{ "id": "46cea0b8-e35e-48de-862a-1dd27b46759d", "name": "PCAP verified workflow 2022-01-07 20260919", "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.", "status": "active", "domain": "enterprise-attack", "actor_ids": [], "technique_ids": [ "T1105" ], "report_ids": [], "evidence_nodes": [ { "id": "log-pcap:6e50c68f-5552-400c-9835-15867ddb022d", "type": "log-pcap-analysis", "label": "2022-01-07-traffic-analysis-exercise.pcap", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2022-01-07-traffic-analysis-exercise.pcap\nCapture SHA-256: `a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b`\nSemantic result SHA-256: `d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 5880 packets across 27 IP endpoints and 157 transport flows. Observed 88 DNS events, 24 HTTP requests, 24 TLS ClientHello events, and 14 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 2 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 5880\n- Duration: 1172563861.65932 seconds\n- Captured bytes: 4628888\n- Endpoints: 27\n- Flows: 157\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 5309 / TCP stream 76, frame 5315 / TCP stream 76, frame 5317 / TCP stream 76, frame 5636 / TCP stream 76.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":307634,\"destination\":\"192.168.1.216\",\"response_count\":2,\"source\":\"23.38.189.225\",\"uri\":\"/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 5313 / TCP stream 77, frame 5316 / TCP stream 77.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":2,\"destination\":\"192.168.1.216\",\"response_count\":1,\"source\":\"23.38.189.201\",\"uri\":\"/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 246 / TCP stream 6, frame 253 / TCP stream 6, frame 254 / TCP stream 10, frame 257 / TCP stream 6, frame 262 / TCP stream 6.\n\nMetrics: `{\"destination\":\"192.168.1.216\",\"event_count\":30,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"192.168.1.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 29 / TCP stream 0, frame 191 / TCP stream 15, frame 213 / TCP stream 15, frame 219 / TCP stream 15, frame 221 / TCP stream 15.\n\nMetrics: `{\"destination\":\"192.168.1.216\",\"event_count\":47,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"192.168.1.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 931 / TCP stream 43, frame 933 / TCP stream 43, frame 935 / TCP stream 43, frame 937 / TCP stream 43, frame 939 / TCP stream 43.\n\nMetrics: `{\"destination\":\"192.168.1.216\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"192.168.1.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 241 / TCP stream 6, frame 251 / TCP stream 6, frame 252 / TCP stream 10, frame 255 / TCP stream 6, frame 256 / TCP stream 10.\n\nMetrics: `{\"destination\":\"192.168.1.2\",\"event_count\":30,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"192.168.1.216\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 27 / TCP stream 0, frame 189 / TCP stream 15, frame 210 / TCP stream 15, frame 218 / TCP stream 15, frame 220 / TCP stream 15.\n\nMetrics: `{\"destination\":\"192.168.1.2\",\"event_count\":58,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"192.168.1.216\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 930 / TCP stream 43, frame 932 / TCP stream 43, frame 934 / TCP stream 43, frame 936 / TCP stream 43, frame 938 / TCP stream 43.\n\nMetrics: `{\"destination\":\"192.168.1.2\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"192.168.1.216\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `desktop-gxmyno2$`; client IPs: 192.168.1.216; frames: 75, 108, 126, 127, 129\n- account: `steve.smith`; client IPs: 192.168.1.216; frames: 829, 837, 839, 851, 891\n- domain: `SPOONWATCH`; client IPs: 192.168.1.216; frames: 914\n- full-name: `Steve Smith`; client IPs: 192.168.1.216; frames: 945\n- hostname: `DESKTOP-GXMYNO2`; client IPs: 192.168.1.216; frames: 1, 694, 756, 757, 914\n- hostname: `DESKTOP-GXNYNO2`; client IPs: 192.168.1.216; frames: 35, 51, 367, 395, 595\n- netbios-group: `SPOONWATCH`; client IPs: unbound subject; frames: 34, 366, 581, 596, 598\n\n## IOC and artifact candidates\n\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `au.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `cp801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `geo.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `kv801.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `pti.store.microsoft.com`; roles: dns-query, tls-sni\n- domain: `self.