Abstract

This class is designed and organized to introduce students to important techniques and tools used to analyze captured network traffic or, in other words, PCAP files. This training is an introductory incident response course, which is a supplement of the incident response and threat hunting 1 and 2 courses.

Throughout this class we will take a deep drive into PCAPs, covering different aspects and perspectives necessary for an analyst and incident response, which will help students to collect evidence and artifacts that are useful for composing a complete analysis of a cyber attack and digital forensic analysis. Furthermore, all chapters present practical and real world examples, which allow class attendees to get an exact evaluation of involved difficulties.

The main object of this course is to explain all possible techniques to analyze PCAPS from different levels of details, allowing students to collect key network information such as IP addresses, ports, certificates, conversations, objects and mainly C2 traces from a collected network data. At the second part of the training, sections offer valuable information that are used for identifying C2 communications and decode them. As a bonus, we will be emulating a few shellcodes extracted from PCAPs to understand the real effect and objectives of the attacker.

This class is focused on PCAPsfrom Windows systems, it shows us that PCAPs are essential for any incident response procedure.

Who Should Attend

This class should be attended by incident responders, threat hunters and any professional interested in following and learning the incident response career. As it is a supplemental class, professionals could attend it before or after taking any of the incident response classes.

Key Learning Objectives

This class has the following goals:

  • Learn how to use network threat analysis for detection of cyber security threats.
  • Learn main techniques on how to use Wireshark to detect, identify and isolate critical IOCs.
  • Perform network traffic analysis using different levels of approach to get a complete comprehension of involved artifacts.
  • Apply practical techniques to decrypt encrypted traffic.
  • Learn how to hunt and analyze C2 communications.
  • Learn how to decrypt C2 traffic.
  • Apply effective techniques to decode shellcodes.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Having attended the Malicious Document Analysis course.
  • Student should be comfortable with typical commands on Linux as well classic commands such as grep, awk, sed and similar.
  • Students must have a solid foundation on network topics such protocols and associated concepts.
  • Prior knowledge on threat hunting and incident response might be useful.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • One virtual machine running Ubuntu 22.04+ or REMnux.
  • One virtual machine running Windows 11 x64.
  • Malwoverview installed on both virtual machines, including all necessary APIs already configured.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class is:

  • Introduction
  • Lab Setup
  • Threat Detection
  • Wireshark Foundations
  • Intercept and Decrypt Secure Communications
  • Traffic Analysis
  • Supplemental Network Analysis
  • Flow Analysis
  • Hunting, Analyzing and Decoding C2
  • Other C2 Frameworks
  • General C2 Detection

Note: Topics can be added, merged or removed without prior notice!