{ "id": "507c6eec-8119-424e-bada-fcd00ccff4f5", "name": "PCAP verified workflow 2021-09-10 20260919", "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.", "status": "active", "domain": "enterprise-attack", "actor_ids": [], "technique_ids": [ "T1105" ], "report_ids": [], "evidence_nodes": [ { "id": "log-pcap:9923b3d5-8d06-4f6a-b1f1-810507712be3", "type": "log-pcap-analysis", "label": "2021-09-10-traffic-analysis-exercise.pcap", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2021-09-10-traffic-analysis-exercise.pcap\nCapture SHA-256: `a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12`\nSemantic result SHA-256: `ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 9221 packets across 66 IP endpoints and 263 transport flows. Observed 199 DNS events, 58 HTTP requests, 105 TLS ClientHello events, and 45 exported HTTP object(s). Deterministic rules produced 9 finding(s): 0 high, 2 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 9221\n- Duration: 4609.2884 seconds\n- Captured bytes: 6032490\n- Endpoints: 66\n- Flows: 263\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 4193 / TCP stream 100, frame 4198 / TCP stream 100, frame 4200 / TCP stream 100, frame 6404 / TCP stream 100.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":1048578,\"destination\":\"10.9.10.102\",\"response_count\":2,\"source\":\"23.1.237.216\",\"uri\":\"/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 4195 / TCP stream 101, frame 4199 / TCP stream 101, frame 4201 / TCP stream 101, frame 6356 / TCP stream 101, frame 6371 / TCP stream 101.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":1970634,\"destination\":\"10.9.10.102\",\"response_count\":3,\"source\":\"23.1.237.225\",\"uri\":\"/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 19, frame 64, frame 134, frame 168, frame 7624.\n\nMetrics: `{\"domain\":\"wpad.angrypoutine.com\",\"response_count\":12,\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 389 / TCP stream 15, frame 398 / TCP stream 15, frame 404 / TCP stream 15, frame 417 / TCP stream 15, frame 2059 / TCP stream 67.\n\nMetrics: `{\"destination\":\"10.9.10.9\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 80 / TCP stream 1, frame 83 / TCP stream 1, frame 478 / TCP stream 22, frame 483 / TCP stream 22, frame 486 / TCP stream 22.\n\nMetrics: `{\"destination\":\"10.9.10.9\",\"event_count\":50,\"operation_numbers\":[\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 440 / TCP stream 19, frame 442 / TCP stream 19, frame 444 / TCP stream 19, frame 446 / TCP stream 19, frame 448 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.9.10.9\",\"event_count\":57,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 391 / TCP stream 15, frame 401 / TCP stream 15, frame 406 / TCP stream 15, frame 418 / TCP stream 15, frame 2060 / TCP stream 67.\n\nMetrics: `{\"destination\":\"10.9.10.102\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.9.10.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 82 / TCP stream 1, frame 480 / TCP stream 22, frame 485 / TCP stream 22, frame 487 / TCP stream 22, frame 495 / TCP stream 23.\n\nMetrics: `{\"destination\":\"10.9.10.102\",\"event_count\":39,\"operation_numbers\":[\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.9.10.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 441 / TCP stream 19, frame 443 / TCP stream 19, frame 445 / TCP stream 19, frame 447 / TCP stream 19, frame 449 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.9.10.102\",\"event_count\":57,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.9.10.9\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `hobart.gunnarsson`; client IPs: 10.9.10.102; frames: 300, 311, 315, 332, 341\n- full-name: `Hobart Gunnarsson`; client IPs: 10.9.10.102; frames: 455\n- hostname: `DESKTOP-KKITB6Q`; client IPs: 10.9.10.102, 169.254.181.227; frames: 1, 3, 5, 6, 9\n- netbios-group: `ANGRYPOUTINE`; client IPs: unbound subject; frames: 7, 8, 11, 35, 38\n\n## IOC and artifact candidates\n\n- domain: `68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `a-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `am2prdapp01-canary.cloudapp.net`; roles: dns-cname\n- domain: `angrypoutine-dc.angrypoutine.com`; roles: dns-query\n- domain: `angrypoutine.com`; roles: dns-query\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `au.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `bing.com`; roles: tls-sni\n- domain: `cdn.onenote.net`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: tls-sni\n- domain: `cp601.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `desktop-kkitb6q.angrypoutine.com`; roles: dns-query\n- domain: `desktop-muyeyv7.angrypoutine.com`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `evoke-windowsservices-tas.msedge.net`; roles: dns-query, tls-sni\n- domain: `f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com.akadns.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fp-afd.azureedge.us`; roles: dns-query, tls-sni\n- domain: `fp-afd.azurefd.us`; roles: dns-query, tls-sni\n- domain: `fp-vs-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp.msedge.net`; roles: dns-query, tls-sni\n- domain: `fs.microsoft.com`; roles: dns-query, tls-sni\n- domain: `gameplayapi.intel.com`; roles: dns-query, tls-sni\n- domain: `geo.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `k-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `kv601.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.live.com`; roles: dns-query, tls-sni\n- domain: `microsoft.com`; roles: dns-query, tls-sni\n- domain: `moiafdazure.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `myexternalip.com`; roles: dns-query, tls-sni\n- domain: `nexus.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `office15client.microsoft.com`; roles: dns-query\n- domain: `prod-w.nexus.live.com.akadns.net`; roles: dns-cname\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `q-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `s-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settingsfd-geo.trafficmanager.net`; roles: dns-cname\n- domain: `simpsonsavingss.com`; roles: dns-query, http-host\n- domain: `slscr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `spo-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `store-images.s-microsoft.com`; roles: dns-query, http-host\n- domain: `storeedgefd.dsx.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `t-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `teams-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `update.googleapis.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wpad.angrypoutine.com`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.microsoft.com`; roles: dns-query, tls-sni\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `10.9.10.102`; roles: dns-answer, network-endpoint\n- ipv4: `10.9.10.103`; roles: dns-answer, network-endpoint\n- ipv4: `10.9.10.255`; roles: network-endpoint\n- ipv4: `10.9.10.9`; roles: dns-answer, network-endpoint\n- ipv4: `104.125.253.131`; roles: dns-answer, network-endpoint\n- ipv4: `104.215.148.63`; roles: dns-answer, network-endpoint\n- ipv4: `104.46.162.226`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.136.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.18.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.3.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.49.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.88`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.239.72`; roles: dns-answer, network-endpoint\n- ipv4: `13.77.161.179`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `167.172.37.9`; roles: network-endpoint\n- ipv4: `169.254.181.227`; roles: network-endpoint\n- ipv4: `169.254.255.255`; roles: network-endpoint\n- ipv4: `172.217.168.195`; roles: dns-answer, network-endpoint\n- ipv4: `184.85.229.68`; roles: dns-answer, network-endpoint\n- ipv4: `194.62.42.206`; roles: dns-answer, network-endpoint\n- ipv4: `20.140.48.71`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.7`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.151.131`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.151.132`; roles: dns-answer\n- ipv4: `20.190.151.133`; roles: dns-answer\n- ipv4: `20.190.151.134`; roles: dns-answer\n- ipv4: `20.190.151.6`; roles: dns-answer\n- ipv4: `20.190.151.68`; roles: dns-answer\n- ipv4: `20.190.151.69`; roles: dns-answer\n- ipv4: `20.190.151.9`; roles: dns-answer\n- ipv4: `20.190.154.136`; roles: dns-answer\n- ipv4: `20.190.154.138`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.154.139`; roles: dns-answer\n- ipv4: `20.190.154.16`; roles: dns-answer\n- ipv4: `20.190.154.17`; roles: dns-answer\n- ipv4: `20.190.154.18`; roles: dns-answer\n- ipv4: `20.190.154.19`; roles: dns-answer\n- ipv4: `20.42.73.25`; roles: dns-answer, network-endpoint\n- ipv4: `20.50.73.10`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.222`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.254`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.1.237.200`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.237.201`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.237.209`; roles: dns-answer\n- ipv4: `23.1.237.216`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.237.225`; roles: dns-answer, network-endpoint\n- ipv4: `23.100.36.182`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.6.28`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.84.67`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.85.202`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.85.234`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.86.10`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `34.117.59.81`; roles: dns-answer, network-endpoint\n- ipv4: `40.112.72.205`; roles: dns-answer\n- ipv4: `40.113.200.201`; roles: dns-answer\n- ipv4: `40.125.122.151`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.26.132`; roles: dns-answer\n- ipv4: `40.126.26.134`; roles: dns-answer\n- ipv4: `40.126.26.135`; roles: dns-answer, network-endpoint\n- ipv4: `40.76.4.15`; roles: dns-answer\n- ipv4: `40.83.240.146`; roles: network-endpoint\n- ipv4: `51.137.102.183`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.75`; roles: dns-answer\n- ipv4: `52.109.76.32`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.76.36`; roles: network-endpoint\n- ipv4: `52.109.8.19`; roles: network-endpoint\n- ipv4: `52.109.8.22`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.25`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.196.254`; roles: dns-answer, network-endpoint\n- ipv4: `52.137.106.217`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.208`; roles: dns-answer, network-endpoint\n- ipv4: `52.184.217.20`; roles: dns-answer, network-endpoint\n- ipv4: `52.238.248.6`; roles: dns-answer, network-endpoint\n- ipv4: `52.242.101.226`; roles: dns-answer, network-endpoint\n- ipv4: `52.242.97.97`; roles: dns-answer\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `94.158.245.52`; roles: network-endpoint\n- ipv4: `96.17.68.66`; roles: dns-answer, network-endpoint\n- ipv4: `96.17.68.83`; roles: dns-answer\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `51c64c77e60f3980eea90869b68c58a8`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5`; roles: exported-object\n- sha256: `01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc`; roles: exported-object\n- sha256: `0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7`; roles: exported-object\n- sha256: `07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196`; roles: exported-object\n- sha256: `0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c`; roles: exported-object\n- sha256: `0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca`; roles: exported-object\n- sha256: `0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f`; roles: exported-object\n- sha256: `1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb`; roles: exported-object\n- sha256: `153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d`; roles: exported-object\n- sha256: `1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431`; roles: exported-object\n- sha256: `2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51`; roles: exported-object\n- sha256: `2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792`; roles: exported-object\n- sha256: `2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f`; roles: exported-object\n- sha256: `3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864`; roles: exported-object\n- sha256: `36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219`; roles: exported-object\n- sha256: `4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34`; roles: exported-object\n- sha256: `4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e`; roles: exported-object\n- sha256: `4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c`; roles: exported-object\n- sha256: `6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d`; roles: exported-object\n- sha256: `6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee`; roles: exported-object\n- sha256: `729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d`; roles: exported-object\n- sha256: `809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a`; roles: exported-object\n- sha256: `80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1`; roles: exported-object\n- sha256: `84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411`; roles: exported-object\n- sha256: `8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c`; roles: exported-object\n- sha256: `8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5`; roles: exported-object\n- sha256: `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; roles: exported-object\n- sha256: `9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886`; roles: exported-object\n- sha256: `b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4`; roles: exported-object\n- sha256: `b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe`; roles: exported-object\n- sha256: `b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334`; roles: exported-object\n- sha256: `c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652`; roles: exported-object\n- sha256: `cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7`; roles: exported-object\n- sha256: `d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2`; roles: exported-object\n- sha256: `dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d`; roles: exported-object\n- sha256: `e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21`; roles: exported-object\n- sha256: `e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe`; roles: exported-object\n- sha256: `e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a`; roles: exported-object\n- sha256: `ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f`; roles: exported-object\n- sha256: `eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74`; roles: exported-object\n- sha256: `eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8`; roles: exported-object\n- sha256: `f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7`; roles: exported-object\n- sha256: `f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8afe60e61b27f828`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?22c230ae05c29e0f`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094711_e3993b23840c0d600179f647e9ac08158269c095.