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settingsfd-geo.trafficmanager.net`; roles: dns-cname\n- domain: `spoonwatch-dc.spoonwatch.net`; roles: dns-query\n- domain: `spoonwatch.net`; roles: dns-query\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.spoonwatch.net`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `104.212.67.47`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `184.50.62.43`; roles: dns-answer, network-endpoint\n- ipv4: `192.168.1.1`; roles: network-endpoint\n- ipv4: `192.168.1.2`; roles: dns-answer, network-endpoint\n- ipv4: `192.168.1.216`; roles: network-endpoint\n- ipv4: `192.168.1.255`; roles: network-endpoint\n- ipv4: `2.56.57.108`; roles: http-host, network-endpoint\n- ipv4: `20.189.173.1`; roles: dns-answer, network-endpoint\n- ipv4: `20.50.80.210`; roles: dns-answer, network-endpoint\n- ipv4: `20.54.89.15`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.38.189.201`; roles: dns-answer, network-endpoint\n- ipv4: `23.38.189.225`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.83.240.146`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.112.67`; roles: dns-answer, network-endpoint\n- ipv4: `52.178.17.2`; roles: dns-answer, network-endpoint\n- ipv4: `52.179.216.235`; roles: dns-answer, network-endpoint\n- ipv4: `52.183.220.149`; roles: dns-answer, network-endpoint\n- ipv4: `52.238.248.1`; roles: dns-answer\n- ipv4: `52.249.36.204`; roles: dns-answer, network-endpoint\n- ipv4: `67.27.123.126`; roles: dns-answer\n- ipv4: `8.240.136.254`; roles: dns-answer\n- ipv4: `8.249.3.254`; roles: dns-answer\n- ipv4: `8.249.7.254`; roles: dns-answer\n- ipv4: `8.253.189.126`; roles: dns-answer, network-endpoint\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2`; roles: exported-object\n- sha256: `16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660`; roles: exported-object\n- sha256: `18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082`; roles: exported-object\n- sha256: `1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f`; roles: exported-object\n- sha256: `334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`; roles: exported-object\n- sha256: `3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd`; roles: exported-object\n- sha256: `43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083`; roles: exported-object\n- sha256: `6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9`; roles: exported-object\n- sha256: `7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14`; roles: exported-object\n- sha256: `835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7`; roles: exported-object\n- sha256: `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; roles: exported-object\n- sha256: `a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba`; roles: exported-object\n- sha256: `c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`; roles: exported-object\n- sha256: `e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78`; roles: exported-object\n- url: `http://2.56.57.108/osk/`; roles: http-request\n- url: `http://2.56.57.108/osk//1.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//2.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//3.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//4.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//5.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//6.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//7.jpg`; roles: http-request\n- url: `http://2.56.57.108/osk//main.php`; roles: http-request\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab`; roles: http-request\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Microsoft-Delivery-Optimization/10.0`; roles: http-client\n- user_agent: `Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32`; roles: http-client\n- exported object `5(1).jpg`; SHA-256 `e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78`; size 1246160 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `1(1).jpg`; SHA-256 `16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660`; size 645592 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `4(1).jpg`; SHA-256 `334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`; size 440120 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `2(1).jpg`; SHA-256 `a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba`; size 334288 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(2).exe`; SHA-256 `6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9`; size 307632 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `6(1).jpg`; SHA-256 `43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083`; size 144848 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[{\"excerpt\":\"IEX\",\"feature\":\"dynamic-evaluation\",\"offset\":135147}],\"inspected_bytes\":144848,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `3(1).jpg`; SHA-256 `3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd`; size 137168 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[{\"excerpt\":\"IEX\",\"feature\":\"dynamic-evaluation\",\"offset\":126724}],\"inspected_bytes\":137168,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `7(1).jpg`; SHA-256 `c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`; size 83784 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":83784,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `osk`; SHA-256 `1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f`; size 379629 bytes\n- exported object `35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab`; SHA-256 `18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082`; size 10885 bytes\n- exported object `35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab`; SHA-256 `0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2`; size 