: Importing PCAP

1. I opened Brim.
2. On the landing page, I clicked Choose Files.

3. I selected sample.pcap → it was processed into Zeek logs.

Q1: What is the qclass_name of the first DNS log?

On the dashboard, I located the first DNS log (blue dns tag).

Right-clicked → Open Details.

In the Log Details panel, I found:

Q2: What is the duration of the first NTP log?

• I clicked on the first NTP log (grey ntp tag).
• In Log Details →

duration: 0.005

Q3: What is the reassem_tcp_size in the STATS log?

1. I found the STATS log (green tag).
2. In Log Details →

reassem_tcp_size: 540

Task 4: Default Queries

Brim has 12 premade queries. These cover:

• Overall activity
• Windows networking
• Unique connections & transfers
• DNS & HTTP activity
• File activity
• IP subnet stats
• Suricata alerts That completes the entire Brim room in clean, professional walkthrough style.

Q1: What is the name of the detected GIF file?

1. I opened task4-sample-b.pcap.
2. From the left sidebar, I ran the File Activity query.

3. Results showed a .gif file:

cat01_with_hidden_text.gif

Q2: In the conn logfile, how many unique city names are identified?

I switched back to sample.pcap.

Searched only conn logs:

_path=="conn"

Extracted city field:

_path=="conn" | cut geo.orig.city

Counted unique cities:

_path=="conn" | cut geo.resp.city | sort | uniq -c

Result: 2 cities.

Q3: What is the Signature ID of the “Potential Corporate Privacy Violation” alert?

I switched to task4-sample-b.pcap again.

Used Suricata Alerts by Category query.

Modified query to also show signature IDs:

event_type=="alert" | count() by alert.severity,alert.category,alert.signature,alert.signature_id | sort count

Found the matching entry →

alert.category: Potential Corporate Privacy Violation
alert.signature_id: 2012887

Task 5: Use Cases

Brim queries for real investigations. This tasks covers a variety of common analysis queries to use in Brim when you work as security analysts.

• Find hosts: Lists all active hosts on the network.

_path=="conn" | cut id.orig_h, id.resp_h | sort | uniq

• Frequent communications (possible backdoors): Identifies hosts communicating most often, useful for spotting exfiltration or backdoor activities.

_path=="conn" | cut id.orig_h, id.resp_h | sort | uniq -c | sort -r

Active ports: Helps uncover hidden activities by analyzing frequently used ports.

_path=="conn" | cut id.resp_p, service | sort | uniq -c | sort -r count

Long connections: Flags unusual persistent connections, which may indicate backdoors.

_path=="conn" | cut id.orig_h, id.resp_p, id.resp_h, duration | sort -r duration

Data transfer analysis: Helps identify possible data exfiltration or malware distribution.

_path=="conn" | put total_bytes := orig_bytes + resp_bytes | sort -r total_bytes | cut uid, id, orig_bytes, resp_bytes, total_bytes

Suspicious DNS & HTTP: Detects suspicious domain requests, useful for spotting C2 communications.

_path=="dns" | count() by query | sort -r
_path=="http" | count() by uri | sort -r

Detecting Files: Investigates suspicious file movements, including malware and sensitive data.

filename!=null

Analyzing SMB Activity: Examines potential lateral movement and malicious file sharing.

_path=="dce_rpc" OR _path=="smb_mapping" OR _path=="smb_files"

Reviewing Security Alerts/ Known Patterns: Correlates logs from IDS/IPS solutions like Zeek or Suricata.

event_type=="alert" or _path=="notice" or _path=="signatures"

This structured approach helps security analysts like me to quickly identify and respond to threats using Brim’s powerful filtering and search capabilities.

Task 6: Malware C2 Detection

Scenario

An employee clicked a malicious link, downloaded a file, and we noticed strange traffic. I’ll investigate the given task6-malware-c2.pcap file in Brim.

Q1: What is the name of the file downloaded from the CobaltStrike C2 connection?