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab`; roles: http-request\n- url: `http://simpsonsavingss.com/bmdff/BhoHsCtZ/MLdmpfjaX/5uFG3Dz7yt/date1?BNLv65=pAAS`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9?w=150&h=225`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477?w=150&h=150`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Microsoft-Delivery-Optimization/10.0`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043`; roles: http-client\n- user_agent: `Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32`; roles: http-client\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(3).exe`; SHA-256 `1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431`; size 1048576 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(2).exe`; SHA-256 `2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792`; size 1048576 bytes\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"iEx\",\"feature\":\"dynamic-evaluation\",\"offset\":207057}],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `date1%3fBNLv65=pAAS`; SHA-256 `eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8`; size 284816 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(4).exe`; SHA-256 `0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f`; size 922056 bytes\n- exported object `apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477%3fw=150&h=150`; SHA-256 `c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652`; size 24101 bytes\n- exported object `apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185%3fw=150&h=150`; SHA-256 `f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43`; size 19230 bytes\n- exported object `apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8%3fw=150&h=150`; SHA-256 `0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c`; size 17906 bytes\n- exported object `apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9%3fw=150&h=225`; SHA-256 `4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e`; size 16870 bytes\n- exported object `apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165%3fw=150&h=150`; SHA-256 `0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca`; size 13972 bytes\n- exported object `35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab`; SHA-256 `4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4`; size 10821 bytes\n- exported object `35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab`; SHA-256 `4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34`; size 10791 bytes\n- exported object `35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab`; SHA-256 `cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7`; size 10789 bytes\n- exported object `35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab`; SHA-256 `2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51`; size 10781 bytes\n- exported object `35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab`; SHA-256 `8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c`; size 10767 bytes\n- exported object `35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab`; SHA-256 `1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb`; size 10765 bytes\n- exported object `35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab`; SHA-256 `80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1`; size 10763 bytes\n- exported object `35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab`; SHA-256 `07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196`; size 10623 bytes\n- exported object `35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab`; SHA-256 `e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a`; size 10621 bytes\n- exported object `35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab`; SHA-256 `dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d`; size 10593 bytes\n- exported object `35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab`; SHA-256 `0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5`; size 10589 bytes\n- exported object `35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab`; SHA-256 `9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886`; size 7287 bytes\n- exported object `35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab`; SHA-256 `01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc`; size 7285 bytes\n- exported object `35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab`; SHA-256 `2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f`; size 7285 bytes\n- exported object `35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab`; SHA-256 `6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee`; size 7283 bytes\n- exported object `35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab`; SHA-256 `d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2`; size 7277 bytes\n- exported object `35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab`; SHA-256 `ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f`; size 7277 bytes\n- exported object `35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab`; SHA-256 `153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d`; size 7275 bytes\n- exported object `35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab`; SHA-256 `729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d`; size 7275 bytes\n- exported object `35094711_e3993b23840c0d600179f647e9ac08158269c095.cab`; SHA-256 `e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21`; size 7275 bytes\n- exported object `35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab`; SHA-256 `8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5`; size 7273 bytes\n- exported object `35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab`; SHA-256 `3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864`; size 7267 bytes\n- exported object `35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab`; SHA-256 `f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7`; size 7261 bytes\n- exported object `35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab`; SHA-256 `6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d`; size 7189 bytes\n- exported object `35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab`; SHA-256 `0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7`; size 7185 bytes\n- exported object `35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab`; SHA-256 `b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4`; size 7183 bytes\n- exported object `35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab`; SHA-256 `36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219`; size 7181 bytes\n- exported object `35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab`; SHA-256 `e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe`; size 7181 bytes\n- exported object `35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab`; SHA-256 `809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a`; size 7175 bytes\n- exported object `35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab`; SHA-256 `b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334`; size 7175 bytes\n- exported object `35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab`; SHA-256 `6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c`; size 7171 bytes\n- exported object `35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab`; SHA-256 `b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe`; size 7171 bytes\n- exported object `35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab`; SHA-256 `eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74`; size 7171 bytes\n- exported object `apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e%3fw=150&h=150`; SHA-256 `84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411`; size 2222 bytes\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(1).exe`; SHA-256 `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; size 2 bytes\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `fd1ef8f35792013eb051dd90b6a512f313f5655d99849d97a044c7dc6beb785f`; recorded 2026-09-19T12:10:32.214995+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":248,\"observable_limit\":5000,\"observables_checked\":248,\"observables_total\":248,\"prior_case_limit_reached\":false,\"prior_cases_checked\":15,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `8f0da1cd-9998-4d41-9fc7-683302a6ee24` shares 51 observations. This does not establish a common campaign.\n- Prior analysis `96e0e828-93ae-49d5-8104-9f14cb584c3e` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 21 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 18 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":45,\"exported_objects\":46,\"hashed_bytes\":3675348,\"hashed_objects\":46,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":45,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":45}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 9/9, identities 4/4, observables 248/248, artifacts 45/45. Full returned inventory is in the JSON result.\n", "summary": "Decoded 9221 packets across 66 IP endpoints and 263 transport flows. Observed 199 DNS events, 58 HTTP requests, 105 TLS ClientHello events, and 45 exported HTTP object(s). Deterministic rules produced 9 finding(s): 0 high, 2 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "observables": [ { "type": "domain", "value": "68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com", "confidence": 1, "description": "dns-query, tls-sni; frame 583 / UDP stream 29, frame 601 / UDP stream 29, frame 641 / TCP stream 33" }, { "type": "domain", "value": "a-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 632 / UDP stream 36, frame 671 / UDP stream 36, frame 769 / TCP stream 39" }, { "type": "domain", "value": "am2prdapp01-canary.cloudapp.net", "confidence": 1, "description": "dns-cname; frame 587 / UDP stream 25" }, { "type": "domain", "value": "angrypoutine-dc.angrypoutine.com", "confidence": 1, "description": "dns-query; frame 41 / UDP stream 11, frame 42 / UDP stream 11, frame 44 / UDP stream 11, frame 45 / UDP stream 11, frame 8533 / UDP stream 92 +5 more" }, { "type": "domain", "value": "angrypoutine.com", "confidence": 1, "description": "dns-query; frame 26 / UDP stream 5, frame 30 / UDP stream 5" }, { "type": "domain", "value": "api.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 555 / UDP stream 23, frame 556 / UDP stream 23, frame 560 / TCP stream 26, frame 970 / TCP stream 43" }, { "type": "domain", "value": "au.download.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 4182 / UDP stream 72, frame 4187 / UDP stream 72, frame 4193 / TCP stream 100, frame 4195 / TCP stream 101, frame 4200 / TCP stream 100 +2 more" }, { "type": "domain", "value": "bing.com", "confidence": 1, "description": "tls-sni; frame 594 / TCP stream 27" }, { "type": "domain", "value": "cdn.onenote.net", "confidence": 1, "description": "dns-query, tls-sni; frame 510 / UDP stream 22, frame 511 / UDP stream 22, frame 518 / TCP stream 25, frame 519 / TCP stream 24" }, { "type": "domain", "value": "client.wns.windows.com", "confidence": 1, "description": "tls-sni; frame 97 / TCP stream 2" }, { "type": "domain", "value": "cp601.prod.do.dsp.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 4151 / UDP stream 71, frame 4159 / UDP stream 71, frame 4163 / TCP stream 99" }, { "type": "domain", "value": "ctldl.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 8441 / UDP stream 91, frame 8442 / UDP stream 91, frame 8446 / TCP stream 137, frame 8449 / TCP stream 137" }, { "type": "domain", "value": "desktop-kkitb6q.angrypoutine.com", "confidence": 1, "description": "dns-query; frame 22 / UDP stream 4, frame 23 / UDP stream 4" }, { "type": "domain", "value": "desktop-muyeyv7.angrypoutine.com", "confidence": 1, "description": "dns-query; frame 2636 / UDP stream 55, frame 2637 / UDP stream 55, frame 2638 / UDP stream 55, frame 2639 / UDP stream 55" }, { "type": "domain", "value": "dns.msftncsi.com", "confidence": 1, "description": "dns-query; frame 8039 / UDP stream 83, frame 8040 / UDP stream 83, frame 8041 / UDP stream 83, frame 8042 / UDP stream 83" }, { "type": "domain", "value": "download.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 3232 / UDP stream 66, frame 3233 / UDP stream 66, frame 3241 / TCP stream 93, frame 3254 / TCP stream 93, frame 3263 / TCP stream 93 +15 more" }, { "type": "domain", "value": "evoke-windowsservices-tas.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 7989 / UDP stream 81, frame 7990 / UDP stream 81, frame 7995 / TCP stream 123" }, { "type": "domain", "value": "f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com", "confidence": 1, "description": "dns-query, tls-sni; frame 578 / UDP stream 25, frame 587 / UDP stream 25, frame 714 / TCP stream 29" }, { "type": "domain", "value": "fe2cr.update.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3049 / UDP stream 63, frame 3050 / UDP stream 63, frame 3054 / TCP stream 90" }, { "type": "domain", "value": "fe2cr.update.microsoft.com.akadns.net", "confidence": 1, "description": "dns-cname; frame 3050 / UDP stream 63" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 4022 / UDP stream 67, frame 4023 / UDP stream 67, frame 4024 / UDP stream 67, frame 4028 / TCP stream 94" }, { "type": "domain", "value": "fp-afd.azureedge.us", "confidence": 1, "description": "dns-query, tls-sni; frame 634 / UDP stream 38, frame 706 / UDP stream 38, frame 712 / UDP stream 38, frame 870 / TCP stream 42" }, { "type": "domain", "value": "fp-afd.azurefd.us", "confidence": 1, "description": "dns-query, tls-sni; frame 582 / UDP stream 28, frame 605 / UDP stream 28, frame 960 / UDP stream 28, frame 1006 / UDP stream 28, frame 1007 / UDP stream 28 +1 more" }, { "type": "domain", "value": "fp-vs-nocache.azureedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 602 / UDP stream 34, frame 625 / UDP stream 34, frame 682 / TCP stream 37" }, { "type": "domain", "value": "fp.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 633 / UDP stream 37, frame 672 / UDP stream 37, frame 768 / TCP stream 40" }, { "type": "domain", "value": "fs.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 218 / UDP stream 20, frame 219 / UDP stream 20, frame 223 / TCP stream 8, frame 244 / TCP stream 9, frame 264 / TCP stream 10" }, { "type": "domain", "value": "gameplayapi.intel.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2328 / UDP stream 49, frame 2329 / UDP stream 49, frame 2370 / UDP stream 49, frame 2457 / TCP stream 76" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 4096 / UDP stream 69, frame 4097 / UDP stream 69, frame 4107 / TCP stream 96" }, { "type": "domain", "value": "k-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 600 / UDP stream 33, frame 618 / UDP stream 33, frame 684 / TCP stream 35" }, { "type": "domain", "value": "kv601.prod.do.dsp.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 4123 / UDP stream 70, frame 4124 / UDP stream 70, frame 4131 / TCP stream 97" }, { "type": "domain", "value": "login.live.com", "confidence": 1, "description": "dns-query, tls-sni; frame 642 / UDP stream 39, frame 707 / UDP stream 39, frame 3072 / UDP stream 64, frame 3073 / UDP stream 64, frame 8397 / UDP stream 90 +5 more" }, { "type": "domain", "value": "microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1478 / UDP stream 44, frame 1480 / UDP stream 44, frame 1486 / TCP stream 52" }, { "type": "domain", "value": "moiafdazure.clo.footprintdns.com", "confidence": 1, "description": "dns-query, tls-sni; frame 579 / UDP stream 26, frame 584 / UDP stream 26, frame 613 / TCP stream 28" }, { "type": "domain", "value": "myexternalip.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2603 / UDP stream 50, frame 2604 / UDP stream 50, frame 2605 / UDP stream 50, frame 2606 / UDP stream 50, frame 2611 / TCP stream 78" }, { "type": "domain", "value": "nexus.officeapps.live.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2849 / UDP stream 58, frame 2853 / UDP stream 58, frame 2854 / UDP stream 58, frame 8178 / UDP stream 86, frame 8179 / UDP stream 86 +9 more" }, { "type": "domain", "value": "nexusrules.officeapps.live.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2875 / UDP stream 59, frame 2877 / UDP stream 59, frame 2878 / UDP stream 59, frame 1166 / TCP stream 49, frame 2882 / TCP stream 84" }, { "type": "domain", "value": "office15client.microsoft.com", "confidence": 1, "description": "dns-query; frame 1143 / UDP stream 41, frame 1144 / UDP stream 41, frame 2833 / UDP stream 56, frame 2844 / UDP stream 56, frame 2845 / UDP stream 56" }, { "type": "domain", "value": "prod-w.nexus.live.com.akadns.net", "confidence": 1, "description": "dns-cname; frame 2854 / UDP stream 58, frame 8182 / UDP stream 86, frame 9204 / UDP stream 101" }, { "type": "domain", "value": "prod.nexusrules.live.com.akadns.net", "confidence": 1, "description": "dns-cname; frame 2878 / UDP stream 59" }, { "type": "domain", "value": "q-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 581 / UDP stream 27, frame 586 / UDP stream 27, frame 628 / TCP stream 30" }, { "type": "domain", "value": "s-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 597 / UDP stream 31, frame 617 / UDP stream 31, frame 657 / TCP stream 34" }, { "type": "domain", "value": "settings-win.