Which Zeek log is most useful for identifying file transfers and malware downloads, including file hashes of transferred content?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Zeek's files.log records metadata for all files transferred over the network, including MD5/SHA1/SHA256 hashes when the FileExtract analyzer is enabled, allowing correlation with known malware hashes from threat intelligence. A is wrong because conn.log records connection-level metadata (bytes, duration, ports) but does not contain file metadata or hashes.
Full explanation below image
Full Explanation
B is correct because Zeek's files.log records metadata for all files transferred over the network, including MD5/SHA1/SHA256 hashes when the FileExtract analyzer is enabled, allowing correlation with known malware hashes from threat intelligence. A is wrong because conn.log records connection-level metadata (bytes, duration, ports) but does not contain file metadata or hashes. C is wrong because http.log contains request URIs and some response metadata but does not compute file hashes. D is wrong because weird.log records protocol anomalies and unexpected Zeek behaviors, not file transfer metadata.