7317 bytes\n- exported object `35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab`; SHA-256 `835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7`; size 7313 bytes\n- exported object `1.jpg`; SHA-256 `7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14`; size 25 bytes\n- exported object `am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(1).exe`; SHA-256 `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; size 2 bytes\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `4775c16cd4ef1258e6af0730109f96f3ed0ac43a533ee465dd460c85c852613e`; recorded 2026-09-19T12:09:31.260950+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":94,\"observable_limit\":5000,\"observables_checked\":94,\"observables_total\":94,\"prior_case_limit_reached\":false,\"prior_cases_checked\":12,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 27 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 21 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":14,\"exported_objects\":22,\"hashed_bytes\":3744940,\"hashed_objects\":22,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":14,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":14}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 7/7, observables 94/94, artifacts 14/14. Full returned inventory is in the JSON result.\n", "summary": "Decoded 5880 packets across 27 IP endpoints and 157 transport flows. Observed 88 DNS events, 24 HTTP requests, 24 TLS ClientHello events, and 14 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 2 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "observables": [ { "type": "domain", "value": "api.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1061 / UDP stream 42, frame 1062 / UDP stream 42, frame 1066 / TCP stream 52" }, { "type": "domain", "value": "au.download.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 5302 / UDP stream 61, frame 5303 / UDP stream 61, frame 5309 / TCP stream 76, frame 5313 / TCP stream 77, frame 5317 / TCP stream 76" }, { "type": "domain", "value": "client.wns.windows.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1429 / UDP stream 51, frame 1430 / UDP stream 51, frame 1435 / TCP stream 63" }, { "type": "domain", "value": "cp801.prod.do.dsp.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 5282 / UDP stream 60, frame 5283 / UDP stream 60, frame 5287 / TCP stream 75" }, { "type": "domain", "value": "ctldl.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 5774 / UDP stream 65, frame 5775 / UDP stream 65, frame 5779 / TCP stream 83" }, { "type": "domain", "value": "dns.msftncsi.com", "confidence": 1, "description": "dns-query; frame 49 / UDP stream 11, frame 50 / UDP stream 11" }, { "type": "domain", "value": "download.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 5042 / UDP stream 55, frame 5043 / UDP stream 55, frame 5047 / TCP stream 69, frame 5058 / TCP stream 69, frame 5069 / TCP stream 69" }, { "type": "domain", "value": "fe2cr.update.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 4936 / UDP stream 54, frame 4937 / UDP stream 54, frame 4941 / TCP stream 68" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 5148 / UDP stream 57, frame 5149 / UDP stream 57, frame 5153 / TCP stream 71" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 5235 / UDP stream 58, frame 5236 / UDP stream 58, frame 5240 / TCP stream 73" }, { "type": "domain", "value": "kv801.prod.do.dsp.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 5259 / UDP stream 59, frame 5260 / UDP stream 59, frame 5266 / TCP stream 74" }, { "type": "domain", "value": "pti.store.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1432 / UDP stream 52, frame 1437 / UDP stream 52, frame 1447 / TCP stream 64" }, { "type": "domain", "value": "self.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 760 / UDP stream 36, frame 761 / UDP stream 36, frame 770 / TCP stream 38, frame 4851 / TCP stream 66" }, { "type": "domain", "value": "settings-win.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1143 / UDP stream 44, frame 1144 / UDP stream 44, frame 4908 / UDP stream 53, frame 4909 / UDP stream 53, frame 1148 / TCP stream 54 +3 more" }, { "type": "domain", "value": "settingsfd-geo.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 1144 / UDP stream 44, frame 4909 / UDP stream 53" }, { "type": "domain", "value": "spoonwatch-dc.spoonwatch.net", "confidence": 1, "description": "dns-query; frame 18 / UDP stream 5, frame 19 / UDP stream 5, frame 369 / UDP stream 28, frame 374 / UDP stream 28" }, { "type": "domain", "value": "spoonwatch.net", "confidence": 1, "description": "dns-query; frame 863 / UDP stream 40, frame 864 / UDP stream 40" }, { "type": "domain", "value": "v10.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1351 / UDP stream 50, frame 1352 / UDP stream 50, frame 5083 / UDP stream 56, frame 5084 / UDP stream 56, frame 5638 / UDP stream 62 +9 more" }, { "type": "domain", "value": "v20.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1037 / UDP stream 41, frame 1038 / UDP stream 41, frame 1042 / TCP stream 51" }, { "type": "domain", "value": "wns.notify.