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1086 / UDP stream 40, frame 1087 / UDP stream 40, frame 1088 / UDP stream 40, frame 7445 / UDP stream 76, frame 7446 / UDP stream 76 +13 more" }, { "type": "domain", "value": "settingsfd-geo.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 1088 / UDP stream 40, frame 7451 / UDP stream 76, frame 8376 / UDP stream 89" }, { "type": "domain", "value": "simpsonsavingss.com", "confidence": 1, "description": "dns-query, http-host; frame 1180 / UDP stream 43, frame 1181 / UDP stream 43, frame 1182 / UDP stream 43, frame 1189 / TCP stream 50" }, { "type": "domain", "value": "slscr.update.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3025 / UDP stream 62, frame 3026 / UDP stream 62, frame 3027 / UDP stream 62, frame 3031 / TCP stream 89" }, { "type": "domain", "value": "spo-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 604 / UDP stream 35, frame 637 / UDP stream 35, frame 700 / TCP stream 38" }, { "type": "domain", "value": "store-images.s-microsoft.com", "confidence": 1, "description": "dns-query, http-host; frame 2295 / UDP stream 48, frame 2305 / UDP stream 48, frame 2306 / UDP stream 48, frame 2316 / TCP stream 70, frame 2317 / TCP stream 71 +4 more" }, { "type": "domain", "value": "storeedgefd.dsx.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1932 / UDP stream 45, frame 1933 / UDP stream 45, frame 1936 / UDP stream 45, frame 1945 / UDP stream 45, frame 1946 / UDP stream 45 +8 more" }, { "type": "domain", "value": "t-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 595 / UDP stream 30, frame 596 / UDP stream 30, frame 627 / TCP stream 32" }, { "type": "domain", "value": "teams-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 599 / UDP stream 32, frame 619 / UDP stream 32, frame 683 / TCP stream 36" }, { "type": "domain", "value": "update.googleapis.com", "confidence": 1, "description": "dns-query, tls-sni; frame 8336 / UDP stream 88, frame 8337 / UDP stream 88, frame 8338 / UDP stream 88, frame 8342 / TCP stream 134" }, { "type": "domain", "value": "v10.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3163 / UDP stream 65, frame 3165 / UDP stream 65, frame 4034 / UDP stream 68, frame 4044 / UDP stream 68, frame 5111 / UDP stream 73 +15 more" }, { "type": "domain", "value": "wpad.angrypoutine.com", "confidence": 1, "description": "dns-query; frame 18 / UDP stream 3, frame 19 / UDP stream 3, frame 63 / UDP stream 16, frame 64 / UDP stream 16, frame 133 / UDP stream 17 +15 more" }, { "type": "domain", "value": "www.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 577 / UDP stream 24, frame 590 / UDP stream 24, frame 624 / TCP stream 31, frame 7746 / TCP stream 115" }, { "type": "domain", "value": "www.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1145 / UDP stream 42, frame 1146 / UDP stream 42, frame 2846 / UDP stream 57, frame 2847 / UDP stream 57, frame 2848 / UDP stream 57 +1 more" }, { "type": "domain", "value": "www.msftncsi.com", "confidence": 1, "description": "dns-query, http-host; frame 62 / UDP stream 15, frame 65 / UDP stream 15, frame 75 / TCP stream 0" }, { "type": "ipv4", "value": "0.0.0.0", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "10.9.10.102", "confidence": 1, "description": "dns-answer, network-endpoint; frame 26 / UDP stream 5, frame 30 / UDP stream 5" }, { "type": "ipv4", "value": "10.9.10.103", "confidence": 1, "description": "dns-answer, network-endpoint; frame 2637 / UDP stream 55, frame 2639 / UDP stream 55" }, { "type": "ipv4", "value": "10.9.10.255", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "10.9.10.9", "confidence": 1, "description": "dns-answer, network-endpoint; frame 23 / UDP stream 4, frame 40 / UDP stream 10, frame 42 / UDP stream 11, frame 45 / UDP stream 11, frame 2015 / UDP stream 46 +5 more" }, { "type": "ipv4", "value": "104.125.253.131", "confidence": 1, "description": "dns-answer, network-endpoint; frame 4124 / UDP stream 70, frame 4159 / UDP stream 71" }, { "type": "ipv4", "value": "104.215.148.63", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1480 / UDP stream 44" }, { "type": "ipv4", "value": "104.46.162.226", "confidence": 1, "description": "dns-answer, network-endpoint; frame 3165 / UDP stream 65, frame 4044 / UDP stream 68, frame 5113 / UDP stream 73" }, { "type": "ipv4", "value": "13.107.136.254", "confidence": 1, "description": "dns-answer, network-endpoint; frame 637 / UDP stream 35" }, { "type": "ipv4", "value": "13.107.18.254", "confidence": 1, "description": "dns-answer, network-endpoint; frame 618 / UDP stream 33" }, { "type": "ipv4", "value": "13.107.21.200", "confidence": 1, "description": "dns-answer, network-endpoint; frame 590 / UDP stream 24" }, { "type": "ipv4", "value": "13.107.246.254", "confidence": 1, "description": "dns-answer, network-endpoint; frame 584 / UDP stream 26, frame 596 / UDP stream 30" }, { "type": "ipv4", "value": "13.107.3.254", "confidence": 1, "description": "dns-answer, network-endpoint; frame 617 / UDP stream 31" }, { "type": "ipv4", "value": "13.107.49.254", "confidence": 1, "description": "dns-answer, network-endpoint; frame 586 / UDP stream 27" }, { "type": "ipv4", "value": "13.107.5.88", "confidence": 1, "description": "dns-answer, network-endpoint; frame 7990 / UDP stream 81" }, { "type": "ipv4", "value": "13.69.239.72", "confidence": 1, "description": "dns-answer, network-endpoint; frame 8044 / UDP stream 84" }, { "type": "ipv4", "value": "13.77.161.179", "confidence": 1, "description": "dns-answer; frame 1480 / UDP stream 44" }, { "type": "ipv4", "value": "131.107.255.255", "confidence": 1, "description": "dns-answer; frame 8040 / UDP stream 83, frame 8042 / UDP stream 83" }, { "type": "ipv4", "value": "167.172.37.9", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "169.254.181.227", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "169.254.255.255", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "172.217.168.195", "confidence": 1, "description": "dns-answer, network-endpoint; frame 8338 / UDP stream 88" }, { "type": "ipv4", "value": "184.85.229.68", "confidence": 1, "description": "dns-answer, network-endpoint; frame 511 / UDP stream 22" }, { "type": "ipv4", "value": "194.62.42.206", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1182 / UDP stream 43" }, { "type": "ipv4", "value": "20.140.48.71", "confidence": 1, "description": "dns-answer, network-endpoint; frame 712 / UDP stream 38, frame 1007 / UDP stream 28" }, { "type": "ipv4", "value": "20.189.173.7", "confidence": 1, "description": "dns-answer, network-endpoint; frame 7586 / UDP stream 77" }, { "type": "ipv4", "value": "20.190.151.131", "confidence": 1, "description": "dns-answer, network-endpoint; frame 707 / UDP stream 39" }, { "type": "ipv4", "value": "20.190.151.132", "confidence": 1, "description": "dns-answer; frame 707 / UDP stream 39" }, { "type": "ipv4", "value": "20.190.151.133", "confidence": 1, "description": "dns-answer; frame 707 / UDP stream 39" }, { "type": "ipv4", "value": "20.190.151.134", "confidence": 1, "description": "dns-answer; frame 707 / UDP stream 39" }, { "type": "ipv4", "value": "20.190.151.6", "confidence": 1, "description": "dns-answer; frame 707 / UDP stream 39" }, { "type": "ipv4", "value": "20.190.151.68", "confidence": 1, "description": "dns-answer; frame 707 / UDP stream 39" }, { "type": "ipv4", "value": "20.190.151.69", "confidence": 1, "description": "dns-answer; frame 707 / UDP stream 39" }, { "type": "ipv4", "value": "20.190.151.9", "confidence": 1, "description": "dns-answer; frame 707 / UDP stream 39" }, { "type": "ipv4", "value": "20.190.154.136", "confidence": 1, "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90" }, { "type": "ipv4", "value": "20.190.154.138", "confidence": 1, "description": "dns-answer, network-endpoint; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90" }, { "type": "ipv4", "value": "20.190.154.139", "confidence": 1, "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90" }, { "type": "ipv4", "value": "20.190.154.16", "confidence": 1, "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90" }, { "type": "ipv4", "value": "20.190.154.17", "confidence": 1, "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90" }, { "type": "ipv4", "value": "20.190.154.18", "confidence": 1, "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90" }, { "type": "ipv4", "value": "20.190.154.19", "confidence": 1, "description": "dns-answer; frame 8399 / UDP stream 90" }, { "type": "ipv4", "value": "20.42.73.25", "confidence": 1, "description": "dns-answer, network-endpoint; frame 8655 / UDP stream 94" }, { "type": "ipv4", "value": "20.50.73.10", "confidence": 1, "description": "dns-answer, network-endpoint; frame 7358 / UDP stream 74, frame 7420 / UDP stream 75" }, { "type": "ipv4", "value": "204.79.197.200", "confidence": 1, "description": "dns-answer, network-endpoint; frame 590 / UDP stream 24" } ], "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap" ], "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12", "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed", "observable_count": 248, "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis", "source_analysis_ref": "/api/pcap/analyses/9923b3d5-8d06-4f6a-b1f1-810507712be3", "suspicious_findings": [ { "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v3; confidence 86%.", "category": "Script, archive, or executable transfer candidate", "evidence": "frame 4193 / TCP stream 100, frame 4198 / TCP stream 100, frame 4200 / TCP stream 100, frame 6404 / TCP stream 100", "severity": "medium" }, { "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v3; confidence 86%.", "category": "Script, archive, or executable transfer candidate", "evidence": "frame 4195 / TCP stream 101, frame 4199 / TCP stream 101, frame 4201 / TCP stream 101, frame 6356 / TCP stream 101, frame 6371 / TCP stream 101 +1 more", "severity": "medium" }, { "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.", "category": "Repeated unsuccessful DNS resolution", "evidence": "frame 19 / UDP stream 3, frame 64 / UDP stream 16, frame 134 / UDP stream 17, frame 168 / UDP stream 19, frame 7624 / UDP stream 78 +7 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 389 / TCP stream 15, frame 398 / TCP stream 15, frame 404 / TCP stream 15, frame 417 / TCP stream 15, frame 2059 / TCP stream 67 +20 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 80 / TCP stream 1, frame 83 / TCP stream 1, frame 478 / TCP stream 22, frame 483 / TCP stream 22, frame 486 / TCP stream 22 +45 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 440 / TCP stream 19, frame 442 / TCP stream 19, frame 444 / TCP stream 19, frame 446 / TCP stream 19, frame 448 / TCP stream 19 +52 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 391 / TCP stream 15, frame 401 / TCP stream 15, frame 406 / TCP stream 15, frame 418 / TCP stream 15, frame 2060 / TCP stream 67 +20 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 82 / TCP stream 1, frame 480 / TCP stream 22, frame 485 / TCP stream 22, frame 487 / TCP stream 22, frame 495 / TCP stream 23 +34 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 441 / TCP stream 19, frame 443 / TCP stream 19, frame 445 / TCP stream 19, frame 447 / TCP stream 19, frame 449 / TCP stream 19 +52 more", "severity": "low" } ], "observables_truncated": true, "actor_similarity_leads": [ { "status": "ttp-overlap-not-attribution", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "group_attack_id": "G0123", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "group_attack_id": "G0044", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "group_attack_id": "G0130", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "group_attack_id": "G0136", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "group_attack_id": "G0133", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0107", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G1013", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0066", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0075", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "group_attack_id": "G0120", "shared_techniques": [ "T1105" ] } ], "expected_suspicious_behaviors": [] }, { "id": "ttp-evidence:9923b3d5-8d06-4f6a-b1f1-810507712be3:T1105", "type": "ttp-evidence", "label": "T1105 Ingress Tool Transfer", "source": "log-pcap-analysis", "status": "suggested", "tactic": "command-and-control", "evidence": "T1105 Ingress Tool Transfer", "attack_id": "T1105", "confidence": 0.8, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com", "type": "ioc", "value": "68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 583 / UDP stream 29, frame 601 / UDP stream 29, frame 641 / TCP stream 33", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a-ring.msedge.net", "type": "ioc", "value": "a-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 632 / UDP stream 36, frame 671 / UDP stream 36, frame 769 / TCP stream 39", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:am2prdapp01-canary.cloudapp.net", "type": "ioc", "value": "am2prdapp01-canary.cloudapp.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-cname; frame 587 / UDP stream 25", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:angrypoutine-dc.angrypoutine.com", "type": "ioc", "value": "angrypoutine-dc.angrypoutine.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query; frame 41 / UDP stream 11, frame 42 / UDP stream 11, frame 44 / UDP stream 11, frame 45 / UDP stream 11, frame 8533 / UDP stream 92 +5 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:angrypoutine.com", "type": "ioc", "value": "angrypoutine.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query; frame 26 / UDP stream 5, frame 30 / UDP stream 5", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:api.msn.com", "type": "ioc", "value": "api.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 555 / UDP stream 23, frame 556 / UDP stream 23, frame 560 / TCP stream 26, frame 970 / TCP stream 43", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:au.download.windowsupdate.com", "type": "ioc", "value": "au.download.windowsupdate.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, http-host; frame 4182 / UDP stream 72, frame 4187 / UDP stream 72, frame 4193 / TCP stream 100, frame 4195 / TCP stream 101, frame 4200 / TCP stream 100 +2 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:bing.com", "type": "ioc", "value": "bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "tls-sni; frame 594 / TCP stream 27", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:cdn.onenote.net", "type": "ioc", "value": "cdn.onenote.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 510 / UDP stream 22, frame 511 / UDP stream 22, frame 518 / TCP stream 25, frame 519 / TCP stream 24", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:client.wns.windows.com", "type": "ioc", "value": "client.wns.windows.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "tls-sni; frame 97 / TCP stream 2", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:cp601.prod.do.dsp.mp.microsoft.com", "type": "ioc", "value": "cp601.prod.do.dsp.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 4151 / UDP stream 71, frame 4159 / UDP stream 71, frame 4163 / TCP stream 99", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ctldl.windowsupdate.com", "type": "ioc", "value": "ctldl.windowsupdate.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, http-host; frame 8441 / UDP stream 91, frame 8442 / UDP stream 91, frame 8446 / TCP stream 137, frame 8449 / TCP stream 137", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:desktop-kkitb6q.angrypoutine.com", "type": "ioc", "value": "desktop-kkitb6q.angrypoutine.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query; frame 22 / UDP stream 4, frame 23 / UDP stream 4", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:desktop-muyeyv7.angrypoutine.com", "type": "ioc", "value": "desktop-muyeyv7.angrypoutine.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query; frame 2636 / UDP stream 55, frame 2637 / UDP stream 55, frame 2638 / UDP stream 55, frame 2639 / UDP stream 55", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:dns.msftncsi.com", "type": "ioc", "value": "dns.msftncsi.