1200KM · ANDREY PAUTOV
Home · Article · Ten reports · Screenshot gallery · Publication boundaries

Measured 19 September 2026 · Public derivative · Historical training evidence, not approved threat intelligence.

AdversaryGraph Deterministic PCAP Analysis

Source: 2022-01-07-traffic-analysis-exercise.pcap Capture SHA-256: a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b Semantic result SHA-256: d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482 Analyzer manifest SHA-256: ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde

Executive summary

Decoded 5880 packets across 27 IP endpoints and 157 transport flows. Observed 88 DNS events, 24 HTTP requests, 24 TLS ClientHello events, and 14 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 2 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.

Capture facts

Deterministic findings

MEDIUM — Script, archive, or executable transfer candidate

HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.

Rule: script-or-executable-transfer@pcap-rules-v3; confidence: 0.86; evidence: frame 5309 / TCP stream 76, frame 5315 / TCP stream 76, frame 5317 / TCP stream 76, frame 5636 / TCP stream 76.

Metrics: {"content_type":"application/octet-stream","declared_body_bytes":307634,"destination":"192.168.1.216","response_count":2,"source":"23.38.189.225","uri":"/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe"}

MEDIUM — Script, archive, or executable transfer candidate

HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.

Rule: script-or-executable-transfer@pcap-rules-v3; confidence: 0.86; evidence: frame 5313 / TCP stream 77, frame 5316 / TCP stream 77.

Metrics: {"content_type":"application/octet-stream","declared_body_bytes":2,"destination":"192.168.1.216","response_count":1,"source":"23.38.189.201","uri":"/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe"}

LOW — Directory-service protocol activity

Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.

Rule: directory-service-activity@pcap-rules-v3; confidence: 0.95; evidence: frame 246 / TCP stream 6, frame 253 / TCP stream 6, frame 254 / TCP stream 10, frame 257 / TCP stream 6, frame 262 / TCP stream 6.

Metrics: {"destination":"192.168.1.216","event_count":30,"operation_numbers":["0","1","12","13","30"],"protocol":"drsuapi","source":"192.168.1.2"}

LOW — Directory-service protocol activity

Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.

Rule: directory-service-activity@pcap-rules-v3; confidence: 0.95; evidence: frame 29 / TCP stream 0, frame 191 / TCP stream 15, frame 213 / TCP stream 15, frame 219 / TCP stream 15, frame 221 / TCP stream 15.

Metrics: {"destination":"192.168.1.216","event_count":47,"operation_numbers":["","1","4,19,19,19,5","4,5","5"],"protocol":"ldap","source":"192.168.1.2"}

LOW — Directory-service protocol activity

Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.

Rule: directory-service-activity@pcap-rules-v3; confidence: 0.95; evidence: frame 931 / TCP stream 43, frame 933 / TCP stream 43, frame 935 / TCP stream 43, frame 937 / TCP stream 43, frame 939 / TCP stream 43.

Metrics: {"destination":"192.168.1.216","event_count":15,"operation_numbers":["1","16","17","3","34","36","39","5","6","64","7"],"protocol":"samr","source":"192.168.1.2"}

LOW — Directory-service protocol activity

Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.

Rule: directory-service-activity@pcap-rules-v3; confidence: 0.95; evidence: frame 241 / TCP stream 6, frame 251 / TCP stream 6, frame 252 / TCP stream 10, frame 255 / TCP stream 6, frame 256 / TCP stream 10.

Metrics: {"destination":"192.168.1.2","event_count":30,"operation_numbers":["0","1","12","13","30"],"protocol":"drsuapi","source":"192.168.1.216"}

LOW — Directory-service protocol activity

Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.

Rule: directory-service-activity@pcap-rules-v3; confidence: 0.95; evidence: frame 27 / TCP stream 0, frame 189 / TCP stream 15, frame 210 / TCP stream 15, frame 218 / TCP stream 15, frame 220 / TCP stream 15.

Metrics: {"destination":"192.168.1.2","event_count":58,"operation_numbers":["","0","2","3"],"protocol":"ldap","source":"192.168.1.216"}

LOW — Directory-service protocol activity

Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.

Rule: directory-service-activity@pcap-rules-v3; confidence: 0.95; evidence: frame 930 / TCP stream 43, frame 932 / TCP stream 43, frame 934 / TCP stream 43, frame 936 / TCP stream 43, frame 938 / TCP stream 43.

Metrics: {"destination":"192.168.1.2","event_count":15,"operation_numbers":["1","16","17","3","34","36","39","5","6","64","7"],"protocol":"samr","source":"192.168.1.216"}

ATT&CK candidates

Identities

IOC and artifact candidates

Actor similarity leads

Local enrichment and correlations

No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution. Snapshot: 4775c16cd4ef1258e6af0730109f96f3ed0ac43a533ee465dd460c85c852613e; recorded 2026-09-19T12:09:31.260950+00:00; mode: local-only. Coverage: {"matched_observables":0,"no_exact_match":94,"observable_limit":5000,"observables_checked":94,"observables_total":94,"prior_case_limit_reached":false,"prior_cases_checked":12,"truncated":false}

Coverage and limitations