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 1430 / UDP stream 51" }, { "type": "domain", "value": "wpad.localdomain", "confidence": 1, "description": "dns-query; frame 58 / UDP stream 15, frame 59 / UDP stream 15, frame 806 / UDP stream 38, frame 807 / UDP stream 38, frame 1218 / UDP stream 46 +3 more" }, { "type": "domain", "value": "wpad.spoonwatch.net", "confidence": 1, "description": "dns-query; frame 56 / UDP stream 14, frame 57 / UDP stream 14, frame 804 / UDP stream 37, frame 805 / UDP stream 37, frame 1216 / UDP stream 45 +3 more" }, { "type": "domain", "value": "www.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1085 / UDP stream 43, frame 1086 / UDP stream 43, frame 1226 / UDP stream 47, frame 1227 / UDP stream 47, frame 5820 / UDP stream 69 +4 more" }, { "type": "ipv4", "value": "0.0.0.0", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "104.212.67.47", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1437 / UDP stream 52" }, { "type": "ipv4", "value": "13.107.21.200", "confidence": 1, "description": "dns-answer; frame 1086 / UDP stream 43, frame 1227 / UDP stream 47, frame 5821 / UDP stream 69" }, { "type": "ipv4", "value": "131.107.255.255", "confidence": 1, "description": "dns-answer; frame 50 / UDP stream 11" }, { "type": "ipv4", "value": "184.50.62.43", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5260 / UDP stream 59, frame 5283 / UDP stream 60" }, { "type": "ipv4", "value": "192.168.1.1", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "192.168.1.2", "confidence": 1, "description": "dns-answer, network-endpoint; frame 17 / UDP stream 4, frame 19 / UDP stream 5, frame 53 / UDP stream 12, frame 55 / UDP stream 13, frame 223 / UDP stream 22 +6 more" }, { "type": "ipv4", "value": "192.168.1.216", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "192.168.1.255", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "2.56.57.108", "confidence": 1, "description": "http-host, network-endpoint; frame 1501 / TCP stream 65, frame 1641 / TCP stream 65, frame 2225 / TCP stream 65, frame 2541 / TCP stream 65, frame 2691 / TCP stream 65 +4 more" }, { "type": "ipv4", "value": "20.189.173.1", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1352 / UDP stream 50" }, { "type": "ipv4", "value": "20.50.80.210", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1038 / UDP stream 41" }, { "type": "ipv4", "value": "20.54.89.15", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5149 / UDP stream 57" }, { "type": "ipv4", "value": "204.79.197.200", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1086 / UDP stream 43, frame 1227 / UDP stream 47, frame 5821 / UDP stream 69" }, { "type": "ipv4", "value": "204.79.197.203", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1062 / UDP stream 42" }, { "type": "ipv4", "value": "224.0.0.22", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "224.0.0.251", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "224.0.0.252", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "23.38.189.201", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5043 / UDP stream 55, frame 5303 / UDP stream 61" }, { "type": "ipv4", "value": "23.38.189.225", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5043 / UDP stream 55, frame 5303 / UDP stream 61" }, { "type": "ipv4", "value": "239.255.255.250", "confidence": 1, "description": "http-host, network-endpoint; frame 5688, frame 5689, frame 5690, frame 5691, frame 5692 +3 more" }, { "type": "ipv4", "value": "255.255.255.255", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "40.83.240.146", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1430 / UDP stream 51" }, { "type": "ipv4", "value": "52.168.112.67", "confidence": 1, "description": "dns-answer, network-endpoint; frame 761 / UDP stream 36" }, { "type": "ipv4", "value": "52.178.17.2", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5084 / UDP stream 56, frame 5639 / UDP stream 62, frame 5717 / UDP stream 64" }, { "type": "ipv4", "value": "52.179.216.235", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5236 / UDP stream 58" }, { "type": "ipv4", "value": "52.183.220.149", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1144 / UDP stream 44, frame 4909 / UDP stream 53" }, { "type": "ipv4", "value": "52.238.248.1", "confidence": 1, "description": "dns-answer; frame 4937 / UDP stream 54" }, { "type": "ipv4", "value": "52.249.36.204", "confidence": 1, "description": "dns-answer, network-endpoint; frame 4937 / UDP stream 54" }, { "type": "ipv4", "value": "67.27.123.126", "confidence": 1, "description": "dns-answer; frame 5775 / UDP stream 65" }, { "type": "ipv4", "value": "8.240.136.254", "confidence": 1, "description": "dns-answer; frame 5775 / UDP stream 65" }, { "type": "ipv4", "value": "8.249.3.254", "confidence": 1, "description": "dns-answer; frame 5775 / UDP stream 65" }, { "type": "ipv4", "value": "8.249.7.254", "confidence": 1, "description": "dns-answer; frame 5775 / UDP stream 65" }, { "type": "ipv4", "value": "8.253.189.126", "confidence": 