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query; frame 8039 / UDP stream 83, frame 8040 / UDP stream 83, frame 8041 / UDP stream 83, frame 8042 / UDP stream 83", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:download.windowsupdate.com", "type": "ioc", "value": "download.windowsupdate.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, http-host; frame 3232 / UDP stream 66, frame 3233 / UDP stream 66, frame 3241 / TCP stream 93, frame 3254 / TCP stream 93, frame 3263 / TCP stream 93 +15 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:evoke-windowsservices-tas.msedge.net", "type": "ioc", "value": "evoke-windowsservices-tas.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 7989 / UDP stream 81, frame 7990 / UDP stream 81, frame 7995 / TCP stream 123", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com", "type": "ioc", "value": "f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 578 / UDP stream 25, frame 587 / UDP stream 25, frame 714 / TCP stream 29", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe2cr.update.microsoft.com", "type": "ioc", "value": "fe2cr.update.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 3049 / UDP stream 63, frame 3050 / UDP stream 63, frame 3054 / TCP stream 90", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe2cr.update.microsoft.com.akadns.net", "type": "ioc", "value": "fe2cr.update.microsoft.com.akadns.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-cname; frame 3050 / UDP stream 63", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe3cr.delivery.mp.microsoft.com", "type": "ioc", "value": "fe3cr.delivery.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 4022 / UDP stream 67, frame 4023 / UDP stream 67, frame 4024 / UDP stream 67, frame 4028 / TCP stream 94", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fp-afd.azureedge.us", "type": "ioc", "value": "fp-afd.azureedge.us", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 634 / UDP stream 38, frame 706 / UDP stream 38, frame 712 / UDP stream 38, frame 870 / TCP stream 42", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fp-afd.azurefd.us", "type": "ioc", "value": "fp-afd.azurefd.us", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 582 / UDP stream 28, frame 605 / UDP stream 28, frame 960 / UDP stream 28, frame 1006 / UDP stream 28, frame 1007 / UDP stream 28 +1 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fp-vs-nocache.azureedge.net", "type": "ioc", "value": "fp-vs-nocache.azureedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 602 / UDP stream 34, frame 625 / UDP stream 34, frame 682 / TCP stream 37", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fp.msedge.net", "type": "ioc", "value": "fp.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 633 / UDP stream 37, frame 672 / UDP stream 37, frame 768 / TCP stream 40", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fs.microsoft.com", "type": "ioc", "value": "fs.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 218 / UDP stream 20, frame 219 / UDP stream 20, frame 223 / TCP stream 8, frame 244 / TCP stream 9, frame 264 / TCP stream 10", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:gameplayapi.intel.com", "type": "ioc", "value": "gameplayapi.intel.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 2328 / UDP stream 49, frame 2329 / UDP stream 49, frame 2370 / UDP stream 49, frame 2457 / TCP stream 76", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:geo.prod.do.dsp.mp.microsoft.com", "type": "ioc", "value": "geo.prod.do.dsp.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 4096 / UDP stream 69, frame 4097 / UDP stream 69, frame 4107 / TCP stream 96", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:k-ring.msedge.net", "type": "ioc", "value": "k-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 600 / UDP stream 33, frame 618 / UDP stream 33, frame 684 / TCP stream 35", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:kv601.prod.do.dsp.mp.microsoft.com", "type": "ioc", "value": "kv601.prod.do.dsp.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 4123 / UDP stream 70, frame 4124 / UDP stream 70, frame 4131 / TCP stream 97", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:login.live.com", "type": "ioc", "value": "login.live.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 642 / UDP stream 39, frame 707 / UDP stream 39, frame 3072 / UDP stream 64, frame 3073 / UDP stream 64, frame 8397 / UDP stream 90 +5 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:microsoft.com", "type": "ioc", "value": "microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 1478 / UDP stream 44, frame 1480 / UDP stream 44, frame 1486 / TCP stream 52", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:moiafdazure.clo.footprintdns.com", "type": "ioc", "value": "moiafdazure.clo.footprintdns.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 579 / UDP stream 26, frame 584 / UDP stream 26, frame 613 / TCP stream 28", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:myexternalip.com", "type": "ioc", "value": "myexternalip.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 2603 / UDP stream 50, frame 2604 / UDP stream 50, frame 2605 / UDP stream 50, frame 2606 / UDP stream 50, frame 2611 / TCP stream 78", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:nexus.officeapps.live.com", "type": "ioc", "value": "nexus.officeapps.live.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 2849 / UDP stream 58, frame 2853 / UDP stream 58, frame 2854 / UDP stream 58, frame 8178 / UDP stream 86, frame 8179 / UDP stream 86 +9 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:nexusrules.officeapps.live.com", "type": "ioc", "value": "nexusrules.officeapps.live.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 2875 / UDP stream 59, frame 2877 / UDP stream 59, frame 2878 / UDP stream 59, frame 1166 / TCP stream 49, frame 2882 / TCP stream 84", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:office15client.microsoft.com", "type": "ioc", "value": "office15client.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query; frame 1143 / UDP stream 41, frame 1144 / UDP stream 41, frame 2833 / UDP stream 56, frame 2844 / UDP stream 56, frame 2845 / UDP stream 56", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:prod-w.nexus.live.com.akadns.net", "type": "ioc", "value": "prod-w.nexus.live.com.akadns.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-cname; frame 2854 / UDP stream 58, frame 8182 / UDP stream 86, frame 9204 / UDP stream 101", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:prod.nexusrules.live.com.akadns.net", "type": "ioc", "value": "prod.nexusrules.live.com.akadns.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-cname; frame 2878 / UDP stream 59", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:q-ring.msedge.net", "type": "ioc", "value": "q-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 581 / UDP stream 27, frame 586 / UDP stream 27, frame 628 / TCP stream 30", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:s-ring.msedge.net", "type": "ioc", "value": "s-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 597 / UDP stream 31, frame 617 / UDP stream 31, frame 657 / TCP stream 34", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:settings-win.data.microsoft.com", "type": "ioc", "value": "settings-win.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 1086 / UDP stream 40, frame 1087 / UDP stream 40, frame 1088 / UDP stream 40, frame 7445 / UDP stream 76, frame 7446 / UDP stream 76 +13 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:settingsfd-geo.trafficmanager.net", "type": "ioc", "value": "settingsfd-geo.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-cname; frame 1088 / UDP stream 40, frame 7451 / UDP stream 76, frame 8376 / UDP stream 89", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:simpsonsavingss.com", "type": "ioc", "value": "simpsonsavingss.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, http-host; frame 1180 / UDP stream 43, frame 1181 / UDP stream 43, frame 1182 / UDP stream 43, frame 1189 / TCP stream 50", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:slscr.update.microsoft.com", "type": "ioc", "value": "slscr.update.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 3025 / UDP stream 62, frame 3026 / UDP stream 62, frame 3027 / UDP stream 62, frame 3031 / TCP stream 89", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:spo-ring.msedge.net", "type": "ioc", "value": "spo-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 604 / UDP stream 35, frame 637 / UDP stream 35, frame 700 / TCP stream 38", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:store-images.s-microsoft.com", "type": "ioc", "value": "store-images.s-microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, http-host; frame 2295 / UDP stream 48, frame 2305 / UDP stream 48, frame 2306 / UDP stream 48, frame 2316 / TCP stream 70, frame 2317 / TCP stream 71 +4 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:storeedgefd.dsx.mp.microsoft.com", "type": "ioc", "value": "storeedgefd.dsx.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 1932 / UDP stream 45, frame 1933 / UDP stream 45, frame 1936 / UDP stream 45, frame 1945 / UDP stream 45, frame 1946 / UDP stream 45 +8 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:t-ring.msedge.net", "type": "ioc", "value": "t-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 595 / UDP stream 30, frame 596 / UDP stream 30, frame 627 / TCP stream 32", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:teams-ring.msedge.net", "type": "ioc", "value": "teams-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 599 / UDP stream 32, frame 619 / UDP stream 32, frame 683 / TCP stream 36", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:update.googleapis.com", "type": "ioc", "value": "update.googleapis.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 8336 / UDP stream 88, frame 8337 / UDP stream 88, frame 8338 / UDP stream 88, frame 8342 / TCP stream 134", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:v10.events.data.microsoft.com", "type": "ioc", "value": "v10.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 3163 / UDP stream 65, frame 3165 / UDP stream 65, frame 4034 / UDP stream 68, frame 4044 / UDP stream 68, frame 5111 / UDP stream 73 +15 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wpad.angrypoutine.com", "type": "ioc", "value": "wpad.angrypoutine.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query; frame 18 / UDP stream 3, frame 19 / UDP stream 3, frame 63 / UDP stream 16, frame 64 / UDP stream 16, frame 133 / UDP stream 17 +15 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.bing.com", "type": "ioc", "value": "www.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 577 / UDP stream 24, frame 590 / UDP stream 24, frame 624 / TCP stream 31, frame 7746 / TCP stream 115", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.microsoft.com", "type": "ioc", "value": "www.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, tls-sni; frame 1145 / UDP stream 42, frame 1146 / UDP stream 42, frame 2846 / UDP stream 57, frame 2847 / UDP stream 57, frame 2848 / UDP stream 57 +1 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.msftncsi.com", "type": "ioc", "value": "www.msftncsi.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-query, http-host; frame 62 / UDP stream 15, frame 65 / UDP stream 15, frame 75 / TCP stream 0", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:0.0.0.0", "type": "ioc", "value": "0.0.0.0", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "network-endpoint; no frame reference", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:10.9.10.102", "type": "ioc", "value": "10.9.10.102", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 26 / UDP stream 5, frame 30 / UDP stream 5", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:10.9.10.103", "type": "ioc", "value": "10.9.10.103", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 2637 / UDP stream 55, frame 2639 / UDP stream 55", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:10.9.10.255", "type": "ioc", "value": "10.9.10.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "network-endpoint; no frame reference", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:10.9.10.9", "type": "ioc", "value": "10.9.10.9", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 23 / UDP stream 4, frame 40 / UDP stream 10, frame 42 / UDP stream 11, frame 45 / UDP stream 11, frame 2015 / UDP stream 46 +5 more", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:104.125.253.131", "type": "ioc", "value": "104.125.253.131", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 4124 / UDP stream 70, frame 4159 / UDP stream 71", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:104.215.148.63", "type": "ioc", "value": "104.215.148.63", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 1480 / UDP stream 44", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:104.46.162.226", "type": "ioc", "value": "104.46.162.226", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 3165 / UDP stream 65, frame 4044 / UDP stream 68, frame 5113 / UDP stream 73", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.136.254", "type": "ioc", "value": "13.107.136.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 637 / UDP stream 35", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.18.254", "type": "ioc", "value": "13.107.18.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 618 / UDP stream 33", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.21.200", "type": "ioc", "value": "13.107.21.200", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 590 / UDP stream 24", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.246.254", "type": "ioc", "value": "13.107.246.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 584 / UDP stream 26, frame 596 / UDP stream 30", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.3.254", "type": "ioc", "value": "13.107.3.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 617 / UDP stream 31", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.49.254", "type": "ioc", "value": "13.107.49.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 586 / UDP stream 27", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.5.88", "type": "ioc", "value": "13.107.5.88", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 7990 / UDP stream 81", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.69.239.72", "type": "ioc", "value": "13.69.239.72", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 8044 / UDP stream 84", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.77.161.179", "type": "ioc", "value": "13.77.161.179", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 1480 / UDP stream 44", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:131.107.255.255", "type": "ioc", "value": "131.107.255.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 8040 / UDP stream 83, frame 8042 / UDP stream 83", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:167.172.37.9", "type": "ioc", "value": "167.172.37.9", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "network-endpoint; no frame reference", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:169.254.181.227", "type": "ioc", "value": "169.254.181.227", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "network-endpoint; no frame reference", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:169.254.255.255", "type": "ioc", "value": "169.254.255.