Case file: ransomware precursors on the Harborline Freight network
In the captures of the fictional logistics company Harborline Freight you trace the attacker step by step from initial access to the moment before encryption.
Level 301 · 15 lessons · 12 practice labs
Lessons
The start of the incident
- The briefing: an odd load on the storage server
- Knowing the data: PCAPs, Zeek logs and a network map
- Initial access: the moment the phishing attachment was downloaded
- The first callback: a new host calling out
- Short task: identify the first affected computer and the time
Moving through the network
- Internal discovery: scans and LDAP queries
- SMB and RDP connections with a stolen account
- Data being staged on one server
- The archive sent out before encryption
- Short task: place every host the attacker touched on a timeline
Findings and recommendations
- Extracting indicators: IP, domain, file hash, JA3
- Which alerts were missed: rule and sensor gaps
- Suricata and Zeek detections proposed to catch it next time
- Executive summary: telling the story to a non-technical reader
- Capstone: deliver the Harborline incident report with timeline and indicators
Practice labs
- Know the data you have: Match the Harborline case PCAPs, Zeek logs and network map and write the time range each source covers.
- Identify the first affected computer: Find the moment the phishing attachment was downloaded and report the first affected computer with the time.
- Prove the first callback: Find the first new outbound connection after the download and show with three pieces of evidence why it is not ordinary traffic.
- Find the internal scan: Identify the host scanning the internal network and the range it scanned in the Zeek logs.
- Connections of the compromised account: Order the SMB and RDP sessions made with the same account together with their targets.
- Place every touched host on the timeline: Place every host accessed during the case on a timeline with first access time and protocol used.
- Find the server where data was gathered: Find the server receiving an unusually large amount of data inside the network from byte counts.
- Measure the archive sent out: Determine the destination, duration and total size of the large outbound transfer.
- Tie the staging to the exfiltration: Prove through time, size and host that the internal staging and the outbound transfer concern the same data.
- List the indicators: Gather the IP, domain, file hash and JA3 indicators from the case in one table.
- Find the missed alert and propose a detection: Determine which stage produced no alert and propose one Suricata rule and one Zeek detection that would catch it.
- Write the executive summary: Tell the Harborline incident to a non-technical reader on one page under what happened, impact and top three recommendations.
About this course
In the captures of the fictional logistics company Harborline Freight you trace the attacker step by step from initial access to the moment before encryption.
What you will learn
- The start of the incident
- Moving through the network
- Findings and recommendations
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.