1, "description": "dns-answer, network-endpoint; frame 5775 / UDP stream 65" }, { "type": "ja3", "value": "28a2c9bd18a11de089ef85a160da29e4", "confidence": 1, "description": "tls-client-fingerprint; frame 1042 / TCP stream 51, frame 1165 / TCP stream 55, frame 1356 / TCP stream 62, frame 1447 / TCP stream 64, frame 4913 / TCP stream 67 +10 more" }, { "type": "ja3", "value": "37f463bf4616ecd445d4a1937da06e19", "confidence": 1, "description": "tls-client-fingerprint; frame 1066 / TCP stream 52" }, { "type": "ja3", "value": "3b5074b1b5d032e5620f69f9f700ff0e", "confidence": 1, "description": "tls-client-fingerprint; frame 1435 / TCP stream 63" }, { "type": "ja3", "value": "6271f898ce5be7dd52b0fc260d0662b3", "confidence": 1, "description": "tls-client-fingerprint; frame 1090 / TCP stream 53, frame 1232 / TCP stream 57, frame 5825 / TCP stream 85" }, { "type": "ja3", "value": "a0e9f5d64349fb13191bc781f81f42e1", "confidence": 1, "description": "tls-client-fingerprint; frame 770 / TCP stream 38, frame 1148 / TCP stream 54, frame 1189 / TCP stream 56, frame 4851 / TCP stream 66" }, { "type": "sha256", "value": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "sha256", "value": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "confidence": 1, "description": "exported-object; no frame reference" }, { "type": "url", "value": "http://2.56.57.108/osk/", "confidence": 1, "description": "http-request; frame 4816 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//1.jpg", "confidence": 1, "description": "http-request; frame 1641 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//2.jpg", "confidence": 1, "description": "http-request; frame 2225 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//3.jpg", "confidence": 1, "description": "http-request; frame 2541 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//4.jpg", "confidence": 1, "description": "http-request; frame 2691 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//5.jpg", "confidence": 1, "description": "http-request; frame 3054 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//6.jpg", "confidence": 1, "description": "http-request; frame 1501 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//7.jpg", "confidence": 1, "description": "http-request; frame 4194 / TCP stream 65" }, { "type": "url", "value": "http://2.56.57.108/osk//main.php", "confidence": 1, "description": "http-request; frame 4275 / TCP stream 65" }, { "type": "url", "value": "http://239.255.255.250:1900*", "confidence": 1, "description": "http-request; frame 5688, frame 5689, frame 5690, frame 5691, frame 5692 +3 more" }, { "type": "url", "value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "confidence": 1, "description": "http-request; frame 5309 / TCP stream 76, frame 5313 / TCP stream 77, frame 5317 / TCP stream 76" }, { "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d", "confidence": 1, "description": "http-request; frame 5779 / TCP stream 83" }, { "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "confidence": 1, "description": "http-request; frame 5058 / TCP stream 69" }, { "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "confidence": 1, "description": "http-request; frame 5047 / TCP stream 69" }, { "type": "url", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "confidence": 1, "description": "http-request; frame 5069 / TCP stream 69" }, { "type": "user_agent", "value": "Microsoft-CryptoAPI/10.0", "confidence": 1, "description": "http-client; frame 5779 / TCP stream 83" }, { "type": "user_agent", "value": "Microsoft-Delivery-Optimization/10.0", "confidence": 1, "description": "http-client; frame 5309 / TCP stream 76, frame 5313 / TCP stream 77, frame 5317 / TCP stream 76" }, { "type": "user_agent", "value": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32", "confidence": 1, "description": "http-client; frame 5047 / TCP stream 69, frame 5058 / TCP stream 69, frame 5069 / TCP stream 69" } ], "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap" ], "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b", "semantic_sha256": "d99f9f0718d2f13b17822949ddc765679358c5ce545ed0bc49ba70534ed25482", "observable_count": 94, "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis", "source_analysis_ref": "/api/pcap/analyses/6e50c68f-5552-400c-9835-15867ddb022d", "suspicious_findings": [ { "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v3; confidence 86%.", "category": "Script, archive, or executable transfer candidate", "evidence": "frame 5309 / TCP stream 76, frame 5315 / TCP stream 76, frame 5317 / TCP stream 76, frame 5636 / TCP stream 76", "severity": "medium" }, { "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v3; confidence 86%.", "category": "Script, archive, or executable transfer candidate", "evidence": "frame 5313 / TCP stream 77, frame 5316 / TCP stream 77", "severity": "medium" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 246 / TCP stream 6, frame 253 / TCP stream 6, frame 254 / TCP stream 10, frame 257 / TCP stream 6, frame 262 / TCP stream 6 +25 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 29 / TCP stream 