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "network-endpoint; no frame reference", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:172.217.168.195", "type": "ioc", "value": "172.217.168.195", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 8338 / UDP stream 88", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:184.85.229.68", "type": "ioc", "value": "184.85.229.68", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 511 / UDP stream 22", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:194.62.42.206", "type": "ioc", "value": "194.62.42.206", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 1182 / UDP stream 43", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.140.48.71", "type": "ioc", "value": "20.140.48.71", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 712 / UDP stream 38, frame 1007 / UDP stream 28", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.189.173.7", "type": "ioc", "value": "20.189.173.7", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 7586 / UDP stream 77", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.151.131", "type": "ioc", "value": "20.190.151.131", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 707 / UDP stream 39", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.151.132", "type": "ioc", "value": "20.190.151.132", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 707 / UDP stream 39", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.151.133", "type": "ioc", "value": "20.190.151.133", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 707 / UDP stream 39", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.151.134", "type": "ioc", "value": "20.190.151.134", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 707 / UDP stream 39", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.151.6", "type": "ioc", "value": "20.190.151.6", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 707 / UDP stream 39", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.151.68", "type": "ioc", "value": "20.190.151.68", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 707 / UDP stream 39", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.151.69", "type": "ioc", "value": "20.190.151.69", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 707 / UDP stream 39", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.151.9", "type": "ioc", "value": "20.190.151.9", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 707 / UDP stream 39", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.154.136", "type": "ioc", "value": "20.190.154.136", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.154.138", "type": "ioc", "value": "20.190.154.138", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.154.139", "type": "ioc", "value": "20.190.154.139", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.154.16", "type": "ioc", "value": "20.190.154.16", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.154.17", "type": "ioc", "value": "20.190.154.17", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.154.18", "type": "ioc", "value": "20.190.154.18", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.154.19", "type": "ioc", "value": "20.190.154.19", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer; frame 8399 / UDP stream 90", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.42.73.25", "type": "ioc", "value": "20.42.73.25", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 8655 / UDP stream 94", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.50.73.10", "type": "ioc", "value": "20.50.73.10", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 7358 / UDP stream 74, frame 7420 / UDP stream 75", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:204.79.197.200", "type": "ioc", "value": "204.79.197.200", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "description": "dns-answer, network-endpoint; frame 590 / UDP stream 24", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "finding-888e9c1168af2bb2521c2e9a", "type": "pcap-finding", "label": "Script, archive, or executable transfer candidate", "source": "deterministic-pcap-analysis", "metrics": { "uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "source": "23.1.237.216", "destination": "10.9.10.102", "content_type": "application/octet-stream", "response_count": 2, "declared_body_bytes": 1048578 }, "rule_id": "script-or-executable-transfer", "severity": "medium", "confidence": 0.86, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 100, "frame_number": 4193, "display_filter": "frame.number == 4193", "timestamp_epoch": "1631316288.773365000" }, { "tcp_stream": 100, "frame_number": 4198, "display_filter": "frame.number == 4198", "timestamp_epoch": "1631316288.847386000" }, { "tcp_stream": 100, "frame_number": 4200, "display_filter": "frame.number == 4200", "timestamp_epoch": "1631316288.853317000" }, { "tcp_stream": 100, "frame_number": 6404, "display_filter": "frame.number == 6404", "timestamp_epoch": "1631316290.461273000" } ] }, { "id": "finding-4a3305add3580028359ef7dc", "type": "pcap-finding", "label": "Script, archive, or executable transfer candidate", "source": "deterministic-pcap-analysis", "metrics": { "uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe", "source": "23.1.237.225", "destination": "10.9.10.102", "content_type": "application/octet-stream", "response_count": 3, "declared_body_bytes": 1970634 }, "rule_id": "script-or-executable-transfer", "severity": "medium", "confidence": 0.86, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 101, "frame_number": 4195, "display_filter": "frame.number == 4195", "timestamp_epoch": "1631316288.774253000" }, { "tcp_stream": 101, "frame_number": 4199, "display_filter": "frame.number == 4199", "timestamp_epoch": "1631316288.850212000" }, { "tcp_stream": 101, "frame_number": 4201, "display_filter": "frame.number == 4201", "timestamp_epoch": "1631316288.853479000" }, { "tcp_stream": 101, "frame_number": 6356, "display_filter": "frame.number == 6356", "timestamp_epoch": "1631316290.372399000" }, { "tcp_stream": 101, "frame_number": 6371, "display_filter": "frame.number == 6371", "timestamp_epoch": "1631316290.377646000" }, { "tcp_stream": 101, "frame_number": 7346, "display_filter": "frame.number == 7346", "timestamp_epoch": "1631316291.098090000" } ] }, { "id": "finding-cff8089c8f798d22603605ac", "type": "pcap-finding", "label": "Repeated unsuccessful DNS resolution", "source": "deterministic-pcap-analysis", "metrics": { "domain": "wpad.angrypoutine.com", "source": "10.9.10.102", "response_count": 12 }, "rule_id": "repeated-nxdomain", "severity": "low", "confidence": 0.5, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "udp_stream": 3, "frame_number": 19, "display_filter": "frame.number == 19", "timestamp_epoch": "1631315709.539026000" }, { "udp_stream": 16, "frame_number": 64, "display_filter": "frame.number == 64", "timestamp_epoch": "1631315714.217859000" }, { "udp_stream": 17, "frame_number": 134, "display_filter": "frame.number == 134", "timestamp_epoch": "1631315732.217241000" }, { "udp_stream": 19, "frame_number": 168, "display_filter": "frame.number == 168", "timestamp_epoch": "1631315792.232631000" }, { "udp_stream": 78, "frame_number": 7624, "display_filter": "frame.number == 7624", "timestamp_epoch": "1631316392.221760000" }, { "udp_stream": 79, "frame_number": 7762, "display_filter": "frame.number == 7762", "timestamp_epoch": "1631316992.281679000" }, { "udp_stream": 80, "frame_number": 7922, "display_filter": "frame.number == 7922", "timestamp_epoch": "1631317592.283915000" }, { "udp_stream": 85, "frame_number": 8078, "display_filter": "frame.number == 8078", "timestamp_epoch": "1631318192.330117000" }, { "udp_stream": 87, "frame_number": 8314, "display_filter": "frame.number == 8314", "timestamp_epoch": "1631318792.332716000" }, { "udp_stream": 87, "frame_number": 8316, "display_filter": "frame.number == 8316", "timestamp_epoch": "1631318792.421801000" }, { "udp_stream": 93, "frame_number": 8565, "display_filter": "frame.number == 8565", "timestamp_epoch": "1631319392.407330000" }, { "udp_stream": 98, "frame_number": 8826, "display_filter": "frame.number == 8826", "timestamp_epoch": "1631319992.455953000" } ] }, { "id": "finding-f67cfc1410d57105f2d8527d", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.9.10.102", "protocol": "drsuapi", "destination": "10.9.10.9", "event_count": 25, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 15, "frame_number": 389, "display_filter": "frame.number == 389", "timestamp_epoch": "1631315816.202252000" }, { "tcp_stream": 15, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1631315816.203725000" }, { "tcp_stream": 15, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1631315816.205311000" }, { "tcp_stream": 15, "frame_number": 417, "display_filter": "frame.number == 417", "timestamp_epoch": "1631315816.208329000" }, { "tcp_stream": 67, "frame_number": 2059, "display_filter": "frame.number == 2059", "timestamp_epoch": "1631315877.056698000" }, { "tcp_stream": 67, "frame_number": 2067, "display_filter": "frame.number == 2067", "timestamp_epoch": "1631315877.061719000" }, { "tcp_stream": 67, "frame_number": 2069, "display_filter": "frame.number == 2069", "timestamp_epoch": "1631315877.064549000" }, { "tcp_stream": 67, "frame_number": 2073, "display_filter": "frame.number == 2073", "timestamp_epoch": "1631315877.070451000" }, { "tcp_stream": 67, "frame_number": 2075, "display_filter": "frame.number == 2075", "timestamp_epoch": "1631315877.073075000" }, { "tcp_stream": 67, "frame_number": 2077, "display_filter": "frame.number == 2077", "timestamp_epoch": "1631315877.075923000" }, { "tcp_stream": 86, "frame_number": 2962, "display_filter": "frame.number == 2962", "timestamp_epoch": "1631316142.057390000" }, { "tcp_stream": 86, "frame_number": 2966, "display_filter": "frame.number == 2966", "timestamp_epoch": "1631316142.301058000" }, { "tcp_stream": 86, "frame_number": 2968, "display_filter": "frame.number == 2968", "timestamp_epoch": "1631316142.303973000" }, { "tcp_stream": 86, "frame_number": 2972, "display_filter": "frame.number == 2972", "timestamp_epoch": "1631316142.310485000" }, { "tcp_stream": 86, "frame_number": 2974, "display_filter": "frame.number == 2974", "timestamp_epoch": "1631316142.313000000" }, { "tcp_stream": 86, "frame_number": 2976, "display_filter": "frame.number == 2976", "timestamp_epoch": "1631316142.315848000" }, { "tcp_stream": 146, "frame_number": 8702, "display_filter": "frame.number == 8702", "timestamp_epoch": "1631319741.451904000" }, { "tcp_stream": 146, "frame_number": 8706, "display_filter": "frame.number == 8706", "timestamp_epoch": "1631319741.698651000" }, { "tcp_stream": 146, "frame_number": 8708, "display_filter": "frame.number == 8708", "timestamp_epoch": "1631319741.701621000" }, { "tcp_stream": 146, "frame_number": 8712, "display_filter": "frame.number == 8712", "timestamp_epoch": "1631319741.708133000" }, { "tcp_stream": 146, "frame_number": 8714, "display_filter": "frame.number == 8714", "timestamp_epoch": "1631319741.710774000" }, { "tcp_stream": 146, "frame_number": 8717, "display_filter": "frame.number == 8717", "timestamp_epoch": "1631319741.761245000" }, { "tcp_stream": 154, "frame_number": 8902, "display_filter": "frame.number == 8902", "timestamp_epoch": "1631320086.166099000" }, { "tcp_stream": 154, "frame_number": 8904, "display_filter": "frame.number == 8904", "timestamp_epoch": "1631320086.168219000" }, { "tcp_stream": 154, "frame_number": 8906, "display_filter": "frame.number == 8906", "timestamp_epoch": "1631320086.170454000" } ] }, { "id": "finding-f2b09872431e80778a89f237", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.9.10.102", "protocol": "ldap", "destination": "10.9.10.9", "event_count": 50, "operation_numbers": [ "0", "2", "3" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1, "frame_number": 80, "display_filter": "frame.number == 80", "timestamp_epoch": "1631315714.903567000" }, { "tcp_stream": 1, "frame_number": 83, "display_filter": "frame.number == 83", "timestamp_epoch": "1631315714.907528000" }, { "tcp_stream": 22, "frame_number": 478, "display_filter": "frame.number == 478", "timestamp_epoch": "1631315816.964061000" }, { "tcp_stream": 22, "frame_number": 483, "display_filter": "frame.number == 483", "timestamp_epoch": "1631315816.973775000" }, { "tcp_stream": 22, "frame_number": 486, "display_filter": "frame.number == 486", "timestamp_epoch": "1631315817.013900000" }, { "tcp_stream": 23, "frame_number": 493, "display_filter": "frame.number == 493", "timestamp_epoch": "1631315817.083271000" }, { "tcp_stream": 23, "frame_number": 496, "display_filter": "frame.number == 496", "timestamp_epoch": "1631315817.092275000" }, { "tcp_stream": 23, "frame_number": 498, "display_filter": "frame.number == 498", "timestamp_epoch": "1631315817.096649000" }, { "tcp_stream": 22, "frame_number": 500, "display_filter": "frame.number == 500", "timestamp_epoch": "1631315817.117237000" }, { "tcp_stream": 23, "frame_number": 502, "display_filter": "frame.number == 502", "timestamp_epoch": "1631315817.146873000" }, { "tcp_stream": 22, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1631315817.172122000" }, { "tcp_stream": 68, "frame_number": 2114, "display_filter": "frame.number == 2114", "timestamp_epoch": "1631315877.084598000" }, { "tcp_stream": 68, "frame_number": 2119, "display_filter": "frame.number == 2119", "timestamp_epoch": "1631315877.088427000" }, { "tcp_stream": 68, "frame_number": 2122, "display_filter": "frame.number == 2122", "timestamp_epoch": "1631315877.092174000" }, { "tcp_stream": 68, "frame_number": 2124, "display_filter": "frame.number == 2124", "timestamp_epoch": "1631315877.095051000" }, { "tcp_stream": 68, "frame_number": 2126, "display_filter": "frame.number == 2126", "timestamp_epoch": "1631315877.096954000" }, { "tcp_stream": 69, "frame_number": 2133, "display_filter": "frame.number == 2133", "timestamp_epoch": "1631315877.114050000" }, { "tcp_stream": 69, "frame_number": 2137, "display_filter": "frame.number == 2137", "timestamp_epoch": "1631315877.116412000" }, { "tcp_stream": 69, "frame_number": 2143, "display_filter": "frame.number == 2143", "timestamp_epoch": "1631315877.117625000" }, { "tcp_stream": 69, "frame_number": 2145, "display_filter": "frame.number == 2145", "timestamp_epoch": "1631315877.119480000" }, { "tcp_stream": 68, "frame_number": 2149, "display_filter": "frame.number == 2149", "timestamp_epoch": "1631315877.119841000" }, { "tcp_stream": 87, "frame_number": 2982, "display_filter": "frame.number == 2982", "timestamp_epoch": "1631316142.356887000" }, { "tcp_stream": 87, "frame_number": 2987, "display_filter": "frame.number == 2987", "timestamp_epoch": "1631316142.361415000" }, { "tcp_stream": 87, "frame_number": 2990, "display_filter": "frame.number == 2990", "timestamp_epoch": "1631316142.365679000" }, { "tcp_stream": 87, "frame_number": 2992, "display_filter": "frame.number == 2992", "timestamp_epoch": "1631316142.368425000" }, { "tcp_stream": 87, "frame_number": 2995, "display_filter": "frame.number == 2995", "timestamp_epoch": "1631316142.370645000" }, { "tcp_stream": 88, "frame_number": 3001, "display_filter": "frame.number == 3001", "timestamp_epoch": "1631316142.407882000" }, { "tcp_stream": 88, "frame_number": 3004, "display_filter": "frame.number == 3004", "timestamp_epoch": "1631316142.411917000" }, { "tcp_stream": 88, "frame_number": 3009, "display_filter": "frame.number == 3009", "timestamp_epoch": "1631316142.414145000" }, { "tcp_stream": 88, "frame_number": 3011, "display_filter": "frame.number == 3011", "timestamp_epoch": "1631316142.416576000" }, { "tcp_stream": 87, "frame_number": 3014, "display_filter": "frame.number == 3014", "timestamp_epoch": "1631316142.416733000" }, { "tcp_stream": 147, "frame_number": 8725, "display_filter": "frame.number == 8725", "timestamp_epoch": "1631319742.090149000" }, { "tcp_stream": 147, "frame_number": 8730, "display_filter": "frame.number == 8730", "timestamp_epoch": "1631319742.094653000" }, { "tcp_stream": 147, "frame_number": 8733, "display_filter": "frame.number == 8733", "timestamp_epoch": "1631319742.098736000" }, { "tcp_stream": 147, "frame_number": 8735, "display_filter": "frame.number == 8735", "timestamp_epoch": "1631319742.101487000" }, { "tcp_stream": 147, "frame_number": 8737, "display_filter": "frame.number == 8737", "timestamp_epoch": "1631319742.104235000" }, { "tcp_stream": 148, "frame_number": 8744, "display_filter": "frame.number == 8744", "timestamp_epoch": "1631319742.157383000" }, { "tcp_stream": 148, "frame_number": 8747, "display_filter": "frame.number == 8747", "timestamp_epoch": "1631319742.160222000" }, { "tcp_stream": 148, "frame_number": 8752, "display_filter": "frame.number == 8752", "timestamp_epoch": "1631319742.162360000" }, { "tcp_stream": 148, "frame_number": 8754, "display_filter": "frame.number == 8754", "timestamp_epoch": "1631319742.164839000" }, { "tcp_stream": 147, "frame_number": 8756, "display_filter": "frame.number == 8756", "timestamp_epoch": "1631319742.164919000" }, { "tcp_stream": 155, "frame_number": 8912, "display_filter": "frame.number == 8912", "timestamp_epoch": "1631320086.882518000" }, { "tcp_stream": 155, "frame_number": 