Introduction It's that time of the month again... Time for another traffic analysis quiz! This one is from a Windows 10 client logged into an Active Directory (AD) environment. Details follow:
The pcap and alerts are available on my Github repository at:
The zip archives are password-protected with the term: infected The alerts archive contains an image of alerts and a text file with the same information.
The alerts file was created using Security Onion running Suricata using the EmergingThreats Pro ruleset, and the alerts were viewed using Sguil. The alerts should give away the type of infection(s) happening on the Windows computer at ugly-wolf.net. Since this is an AD environment, you should also be able to find the user account name that was logged into the Windows host before it became infected. In a real-world situation, this could help you track down an infected user and perform incident response actions. You can also use this quiz to practice drafting an incident report. If the answers are not obvious, feel free to leave a comment in the comments section, and I'll answer when I get the time. --- |
Brad 435 Posts ISC Handler Oct 16th 2020 |
Thread locked Subscribe |
Oct 16th 2020 1 year ago |
Is the actual file removed? I can see the file name being downloaded but when I look at the HTTP object list it isn't there. I tried a different pcap and can see files in it so I feel it should work, or I'm missing something. I got the PC name, OS version, browser, user, and website right away. Good practice! Thanks for this!
|
Sam 6 Posts |
Quote |
Oct 23rd 2020 1 year ago |
Thanks for the reply! The file names listed in the export HTTP object list are based on the last part of the URL. For example, the URL to filmtalks[.]co that returned an EXE ended with /YZ, so that object will show up as "YZ" as the Filename in the HTTP object list. The URL to vastraindia[.]com that ended with /haVu4Afjor4px returned the Word document, so that object shows up as "haVu4Afjor4px" for the Filename in the HTTP object list.
These won't show up as whatever the "filename" line shows from the HTTP response headers. Hope this helps. |
Brad 435 Posts ISC Handler |
Quote |
Nov 10th 2020 1 year ago |
Sign Up for Free or Log In to start participating in the conversation!