Steps I took:

Loaded task6-malware-c2.pcap in Brim.

Ran an overview query to see all activity types:

count() by _path | sort -r

Checked frequently communicated hosts:

cut id.orig_h, id.resp_p, id.resp_h | sort | uniq -c | sort -r count

• Found heavy communication:
• Source: 10.22.5.47
• Destination: 104.168.44.45

Checked most common ports:

_path=="conn" | cut id.resp_p, service | sort | uniq -c | sort -r count

• Seems normal at first. but saw lots of DNS traffic → which is suspicious.

1. Looked at DNS queries:

_path=="dns" | count() by query | sort -r

• Found weird domains like hashingold.top → confirmed malicious via VirusTotal.

Moved to HTTP logs for downloads:

_path=="http" | cut id.orig_h, id.resp_h, id.resp_p, method, host, uri | uniq -c | sort value.uri

• Found a suspicious executable: 4564.exe.

Q2: What is the number of CobaltStrike connections using port 443?

Steps I took:

1. Since the download IP (104.168.44.45) was linked to CobaltStrike, I filtered connections on port 443:

_path=="conn" and id.resp_h==104.168.44.45 and id.resp_p==443 | count()

1. Brim result showed 328 connections.

Q3: What is the name of the secondary C2 channel?

Steps I took:

Let’s have another look at the VirusTotal page on the suspicous IP:

• Under Relations, I can see 2022–01–12-IOCs-for-IcedID-with-Cobalt-Strike-and-DarkVNC.txt being mentioned.

Checked Suricata alerts:

event_type=="alert" | cut alert.signature | sort -r | uniq -c | sort -r count

• IcedID can be seen mentioned in the second to last row.

This seems to be the secondary C2 channel.

• Cross-verified on VirusTotal (104.168.44.45) → related to IcedID malware.

Task 7: Crypto Mining

Scenario

Crypto mining often involves compromised internal machines abusing resources. I’ll investigate the given task7-crypto-mine.pcapng file.

Q1: How many connections used port 19999?

Steps I took:

1. Loaded task7-crypto-mine.pcapng in Brim.
2. Checked activity overview:

count() by _path | sort -r

3. Analyzed connections and ports:

_path=="conn" | cut id.resp_p, service | sort | uniq -c | sort -r count

• Found 22 connections on port 19999.

Q2: What is the name of the service used by port 6666?

Steps I took:

• From the previous port analysis, saw that port 6666 was associated with:

irc

Q3: What is the amount of transferred total bytes to 101.201.172.235:8888?

Steps I took:

1. Queried for total bytes calculation:

_path=="conn" | put total_bytes := orig_bytes + resp_bytes | sort -r total_bytes | cut uid, id, orig_bytes, resp_bytes, total_bytes

1. Located the specific IP: 101.201.172.235:8888.
2. Found 3729 bytes transferred.

Q4: What is the detected MITRE tactic id?

Steps I took:

Checked Suricata alerts with MITRE mapping:

event_type=="alert" | cut alert.category, alert.metadata.mitre_technique_name, alert.metadata.mitre_technique_id, alert.metadata.mitre_tactic_name, alert.metadata.mitre_tactic_id | sort | uniq -c

Found tactic = Impact.

MITRE ATT&CK tactic ID: TA0040.

Conclusion

I completed the Brim room by:

• Investigating malware traffic (CobaltStrike + IcedID).
• Detecting crypto mining activity (unusual ports, IRC service, mining pool connections).
• Using Brim queries to analyze connections, detect files, DNS anomalies, and Suricata alerts.

Brim proved to be very useful for:

• Quickly identifying threats in pcap files.
• Mapping activity to MITRE ATT&CK tactics.
• Correlating logs with external threat intel (VirusTotal).

Thank you for engaging with my posts! I truly appreciate your time and hope they’re providing value in some way.

I am new on Medium and Github, so any like like and follows will be much appreciated, thanks!

https://github.com/RahulCyberDefense