8917, "display_filter": "frame.number == 8917", "timestamp_epoch": "1631320086.887609000" }, { "tcp_stream": 155, "frame_number": 8923, "display_filter": "frame.number == 8923", "timestamp_epoch": "1631320087.008355000" }, { "tcp_stream": 156, "frame_number": 8930, "display_filter": "frame.number == 8930", "timestamp_epoch": "1631320087.069008000" }, { "tcp_stream": 156, "frame_number": 8933, "display_filter": "frame.number == 8933", "timestamp_epoch": "1631320087.073105000" }, { "tcp_stream": 156, "frame_number": 8935, "display_filter": "frame.number == 8935", "timestamp_epoch": "1631320087.075730000" }, { "tcp_stream": 155, "frame_number": 8937, "display_filter": "frame.number == 8937", "timestamp_epoch": "1631320087.079435000" }, { "tcp_stream": 156, "frame_number": 9078, "display_filter": "frame.number == 9078", "timestamp_epoch": "1631320088.311246000" }, { "tcp_stream": 155, "frame_number": 9082, "display_filter": "frame.number == 9082", "timestamp_epoch": "1631320088.319916000" } ] }, { "id": "finding-7fc4e438e831d844a0841cfe", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.9.10.102", "protocol": "samr", "destination": "10.9.10.9", "event_count": 57, "operation_numbers": [ "1", "16", "17", "18", "19", "20", "25", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 19, "frame_number": 440, "display_filter": "frame.number == 440", "timestamp_epoch": "1631315816.243133000" }, { "tcp_stream": 19, "frame_number": 442, "display_filter": "frame.number == 442", "timestamp_epoch": "1631315816.245054000" }, { "tcp_stream": 19, "frame_number": 444, "display_filter": "frame.number == 444", "timestamp_epoch": "1631315816.246899000" }, { "tcp_stream": 19, "frame_number": 446, "display_filter": "frame.number == 446", "timestamp_epoch": "1631315816.248730000" }, { "tcp_stream": 19, "frame_number": 448, "display_filter": "frame.number == 448", "timestamp_epoch": "1631315816.250617000" }, { "tcp_stream": 19, "frame_number": 450, "display_filter": "frame.number == 450", "timestamp_epoch": "1631315816.252375000" }, { "tcp_stream": 19, "frame_number": 452, "display_filter": "frame.number == 452", "timestamp_epoch": "1631315816.254369000" }, { "tcp_stream": 19, "frame_number": 454, "display_filter": "frame.number == 454", "timestamp_epoch": "1631315816.256268000" }, { "tcp_stream": 19, "frame_number": 456, "display_filter": "frame.number == 456", "timestamp_epoch": "1631315816.258395000" }, { "tcp_stream": 19, "frame_number": 458, "display_filter": "frame.number == 458", "timestamp_epoch": "1631315816.260346000" }, { "tcp_stream": 19, "frame_number": 460, "display_filter": "frame.number == 460", "timestamp_epoch": "1631315816.262280000" }, { "tcp_stream": 19, "frame_number": 462, "display_filter": "frame.number == 462", "timestamp_epoch": "1631315816.264186000" }, { "tcp_stream": 19, "frame_number": 464, "display_filter": "frame.number == 464", "timestamp_epoch": "1631315816.265989000" }, { "tcp_stream": 19, "frame_number": 466, "display_filter": "frame.number == 466", "timestamp_epoch": "1631315816.267805000" }, { "tcp_stream": 19, "frame_number": 468, "display_filter": "frame.number == 468", "timestamp_epoch": "1631315816.269633000" }, { "tcp_stream": 80, "frame_number": 2705, "display_filter": "frame.number == 2705", "timestamp_epoch": "1631315966.505945000" }, { "tcp_stream": 80, "frame_number": 2707, "display_filter": "frame.number == 2707", "timestamp_epoch": "1631315966.508802000" }, { "tcp_stream": 80, "frame_number": 2709, "display_filter": "frame.number == 2709", "timestamp_epoch": "1631315966.511562000" }, { "tcp_stream": 80, "frame_number": 2711, "display_filter": "frame.number == 2711", "timestamp_epoch": "1631315966.514181000" }, { "tcp_stream": 80, "frame_number": 2713, "display_filter": "frame.number == 2713", "timestamp_epoch": "1631315966.516818000" }, { "tcp_stream": 80, "frame_number": 2717, "display_filter": "frame.number == 2717", "timestamp_epoch": "1631315966.895289000" }, { "tcp_stream": 80, "frame_number": 2719, "display_filter": "frame.number == 2719", "timestamp_epoch": "1631315966.897682000" }, { "tcp_stream": 80, "frame_number": 2721, "display_filter": "frame.number == 2721", "timestamp_epoch": "1631315966.900014000" }, { "tcp_stream": 80, "frame_number": 2723, "display_filter": "frame.number == 2723", "timestamp_epoch": "1631315966.902012000" }, { "tcp_stream": 80, "frame_number": 2725, "display_filter": "frame.number == 2725", "timestamp_epoch": "1631315966.903988000" }, { "tcp_stream": 80, "frame_number": 2737, "display_filter": "frame.number == 2737", "timestamp_epoch": "1631315966.916394000" }, { "tcp_stream": 80, "frame_number": 2739, "display_filter": "frame.number == 2739", "timestamp_epoch": "1631315966.918290000" }, { "tcp_stream": 80, "frame_number": 2741, "display_filter": "frame.number == 2741", "timestamp_epoch": "1631315966.920310000" }, { "tcp_stream": 80, "frame_number": 2743, "display_filter": "frame.number == 2743", "timestamp_epoch": "1631315966.922243000" }, { "tcp_stream": 80, "frame_number": 2745, "display_filter": "frame.number == 2745", "timestamp_epoch": "1631315966.923956000" }, { "tcp_stream": 80, "frame_number": 2747, "display_filter": "frame.number == 2747", "timestamp_epoch": "1631315966.925841000" }, { "tcp_stream": 80, "frame_number": 2749, "display_filter": "frame.number == 2749", "timestamp_epoch": "1631315966.927916000" }, { "tcp_stream": 80, "frame_number": 2751, "display_filter": "frame.number == 2751", "timestamp_epoch": "1631315966.929933000" }, { "tcp_stream": 80, "frame_number": 2753, "display_filter": "frame.number == 2753", "timestamp_epoch": "1631315966.932162000" }, { "tcp_stream": 80, "frame_number": 2755, "display_filter": "frame.number == 2755", "timestamp_epoch": "1631315966.934106000" }, { "tcp_stream": 80, "frame_number": 2757, "display_filter": "frame.number == 2757", "timestamp_epoch": "1631315966.936076000" }, { "tcp_stream": 80, "frame_number": 2770, "display_filter": "frame.number == 2770", "timestamp_epoch": "1631315967.107975000" }, { "tcp_stream": 80, "frame_number": 2772, "display_filter": "frame.number == 2772", "timestamp_epoch": "1631315967.109802000" }, { "tcp_stream": 80, "frame_number": 2774, "display_filter": "frame.number == 2774", "timestamp_epoch": "1631315967.111638000" }, { "tcp_stream": 80, "frame_number": 2776, "display_filter": "frame.number == 2776", "timestamp_epoch": "1631315967.113444000" }, { "tcp_stream": 80, "frame_number": 2778, "display_filter": "frame.number == 2778", "timestamp_epoch": "1631315967.115360000" }, { "tcp_stream": 80, "frame_number": 2780, "display_filter": "frame.number == 2780", "timestamp_epoch": "1631315967.117411000" }, { "tcp_stream": 80, "frame_number": 2782, "display_filter": "frame.number == 2782", "timestamp_epoch": "1631315967.119332000" }, { "tcp_stream": 80, "frame_number": 2784, "display_filter": "frame.number == 2784", "timestamp_epoch": "1631315967.121257000" }, { "tcp_stream": 80, "frame_number": 2786, "display_filter": "frame.number == 2786", "timestamp_epoch": "1631315967.123094000" }, { "tcp_stream": 80, "frame_number": 2788, "display_filter": "frame.number == 2788", "timestamp_epoch": "1631315967.124946000" }, { "tcp_stream": 80, "frame_number": 2800, "display_filter": "frame.number == 2800", "timestamp_epoch": "1631315967.137311000" }, { "tcp_stream": 80, "frame_number": 2802, "display_filter": "frame.number == 2802", "timestamp_epoch": "1631315967.139190000" }, { "tcp_stream": 80, "frame_number": 2804, "display_filter": "frame.number == 2804", "timestamp_epoch": "1631315967.141123000" }, { "tcp_stream": 80, "frame_number": 2806, "display_filter": "frame.number == 2806", "timestamp_epoch": "1631315967.142993000" }, { "tcp_stream": 80, "frame_number": 2808, "display_filter": "frame.number == 2808", "timestamp_epoch": "1631315967.144878000" }, { "tcp_stream": 80, "frame_number": 2810, "display_filter": "frame.number == 2810", "timestamp_epoch": "1631315967.146886000" }, { "tcp_stream": 80, "frame_number": 2812, "display_filter": "frame.number == 2812", "timestamp_epoch": "1631315967.148810000" }, { "tcp_stream": 80, "frame_number": 2814, "display_filter": "frame.number == 2814", "timestamp_epoch": "1631315967.150926000" }, { "tcp_stream": 80, "frame_number": 2816, "display_filter": "frame.number == 2816", "timestamp_epoch": "1631315967.152894000" }, { "tcp_stream": 80, "frame_number": 2818, "display_filter": "frame.number == 2818", "timestamp_epoch": "1631315967.154700000" }, { "tcp_stream": 80, "frame_number": 2820, "display_filter": "frame.number == 2820", "timestamp_epoch": "1631315967.156536000" } ] }, { "id": "finding-66057f32f2a0cf52c87223fb", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.9.10.9", "protocol": "drsuapi", "destination": "10.9.10.102", "event_count": 25, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 15, "frame_number": 391, "display_filter": "frame.number == 391", "timestamp_epoch": "1631315816.202503000" }, { "tcp_stream": 15, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1631315816.204127000" }, { "tcp_stream": 15, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1631315816.205807000" }, { "tcp_stream": 15, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1631315816.208461000" }, { "tcp_stream": 67, "frame_number": 2060, "display_filter": "frame.number == 2060", "timestamp_epoch": "1631315877.057161000" }, { "tcp_stream": 67, "frame_number": 2068, "display_filter": "frame.number == 2068", "timestamp_epoch": "1631315877.062420000" }, { "tcp_stream": 67, "frame_number": 2070, "display_filter": "frame.number == 2070", "timestamp_epoch": "1631315877.064849000" }, { "tcp_stream": 67, "frame_number": 2074, "display_filter": "frame.number == 2074", "timestamp_epoch": "1631315877.070829000" }, { "tcp_stream": 67, "frame_number": 2076, "display_filter": "frame.number == 2076", "timestamp_epoch": "1631315877.073778000" }, { "tcp_stream": 67, "frame_number": 2078, "display_filter": "frame.number == 2078", "timestamp_epoch": "1631315877.076183000" }, { "tcp_stream": 86, "frame_number": 2963, "display_filter": "frame.number == 2963", "timestamp_epoch": "1631316142.057859000" }, { "tcp_stream": 86, "frame_number": 2967, "display_filter": "frame.number == 2967", "timestamp_epoch": "1631316142.301796000" }, { "tcp_stream": 86, "frame_number": 2969, "display_filter": "frame.number == 2969", "timestamp_epoch": "1631316142.304324000" }, { "tcp_stream": 86, "frame_number": 2973, "display_filter": "frame.number == 2973", "timestamp_epoch": "1631316142.310861000" }, { "tcp_stream": 86, "frame_number": 2975, "display_filter": "frame.number == 2975", "timestamp_epoch": "1631316142.313717000" }, { "tcp_stream": 86, "frame_number": 2977, "display_filter": "frame.number == 2977", "timestamp_epoch": "1631316142.316213000" }, { "tcp_stream": 146, "frame_number": 8703, "display_filter": "frame.number == 8703", "timestamp_epoch": "1631319741.452370000" }, { "tcp_stream": 146, "frame_number": 8707, "display_filter": "frame.number == 8707", "timestamp_epoch": "1631319741.699401000" }, { "tcp_stream": 146, "frame_number": 8709, "display_filter": "frame.number == 8709", "timestamp_epoch": "1631319741.701932000" }, { "tcp_stream": 146, "frame_number": 8713, "display_filter": "frame.number == 8713", "timestamp_epoch": "1631319741.708518000" }, { "tcp_stream": 146, "frame_number": 8715, "display_filter": "frame.number == 8715", "timestamp_epoch": "1631319741.711246000" }, { "tcp_stream": 146, "frame_number": 8718, "display_filter": "frame.number == 8718", "timestamp_epoch": "1631319741.761575000" }, { "tcp_stream": 154, "frame_number": 8903, "display_filter": "frame.number == 8903", "timestamp_epoch": "1631320086.166565000" }, { "tcp_stream": 154, "frame_number": 8905, "display_filter": "frame.number == 8905", "timestamp_epoch": "1631320086.168976000" }, { "tcp_stream": 154, "frame_number": 8907, "display_filter": "frame.number == 8907", "timestamp_epoch": "1631320086.170812000" } ] }, { "id": "finding-04c71321ef5dbb606946d222", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.9.10.9", "protocol": "ldap", "destination": "10.9.10.102", "event_count": 39, "operation_numbers": [ "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1, "frame_number": 82, "display_filter": "frame.number == 82", "timestamp_epoch": "1631315714.905140000" }, { "tcp_stream": 22, "frame_number": 480, "display_filter": "frame.number == 480", "timestamp_epoch": "1631315816.964799000" }, { "tcp_stream": 22, "frame_number": 485, "display_filter": "frame.number == 485", "timestamp_epoch": "1631315816.975285000" }, { "tcp_stream": 22, "frame_number": 487, "display_filter": "frame.number == 487", "timestamp_epoch": "1631315817.014530000" }, { "tcp_stream": 23, "frame_number": 495, "display_filter": "frame.number == 495", "timestamp_epoch": "1631315817.084711000" }, { "tcp_stream": 23, "frame_number": 497, "display_filter": "frame.number == 497", "timestamp_epoch": "1631315817.092525000" }, { "tcp_stream": 23, "frame_number": 499, "display_filter": "frame.number == 499", "timestamp_epoch": "1631315817.097104000" }, { "tcp_stream": 22, "frame_number": 501, "display_filter": "frame.number == 501", "timestamp_epoch": "1631315817.117819000" }, { "tcp_stream": 68, "frame_number": 2116, "display_filter": "frame.number == 2116", "timestamp_epoch": "1631315877.085324000" }, { "tcp_stream": 68, "frame_number": 2121, "display_filter": "frame.number == 2121", "timestamp_epoch": "1631315877.089901000" }, { "tcp_stream": 68, "frame_number": 2123, "display_filter": "frame.number == 2123", "timestamp_epoch": "1631315877.092602000" }, { "tcp_stream": 68, "frame_number": 2125, "display_filter": "frame.number == 2125", "timestamp_epoch": "1631315877.095417000" }, { "tcp_stream": 68, "frame_number": 2127, "display_filter": "frame.number == 2127", "timestamp_epoch": "1631315877.097372000" }, { "tcp_stream": 69, "frame_number": 2135, "display_filter": "frame.number == 2135", "timestamp_epoch": "1631315877.114813000" }, { "tcp_stream": 69, "frame_number": 2140, "display_filter": "frame.number == 2140", "timestamp_epoch": "1631315877.117000000" }, { "tcp_stream": 69, "frame_number": 2144, "display_filter": "frame.number == 2144", "timestamp_epoch": "1631315877.117965000" }, { "tcp_stream": 87, "frame_number": 2984, "display_filter": "frame.number == 2984", "timestamp_epoch": "1631316142.357695000" }, { "tcp_stream": 87, "frame_number": 2989, "display_filter": "frame.number == 2989", "timestamp_epoch": "1631316142.363093000" }, { "tcp_stream": 87, "frame_number": 2991, "display_filter": "frame.number == 2991", "timestamp_epoch": "1631316142.366144000" }, { "tcp_stream": 87, "frame_number": 2993, "display_filter": "frame.number == 2993", "timestamp_epoch": "1631316142.368873000" }, { "tcp_stream": 87, "frame_number": 2996, "display_filter": "frame.number == 2996", "timestamp_epoch": "1631316142.370955000" }, { "tcp_stream": 88, "frame_number": 3003, "display_filter": "frame.number == 3003", "timestamp_epoch": "1631316142.409360000" }, { "tcp_stream": 88, "frame_number": 3007, "display_filter": "frame.number == 3007", "timestamp_epoch": "1631316142.412719000" }, { "tcp_stream": 88, "frame_number": 3010, "display_filter": "frame.number == 3010", "timestamp_epoch": "1631316142.414320000" }, { "tcp_stream": 147, "frame_number": 8727, "display_filter": "frame.number == 8727", "timestamp_epoch": "1631319742.090941000" }, { "tcp_stream": 147, "frame_number": 8732, "display_filter": "frame.number == 8732", "timestamp_epoch": "1631319742.096110000" }, { "tcp_stream": 147, "frame_number": 8734, "display_filter": "frame.number == 8734", "timestamp_epoch": "1631319742.099162000" }, { "tcp_stream": 147, "frame_number": 8736, "display_filter": "frame.number == 8736", "timestamp_epoch": "1631319742.101962000" }, { "tcp_stream": 147, "frame_number": 8738, "display_filter": "frame.number == 8738", "timestamp_epoch": "1631319742.104757000" }, { "tcp_stream": 148, "frame_number": 8746, "display_filter": "frame.number == 8746", "timestamp_epoch": "1631319742.158067000" }, { "tcp_stream": 148, "frame_number": 8750, "display_filter": "frame.number == 8750", "timestamp_epoch": "1631319742.160990000" }, { "tcp_stream": 148, "frame_number": 8753, "display_filter": "frame.number == 8753", "timestamp_epoch": "1631319742.162606000" }, { "tcp_stream": 