0, frame 191 / TCP stream 15, frame 213 / TCP stream 15, frame 219 / TCP stream 15, frame 221 / TCP stream 15 +42 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 931 / TCP stream 43, frame 933 / TCP stream 43, frame 935 / TCP stream 43, frame 937 / TCP stream 43, frame 939 / TCP stream 43 +10 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 241 / TCP stream 6, frame 251 / TCP stream 6, frame 252 / TCP stream 10, frame 255 / TCP stream 6, frame 256 / TCP stream 10 +25 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 27 / TCP stream 0, frame 189 / TCP stream 15, frame 210 / TCP stream 15, frame 218 / TCP stream 15, frame 220 / TCP stream 15 +53 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 930 / TCP stream 43, frame 932 / TCP stream 43, frame 934 / TCP stream 43, frame 936 / TCP stream 43, frame 938 / TCP stream 43 +10 more", "severity": "low" } ], "observables_truncated": false, "actor_similarity_leads": [ { "status": "ttp-overlap-not-attribution", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "group_attack_id": "G0123", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "group_attack_id": "G0044", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "group_attack_id": "G0130", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "group_attack_id": "G0136", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "group_attack_id": "G0133", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0107", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G1013", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0066", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0075", "shared_techniques": [ "T1105" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "group_attack_id": "G0120", "shared_techniques": [ "T1105" ] } ], "expected_suspicious_behaviors": [] }, { "id": "ttp-evidence:6e50c68f-5552-400c-9835-15867ddb022d:T1105", "type": "ttp-evidence", "label": "T1105 Ingress Tool Transfer", "source": "log-pcap-analysis", "status": "suggested", "tactic": "command-and-control", "evidence": "T1105 Ingress Tool Transfer", "attack_id": "T1105", "confidence": 0.8, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:api.msn.com", "type": "ioc", "value": "api.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1061 / UDP stream 42, frame 1062 / UDP stream 42, frame 1066 / TCP stream 52", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:au.download.windowsupdate.com", "type": "ioc", "value": "au.download.windowsupdate.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, http-host; frame 5302 / UDP stream 61, frame 5303 / UDP stream 61, frame 5309 / TCP stream 76, frame 5313 / TCP stream 77, frame 5317 / TCP stream 76", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:client.wns.windows.com", "type": "ioc", "value": "client.wns.windows.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1429 / UDP stream 51, frame 1430 / UDP stream 51, frame 1435 / TCP stream 63", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:cp801.prod.do.dsp.mp.microsoft.com", "type": "ioc", "value": "cp801.prod.do.dsp.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 5282 / UDP stream 60, frame 5283 / UDP stream 60, frame 5287 / TCP stream 75", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ctldl.windowsupdate.com", "type": "ioc", "value": "ctldl.windowsupdate.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, http-host; frame 5774 / UDP stream 65, frame 5775 / UDP stream 65, frame 5779 / TCP stream 83", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:dns.msftncsi.com", "type": "ioc", "value": "dns.msftncsi.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 49 / UDP stream 11, frame 50 / UDP stream 11", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:download.windowsupdate.com", "type": "ioc", "value": "download.windowsupdate.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, http-host; frame 5042 / UDP stream 55, frame 5043 / UDP stream 55, frame 5047 / TCP stream 69, frame 5058 / TCP stream 69, frame 5069 / TCP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe2cr.update.microsoft.com", "type": "ioc", "value": "fe2cr.update.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 4936 / UDP stream 54, frame 4937 / UDP stream 54, frame 4941 / TCP stream 68", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe3cr.delivery.mp.microsoft.com", "type": "ioc", "value": "fe3cr.delivery.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 5148 / UDP stream 57, frame 5149 / UDP stream 57, frame 5153 / TCP stream 71", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:geo.prod.do.dsp.mp.microsoft.com", "type": "ioc", "value": "geo.prod.do.dsp.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 5235 / UDP stream 58, frame 5236 / UDP stream 58, frame 5240 / TCP stream 73", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:kv801.prod.do.dsp.mp.microsoft.com", "type": "ioc", "value": "kv801.prod.do.dsp.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 5259 / UDP stream 59, frame 5260 / UDP stream 59, frame 5266 / TCP stream 74", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:pti.store.microsoft.com", "type": "ioc", "value": "pti.store.