Capstone: find the suspicious traffic with Wireshark
In the mixed traffic of three workstations you find the compromised computer; you uncover the downloaded malware and its digest, the control server and beacon interval, the beacon ID, the domain data was leaked to over DNS and the accounts sent in cleartext, prepare the evidence package and write an incident report. No commands are given; the incident differs in every lab.
Level 101 · 75 min
Friday, 17:40. Elif is about to leave: "A capture came in from the gateway, three workstations’ afternoon traffic. We suspect one of them, but we don’t know which. By Monday morning I want a report that explains to management what happened. This time it is all yours."
This is a final task: I give no commands or click paths. Each step is a question and a file to deliver. If you get stuck, the hint reminds you of the method; after two wrong tries the solution appears. Going back to earlier lessons is allowed.
The capture: ~/captures/incident.pcapng. Collect your answers in the ~/case folder and your report in ~/ws-incident.txt. Don’t run any file you extract from the traffic.
What you will do in this lesson
- Open the case
- 1. Which computer?
- 2. What was downloaded?
- 3. The control server and interval
- 4. The beacon ID
- 5. Leaking over DNS
- 6. Exposed accounts
- 7. The evidence package
- 8. The incident report
- Short quiz
Skills you will earn
- Finding the compromised computer and its indicators in mixed traffic
- Exporting files carried over HTTP (Export Objects)
- Taking an evidence file’s SHA-256 digest
- Finding beaconing by measuring the connection interval
- Writing a detection script for data exfiltration over DNS
- Finding cleartext credentials in traffic
- Exporting only the related packets to a new file (Export Specified Packets)
- Writing an incident report from traffic analysis
← Wireshark: extracting fields with tshark · Wireshark fundamentals
Start for free