155, "frame_number": 8914, "display_filter": "frame.number == 8914", "timestamp_epoch": "1631320086.883277000" }, { "tcp_stream": 155, "frame_number": 8919, "display_filter": "frame.number == 8919", "timestamp_epoch": "1631320086.889082000" }, { "tcp_stream": 155, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1631320087.008995000" }, { "tcp_stream": 156, "frame_number": 8932, "display_filter": "frame.number == 8932", "timestamp_epoch": "1631320087.070473000" }, { "tcp_stream": 156, "frame_number": 8934, "display_filter": "frame.number == 8934", "timestamp_epoch": "1631320087.073375000" }, { "tcp_stream": 156, "frame_number": 8936, "display_filter": "frame.number == 8936", "timestamp_epoch": "1631320087.076111000" }, { "tcp_stream": 155, "frame_number": 8938, "display_filter": "frame.number == 8938", "timestamp_epoch": "1631320087.080419000" } ] }, { "id": "finding-94f3fd9fea4406cb12e7ecdf", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.9.10.9", "protocol": "samr", "destination": "10.9.10.102", "event_count": 57, "operation_numbers": [ "1", "16", "17", "18", "19", "20", "25", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 19, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1631315816.243557000" }, { "tcp_stream": 19, "frame_number": 443, "display_filter": "frame.number == 443", "timestamp_epoch": "1631315816.245465000" }, { "tcp_stream": 19, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1631315816.247380000" }, { "tcp_stream": 19, "frame_number": 447, "display_filter": "frame.number == 447", "timestamp_epoch": "1631315816.249191000" }, { "tcp_stream": 19, "frame_number": 449, "display_filter": "frame.number == 449", "timestamp_epoch": "1631315816.250931000" }, { "tcp_stream": 19, "frame_number": 451, "display_filter": "frame.number == 451", "timestamp_epoch": "1631315816.252925000" }, { "tcp_stream": 19, "frame_number": 453, "display_filter": "frame.number == 453", "timestamp_epoch": "1631315816.254812000" }, { "tcp_stream": 19, "frame_number": 455, "display_filter": "frame.number == 455", "timestamp_epoch": "1631315816.256961000" }, { "tcp_stream": 19, "frame_number": 457, "display_filter": "frame.number == 457", "timestamp_epoch": "1631315816.258946000" }, { "tcp_stream": 19, "frame_number": 459, "display_filter": "frame.number == 459", "timestamp_epoch": "1631315816.260793000" }, { "tcp_stream": 19, "frame_number": 461, "display_filter": "frame.number == 461", "timestamp_epoch": "1631315816.262733000" }, { "tcp_stream": 19, "frame_number": 463, "display_filter": "frame.number == 463", "timestamp_epoch": "1631315816.264601000" }, { "tcp_stream": 19, "frame_number": 465, "display_filter": "frame.number == 465", "timestamp_epoch": "1631315816.266340000" }, { "tcp_stream": 19, "frame_number": 467, "display_filter": "frame.number == 467", "timestamp_epoch": "1631315816.268210000" }, { "tcp_stream": 19, "frame_number": 469, "display_filter": "frame.number == 469", "timestamp_epoch": "1631315816.269868000" }, { "tcp_stream": 80, "frame_number": 2706, "display_filter": "frame.number == 2706", "timestamp_epoch": "1631315966.506606000" }, { "tcp_stream": 80, "frame_number": 2708, "display_filter": "frame.number == 2708", "timestamp_epoch": "1631315966.509355000" }, { "tcp_stream": 80, "frame_number": 2710, "display_filter": "frame.number == 2710", "timestamp_epoch": "1631315966.512048000" }, { "tcp_stream": 80, "frame_number": 2712, "display_filter": "frame.number == 2712", "timestamp_epoch": "1631315966.514600000" }, { "tcp_stream": 80, "frame_number": 2714, "display_filter": "frame.number == 2714", "timestamp_epoch": "1631315966.517327000" }, { "tcp_stream": 80, "frame_number": 2718, "display_filter": "frame.number == 2718", "timestamp_epoch": "1631315966.896127000" }, { "tcp_stream": 80, "frame_number": 2720, "display_filter": "frame.number == 2720", "timestamp_epoch": "1631315966.898450000" }, { "tcp_stream": 80, "frame_number": 2722, "display_filter": "frame.number == 2722", "timestamp_epoch": "1631315966.900524000" }, { "tcp_stream": 80, "frame_number": 2724, "display_filter": "frame.number == 2724", "timestamp_epoch": "1631315966.902430000" }, { "tcp_stream": 80, "frame_number": 2726, "display_filter": "frame.number == 2726", "timestamp_epoch": "1631315966.904500000" }, { "tcp_stream": 80, "frame_number": 2738, "display_filter": "frame.number == 2738", "timestamp_epoch": "1631315966.916801000" }, { "tcp_stream": 80, "frame_number": 2740, "display_filter": "frame.number == 2740", "timestamp_epoch": "1631315966.918651000" }, { "tcp_stream": 80, "frame_number": 2742, "display_filter": "frame.number == 2742", "timestamp_epoch": "1631315966.920672000" }, { "tcp_stream": 80, "frame_number": 2744, "display_filter": "frame.number == 2744", "timestamp_epoch": "1631315966.922457000" }, { "tcp_stream": 80, "frame_number": 2746, "display_filter": "frame.number == 2746", "timestamp_epoch": "1631315966.924393000" }, { "tcp_stream": 80, "frame_number": 2748, "display_filter": "frame.number == 2748", "timestamp_epoch": "1631315966.926357000" }, { "tcp_stream": 80, "frame_number": 2750, "display_filter": "frame.number == 2750", "timestamp_epoch": "1631315966.928378000" }, { "tcp_stream": 80, "frame_number": 2752, "display_filter": "frame.number == 2752", "timestamp_epoch": "1631315966.930497000" }, { "tcp_stream": 80, "frame_number": 2754, "display_filter": "frame.number == 2754", "timestamp_epoch": "1631315966.932520000" }, { "tcp_stream": 80, "frame_number": 2756, "display_filter": "frame.number == 2756", "timestamp_epoch": "1631315966.934472000" }, { "tcp_stream": 80, "frame_number": 2758, "display_filter": "frame.number == 2758", "timestamp_epoch": "1631315966.936436000" }, { "tcp_stream": 80, "frame_number": 2771, "display_filter": "frame.number == 2771", "timestamp_epoch": "1631315967.108357000" }, { "tcp_stream": 80, "frame_number": 2773, "display_filter": "frame.number == 2773", "timestamp_epoch": "1631315967.110185000" }, { "tcp_stream": 80, "frame_number": 2775, "display_filter": "frame.number == 2775", "timestamp_epoch": "1631315967.112004000" }, { "tcp_stream": 80, "frame_number": 2777, "display_filter": "frame.number == 2777", "timestamp_epoch": "1631315967.113908000" }, { "tcp_stream": 80, "frame_number": 2779, "display_filter": "frame.number == 2779", "timestamp_epoch": "1631315967.115884000" }, { "tcp_stream": 80, "frame_number": 2781, "display_filter": "frame.number == 2781", "timestamp_epoch": "1631315967.117894000" }, { "tcp_stream": 80, "frame_number": 2783, "display_filter": "frame.number == 2783", "timestamp_epoch": "1631315967.119790000" }, { "tcp_stream": 80, "frame_number": 2785, "display_filter": "frame.number == 2785", "timestamp_epoch": "1631315967.121621000" }, { "tcp_stream": 80, "frame_number": 2787, "display_filter": "frame.number == 2787", "timestamp_epoch": "1631315967.123453000" }, { "tcp_stream": 80, "frame_number": 2789, "display_filter": "frame.number == 2789", "timestamp_epoch": "1631315967.125283000" }, { "tcp_stream": 80, "frame_number": 2801, "display_filter": "frame.number == 2801", "timestamp_epoch": "1631315967.137715000" }, { "tcp_stream": 80, "frame_number": 2803, "display_filter": "frame.number == 2803", "timestamp_epoch": "1631315967.139701000" }, { "tcp_stream": 80, "frame_number": 2805, "display_filter": "frame.number == 2805", "timestamp_epoch": "1631315967.141536000" }, { "tcp_stream": 80, "frame_number": 2807, "display_filter": "frame.number == 2807", "timestamp_epoch": "1631315967.143458000" }, { "tcp_stream": 80, "frame_number": 2809, "display_filter": "frame.number == 2809", "timestamp_epoch": "1631315967.145402000" }, { "tcp_stream": 80, "frame_number": 2811, "display_filter": "frame.number == 2811", "timestamp_epoch": "1631315967.147382000" }, { "tcp_stream": 80, "frame_number": 2813, "display_filter": "frame.number == 2813", "timestamp_epoch": "1631315967.149337000" }, { "tcp_stream": 80, "frame_number": 2815, "display_filter": "frame.number == 2815", "timestamp_epoch": "1631315967.151339000" }, { "tcp_stream": 80, "frame_number": 2817, "display_filter": "frame.number == 2817", "timestamp_epoch": "1631315967.153273000" }, { "tcp_stream": 80, "frame_number": 2819, "display_filter": "frame.number == 2819", "timestamp_epoch": "1631315967.155105000" }, { "tcp_stream": 80, "frame_number": 2821, "display_filter": "frame.number == 2821", "timestamp_epoch": "1631315967.156946000" } ] }, { "id": "identity-f7b6d432f3eade83def31af2", "type": "identity", "label": "account: hobart.gunnarsson", "value": "hobart.gunnarsson", "source": "deterministic-pcap-analysis", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.9.10.102" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 11, "frame_number": 300, "display_filter": "frame.number == 300", "timestamp_epoch": "1631315815.761043000" }, { "tcp_stream": 12, "frame_number": 311, "display_filter": "frame.number == 311", "timestamp_epoch": "1631315815.983665000" }, { "tcp_stream": 12, "frame_number": 315, "display_filter": "frame.number == 315", "timestamp_epoch": "1631315815.985466000" }, { "tcp_stream": 14, "frame_number": 332, "display_filter": "frame.number == 332", "timestamp_epoch": "1631315815.995245000" }, { "tcp_stream": 16, "frame_number": 341, "display_filter": "frame.number == 341", "timestamp_epoch": "1631315815.996631000" }, { "tcp_stream": 17, "frame_number": 350, "display_filter": "frame.number == 350", "timestamp_epoch": "1631315816.020222000" }, { "tcp_stream": 17, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1631315816.021278000" }, { "tcp_stream": 18, "frame_number": 367, "display_filter": "frame.number == 367", "timestamp_epoch": "1631315816.109766000" }, { "tcp_stream": 20, "frame_number": 393, "display_filter": "frame.number == 393", "timestamp_epoch": "1631315816.203285000" }, { "tcp_stream": 21, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1631315816.206084000" }, { "tcp_stream": 19, "frame_number": 455, "display_filter": "frame.number == 455", "timestamp_epoch": "1631315816.256961000" }, { "tcp_stream": 81, "frame_number": 2681, "display_filter": "frame.number == 2681", "timestamp_epoch": "1631315966.487925000" } ] }, { "id": "identity-0b21cf421c3092d50b297bba", "type": "identity", "label": "full-name: Hobart Gunnarsson", "value": "Hobart Gunnarsson", "source": "deterministic-pcap-analysis", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.9.10.102" ], "identity_type": "full-name", "frame_evidence": [ { "tcp_stream": 19, "frame_number": 455, "display_filter": "frame.number == 455", "timestamp_epoch": "1631315816.256961000" } ] }, { "id": "identity-7bbffa5c46aa4e795236652a", "type": "identity", "label": "hostname: DESKTOP-KKITB6Q", "value": "DESKTOP-KKITB6Q", "source": "deterministic-pcap-analysis", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.9.10.102", "169.254.181.227" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1631315707.787295000" }, { "udp_stream": 0, "frame_number": 3, "display_filter": "frame.number == 3", "timestamp_epoch": "1631315707.790675000" }, { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1631315707.932871000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1631315707.932872000" }, { "udp_stream": 2, "frame_number": 9, "display_filter": "frame.number == 9", "timestamp_epoch": "1631315708.684599000" }, { "udp_stream": 2, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1631315708.684600000" }, { "udp_stream": 8, "frame_number": 31, "display_filter": "frame.number == 31", "timestamp_epoch": "1631315709.575825000" }, { "udp_stream": 8, "frame_number": 36, "display_filter": "frame.number == 36", "timestamp_epoch": "1631315710.353794000" }, { "udp_stream": 8, "frame_number": 43, "display_filter": "frame.number == 43", "timestamp_epoch": "1631315711.117648000" }, { "udp_stream": 8, "frame_number": 52, "display_filter": "frame.number == 52", "timestamp_epoch": "1631315711.869204000" }, { "udp_stream": 8, "frame_number": 54, "display_filter": "frame.number == 54", "timestamp_epoch": "1631315712.599978000" }, { "udp_stream": 14, "frame_number": 55, "display_filter": "frame.number == 55", "timestamp_epoch": "1631315712.687123000" }, { "udp_stream": 8, "frame_number": 58, "display_filter": "frame.number == 58", "timestamp_epoch": "1631315713.358829000" }, { "udp_stream": 8, "frame_number": 61, "display_filter": "frame.number == 61", "timestamp_epoch": "1631315714.122641000" }, { "udp_stream": 8, "frame_number": 72, "display_filter": "frame.number == 72", "timestamp_epoch": "1631315714.885657000" }, { "udp_stream": 14, "frame_number": 98, "display_filter": "frame.number == 98", "timestamp_epoch": "1631315715.685778000" }, { "udp_stream": 14, "frame_number": 121, "display_filter": "frame.number == 121", "timestamp_epoch": "1631315717.199232000" }, { "udp_stream": 14, "frame_number": 131, "display_filter": "frame.number == 131", "timestamp_epoch": "1631315721.834465000" }, { "udp_stream": 14, "frame_number": 132, "display_filter": "frame.number == 132", "timestamp_epoch": "1631315721.842967000" }, { "tcp_stream": 79, "frame_number": 2651, "display_filter": "frame.number == 2651", "timestamp_epoch": "1631315964.378254000" } ] }, { "id": "identity-6f0a9bd41209a8a862000245", "type": "identity", "label": "netbios-group: ANGRYPOUTINE", "value": "ANGRYPOUTINE", "source": "deterministic-pcap-analysis", "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [], "identity_type": "netbios-group", "frame_evidence": [ { "udp_stream": 2, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1631315707.932873000" }, { "udp_stream": 2, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1631315708.684598000" }, { "udp_stream": 2, "frame_number": 11, "display_filter": "frame.number == 11", "timestamp_epoch": "1631315709.495571000" }, { "udp_stream": 8, "frame_number": 35, "display_filter": "frame.number == 35", "timestamp_epoch": "1631315710.258173000" }, { "udp_stream": 8, "frame_number": 38, "display_filter": "frame.number == 38", "timestamp_epoch": "1631315711.017650000" }, { "udp_stream": 8, "frame_number": 50, "display_filter": "frame.number == 50", "timestamp_epoch": "1631315711.789000000" }, { "udp_stream": 8, "frame_number": 53, "display_filter": "frame.number == 53", "timestamp_epoch": "1631315712.599977000" }, { "udp_stream": 8, "frame_number": 59, "display_filter": "frame.number == 59", "timestamp_epoch": "1631315713.358831000" }, { "udp_stream": 8, "frame_number": 60, "display_filter": "frame.number == 60", "timestamp_epoch": "1631315714.122639000" }, { "udp_stream": 8, "frame_number": 73, "display_filter": "frame.number == 73", "timestamp_epoch": "1631315714.885658000" }, { "udp_stream": 8, "frame_number": 123, "display_filter": "frame.number == 123", "timestamp_epoch": "1631315718.747751000" }, { "udp_stream": 8, "frame_number": 127, "display_filter": "frame.number == 127", "timestamp_epoch": "1631315719.511263000" }, { "udp_stream": 8, "frame_number": 128, "display_filter": "frame.number == 128", "timestamp_epoch": "1631315720.278616000" }, { "udp_stream": 8, "frame_number": 129, "display_filter": "frame.number == 129", "timestamp_epoch": "1631315721.040842000" } ] }, { "id": "artifact-4ab43a37d5b5d37b561a401c", "type": "file-artifact", "label": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(3).exe", "value": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431", "sha256": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431", "source": "deterministic-pcap-analysis", "size_bytes": 1048576, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-e972ba353cda6421180154da", "type": "file-artifact", "label": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(2).exe", "value": "2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792", "sha256": "2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792", "source": "deterministic-pcap-analysis", "size_bytes": 1048576, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-3139dedfc6a1194feef19f69", "type": "file-artifact", "label": "date1%3fBNLv65=pAAS", "value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8", "sha256": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8", "source": "deterministic-pcap-analysis", "size_bytes": 