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1432 / UDP stream 52, frame 1437 / UDP stream 52, frame 1447 / TCP stream 64", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:self.events.data.microsoft.com", "type": "ioc", "value": "self.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 760 / UDP stream 36, frame 761 / UDP stream 36, frame 770 / TCP stream 38, frame 4851 / TCP stream 66", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:settings-win.data.microsoft.com", "type": "ioc", "value": "settings-win.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1143 / UDP stream 44, frame 1144 / UDP stream 44, frame 4908 / UDP stream 53, frame 4909 / UDP stream 53, frame 1148 / TCP stream 54 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:settingsfd-geo.trafficmanager.net", "type": "ioc", "value": "settingsfd-geo.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-cname; frame 1144 / UDP stream 44, frame 4909 / UDP stream 53", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:spoonwatch-dc.spoonwatch.net", "type": "ioc", "value": "spoonwatch-dc.spoonwatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 18 / UDP stream 5, frame 19 / UDP stream 5, frame 369 / UDP stream 28, frame 374 / UDP stream 28", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:spoonwatch.net", "type": "ioc", "value": "spoonwatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 863 / UDP stream 40, frame 864 / UDP stream 40", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:v10.events.data.microsoft.com", "type": "ioc", "value": "v10.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1351 / UDP stream 50, frame 1352 / UDP stream 50, frame 5083 / UDP stream 56, frame 5084 / UDP stream 56, frame 5638 / UDP stream 62 +9 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:v20.events.data.microsoft.com", "type": "ioc", "value": "v20.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1037 / UDP stream 41, frame 1038 / UDP stream 41, frame 1042 / TCP stream 51", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wns.notify.trafficmanager.net", "type": "ioc", "value": "wns.notify.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-cname; frame 1430 / UDP stream 51", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wpad.localdomain", "type": "ioc", "value": "wpad.localdomain", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 58 / UDP stream 15, frame 59 / UDP stream 15, frame 806 / UDP stream 38, frame 807 / UDP stream 38, frame 1218 / UDP stream 46 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wpad.spoonwatch.net", "type": "ioc", "value": "wpad.spoonwatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query; frame 56 / UDP stream 14, frame 57 / UDP stream 14, frame 804 / UDP stream 37, frame 805 / UDP stream 37, frame 1216 / UDP stream 45 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.bing.com", "type": "ioc", "value": "www.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-query, tls-sni; frame 1085 / UDP stream 43, frame 1086 / UDP stream 43, frame 1226 / UDP stream 47, frame 1227 / UDP stream 47, frame 5820 / UDP stream 69 +4 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:0.0.0.0", "type": "ioc", "value": "0.0.0.0", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:104.212.67.47", "type": "ioc", "value": "104.212.67.47", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1437 / UDP stream 52", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.21.200", "type": "ioc", "value": "13.107.21.200", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 1086 / UDP stream 43, frame 1227 / UDP stream 47, frame 5821 / UDP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:131.107.255.255", "type": "ioc", "value": "131.107.255.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 50 / UDP stream 11", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:184.50.62.43", "type": "ioc", "value": "184.50.62.43", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5260 / UDP stream 59, frame 5283 / UDP stream 60", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:192.168.1.1", "type": "ioc", "value": "192.168.1.1", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:192.168.1.2", "type": "ioc", "value": "192.168.1.2", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 17 / UDP stream 4, frame 19 / UDP stream 5, frame 53 / UDP stream 12, frame 55 / UDP stream 13, frame 223 / UDP stream 22 +6 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:192.168.1.216", "type": "ioc", "value": "192.168.1.216", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:192.168.1.255", "type": "ioc", "value": "192.168.1.