284816, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-74472d7bfd877aa3363c2955", "type": "file-artifact", "label": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(4).exe", "value": "0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f", "sha256": "0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f", "source": "deterministic-pcap-analysis", "size_bytes": 922056, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-0fb55f3316dc0c38ed2fe99e", "type": "file-artifact", "label": "apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477%3fw=150&h=150", "value": "c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652", "sha256": "c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652", "source": "deterministic-pcap-analysis", "size_bytes": 24101, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-752a975585b653cc07a0b2ff", "type": "file-artifact", "label": "apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185%3fw=150&h=150", "value": "f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43", "sha256": "f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43", "source": "deterministic-pcap-analysis", "size_bytes": 19230, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-70bb5da136c66653715ee483", "type": "file-artifact", "label": "apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8%3fw=150&h=150", "value": "0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c", "sha256": "0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c", "source": "deterministic-pcap-analysis", "size_bytes": 17906, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-5ab522a329d23e888d2e9c73", "type": "file-artifact", "label": "apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9%3fw=150&h=225", "value": "4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e", "sha256": "4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e", "source": "deterministic-pcap-analysis", "size_bytes": 16870, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-7953b8baee3e02621457eeef", "type": "file-artifact", "label": "apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165%3fw=150&h=150", "value": "0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca", "sha256": "0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca", "source": "deterministic-pcap-analysis", "size_bytes": 13972, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-baacb90b3ea2a5bac3bb2228", "type": "file-artifact", "label": "35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab", "value": "4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4", "sha256": "4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4", "source": "deterministic-pcap-analysis", "size_bytes": 10821, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-6ec9d7b2eeadec7d012d8a56", "type": "file-artifact", "label": "35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab", "value": "4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34", "sha256": "4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34", "source": "deterministic-pcap-analysis", "size_bytes": 10791, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-1bcd879a067ef93d296ed895", "type": "file-artifact", "label": "35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab", "value": "cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7", "sha256": "cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7", "source": "deterministic-pcap-analysis", "size_bytes": 10789, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-4cba839fc685581f1de16836", "type": "file-artifact", "label": "35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab", "value": "2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51", "sha256": "2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51", "source": "deterministic-pcap-analysis", "size_bytes": 10781, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-4b9ef213a8b480b046f0e55d", "type": "file-artifact", "label": "35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab", "value": "8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c", "sha256": "8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c", "source": "deterministic-pcap-analysis", "size_bytes": 10767, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-286a093f05b5dda8bf2af676", "type": "file-artifact", "label": "35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab", "value": "1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb", "sha256": "1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb", "source": "deterministic-pcap-analysis", "size_bytes": 10765, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-ed48e5ec1e756dd30dcc10bc", "type": "file-artifact", "label": "35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab", "value": "80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1", "sha256": "80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1", "source": "deterministic-pcap-analysis", "size_bytes": 10763, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-710cd180d86e73cf5af6f7ca", "type": "file-artifact", "label": "35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab", "value": "07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196", "sha256": "07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196", "source": "deterministic-pcap-analysis", "size_bytes": 10623, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-9e0bee7b41d6b7ca0e69d67d", "type": "file-artifact", "label": "35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab", "value": "e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a", "sha256": "e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a", "source": "deterministic-pcap-analysis", "size_bytes": 10621, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-c6d21c7f5c356b86c31703bb", "type": "file-artifact", "label": "35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab", "value": "dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d", "sha256": "dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d", "source": "deterministic-pcap-analysis", "size_bytes": 10593, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-67d57be4db6fe8650288f03b", "type": "file-artifact", "label": "35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab", "value": "0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5", "sha256": "0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5", "source": "deterministic-pcap-analysis", "size_bytes": 10589, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-387316dbd8bd994b4abb00f1", "type": "file-artifact", "label": "35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab", "value": "9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886", "sha256": "9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886", "source": "deterministic-pcap-analysis", "size_bytes": 7287, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-180b6d8f674e60363cc922f7", "type": "file-artifact", "label": "35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab", "value": "01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc", "sha256": "01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc", "source": "deterministic-pcap-analysis", "size_bytes": 7285, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-6d935ccb1dfb597125dd0f98", "type": "file-artifact", "label": "35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab", "value": "2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f", "sha256": "2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f", "source": "deterministic-pcap-analysis", "size_bytes": 7285, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-2d99be72ce0938e1d5cbe15a", "type": "file-artifact", "label": "35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab", "value": "6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee", "sha256": "6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee", "source": "deterministic-pcap-analysis", "size_bytes": 7283, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-69b45771a4e918bc030c1f5c", "type": "file-artifact", "label": "35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab", "value": "d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2", "sha256": "d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2", "source": "deterministic-pcap-analysis", "size_bytes": 7277, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-2ad4d61b8d2e2e6a6577e5fa", "type": "file-artifact", "label": "35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab", "value": "ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f", "sha256": "ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f", "source": "deterministic-pcap-analysis", "size_bytes": 7277, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-6c9261c50b1842b029fbf98a", "type": "file-artifact", "label": "35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab", "value": "153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d", "sha256": "153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d", "source": "deterministic-pcap-analysis", "size_bytes": 7275, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-048bc1575e3c1d50f469a660", "type": "file-artifact", "label": "35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab", "value": "729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d", "sha256": "729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d", "source": "deterministic-pcap-analysis", "size_bytes": 7275, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-b01f68708da0f1bb264a8668", "type": "file-artifact", "label": "35094711_e3993b23840c0d600179f647e9ac08158269c095.cab", "value": "e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21", "sha256": "e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21", "source": "deterministic-pcap-analysis", "size_bytes": 7275, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-910911685decebc2c3ee0cad", "type": "file-artifact", "label": "35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab", "value": "8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5", "sha256": "8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5", "source": "deterministic-pcap-analysis", "size_bytes": 7273, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-30ac0a77eb10b6bc5a953010", "type": "file-artifact", "label": "35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab", "value": "3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864", "sha256": "3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864", "source": "deterministic-pcap-analysis", "size_bytes": 7267, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-f5f89b4e1678d28348a0e84e", "type": "file-artifact", "label": "35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab", "value": "f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7", "sha256": "f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7", "source": "deterministic-pcap-analysis", "size_bytes": 7261, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-ae04db8f4788e6435c2d3639", "type": "file-artifact", "label": "35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab", "value": "6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d", "sha256": "6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d", "source": "deterministic-pcap-analysis", "size_bytes": 7189, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-cbf67ce8eb8b5faa88185a15", "type": "file-artifact", "label": "35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab", "value": "0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7", "sha256": "0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7", "source": "deterministic-pcap-analysis", "size_bytes": 7185, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-86ba355c6f7138cabbded8e8", "type": "file-artifact", "label": "35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab", "value": "b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4", "sha256": "b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4", "source": "deterministic-pcap-analysis", "size_bytes": 7183, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-e0731dc3eff6de98411d3b44", "type": "file-artifact", "label": "35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab", "value": "36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219", "sha256": "36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219", "source": "deterministic-pcap-analysis", "size_bytes": 7181, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-28cabf370041ec91b1106009", "type": "file-artifact", "label": "35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab", "value": "e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe", "sha256": "e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe", "source": "deterministic-pcap-analysis", "size_bytes": 7181, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-3e58d219ed25bd72b8be4a9c", "type": "file-artifact", "label": "35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab", "value": "809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a", "sha256": "809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a", "source": "deterministic-pcap-analysis", "size_bytes": 7175, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-6393dcafb21eb3f8fa0af067", "type": "file-artifact", "label": "35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab", "value": "b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334", "sha256": "b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334", "source": "deterministic-pcap-analysis", "size_bytes": 7175, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-382a4df8d7cc37c7274cf358", "type": "file-artifact", "label": "35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab", "value": "6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c", "sha256": "6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c", "source": "deterministic-pcap-analysis", "size_bytes": 7171, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-23f6fc7b3b31892241e9e53d", "type": "file-artifact", "label": "35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab", "value": "b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe", "sha256": "b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe", "source": "deterministic-pcap-analysis", "size_bytes": 7171, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-f8a6b000a365b8e0f3d09f05", "type": "file-artifact", "label": "35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab", "value": "eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74", "sha256": "eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74", "source": "deterministic-pcap-analysis", "size_bytes": 7171, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-1a5706bb5697bc56c5bcddb5", "type": "file-artifact", "label": "apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e%3fw=150&h=150", "value": "84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411", "sha256": "84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411", "source": "deterministic-pcap-analysis", "size_bytes": 2222, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-0fc769c752319e9982259def", "type": "file-artifact", "label": "ncsi.txt", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "source": "deterministic-pcap-analysis", "size_bytes": 14, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "text/plain" }, { "id": "artifact-cfaef7a0adb110765307d655", "type": "file-artifact", "label": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(1).exe", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "sha256": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "source": "deterministic-pcap-analysis", "size_bytes": 2, "source_ref": "2021-09-10-traffic-analysis-exercise.pcap", "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3", "source_refs": [ "2021-09-10-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" } ], "evidence_edges": [], "timeline": [ { "at": "2026-09-19T12:49:52.701Z", "event": "Added Log/PCAP analysis 2021-09-10-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2021-09-10-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 1 }, { "at": "2026-09-19T12:57:44.228Z", "event": "Added Log/PCAP analysis 2021-09-10-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2021-09-10-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 1 } ], "created_at": "2026-09-19T12:49:48.393261+00:00", "updated_at": "2026-09-19T12:57:44.251392+00:00" }