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:2.56.57.108", "type": "ioc", "value": "2.56.57.108", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-host, network-endpoint; frame 1501 / TCP stream 65, frame 1641 / TCP stream 65, frame 2225 / TCP stream 65, frame 2541 / TCP stream 65, frame 2691 / TCP stream 65 +4 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.189.173.1", "type": "ioc", "value": "20.189.173.1", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1352 / UDP stream 50", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.50.80.210", "type": "ioc", "value": "20.50.80.210", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1038 / UDP stream 41", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.54.89.15", "type": "ioc", "value": "20.54.89.15", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5149 / UDP stream 57", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:204.79.197.200", "type": "ioc", "value": "204.79.197.200", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1086 / UDP stream 43, frame 1227 / UDP stream 47, frame 5821 / UDP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:204.79.197.203", "type": "ioc", "value": "204.79.197.203", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1062 / UDP stream 42", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:224.0.0.22", "type": "ioc", "value": "224.0.0.22", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:224.0.0.251", "type": "ioc", "value": "224.0.0.251", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:224.0.0.252", "type": "ioc", "value": "224.0.0.252", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.38.189.201", "type": "ioc", "value": "23.38.189.201", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5043 / UDP stream 55, frame 5303 / UDP stream 61", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.38.189.225", "type": "ioc", "value": "23.38.189.225", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5043 / UDP stream 55, frame 5303 / UDP stream 61", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:239.255.255.250", "type": "ioc", "value": "239.255.255.250", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-host, network-endpoint; frame 5688, frame 5689, frame 5690, frame 5691, frame 5692 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:255.255.255.255", "type": "ioc", "value": "255.255.255.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "network-endpoint; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:40.83.240.146", "type": "ioc", "value": "40.83.240.146", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1430 / UDP stream 51", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.168.112.67", "type": "ioc", "value": "52.168.112.67", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 761 / UDP stream 36", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.178.17.2", "type": "ioc", "value": "52.178.17.2", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5084 / UDP stream 56, frame 5639 / UDP stream 62, frame 5717 / UDP stream 64", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.179.216.235", "type": "ioc", "value": "52.179.216.235", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5236 / UDP stream 58", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.183.220.149", "type": "ioc", "value": "52.183.220.149", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 1144 / UDP stream 44, frame 4909 / UDP stream 53", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.238.248.1", "type": "ioc", "value": "52.238.248.1", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 4937 / UDP stream 54", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:52.249.36.204", "type": "ioc", "value": "52.249.36.204", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 4937 / UDP stream 54", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:67.27.123.126", "type": "ioc", "value": "67.27.123.126", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:8.240.136.254", "type": "ioc", "value": "8.240.136.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:8.249.3.254", "type": "ioc", "value": "8.249.3.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:8.249.7.254", "type": "ioc", "value": "8.249.7.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:8.253.189.126", "type": "ioc", "value": "8.253.189.126", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "dns-answer, network-endpoint; frame 5775 / UDP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:28a2c9bd18a11de089ef85a160da29e4", "type": "ioc", "value": "28a2c9bd18a11de089ef85a160da29e4", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 1042 / TCP stream 51, frame 1165 / TCP stream 55, frame 1356 / TCP stream 62, frame 1447 / TCP stream 64, frame 4913 / TCP stream 67 +10 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:37f463bf4616ecd445d4a1937da06e19", "type": "ioc", "value": "37f463bf4616ecd445d4a1937da06e19", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 1066 / TCP stream 52", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:3b5074b1b5d032e5620f69f9f700ff0e", "type": "ioc", "value": "3b5074b1b5d032e5620f69f9f700ff0e", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 1435 / TCP stream 63", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:6271f898ce5be7dd52b0fc260d0662b3", "type": "ioc", "value": "6271f898ce5be7dd52b0fc260d0662b3", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 1090 / TCP stream 53, frame 1232 / TCP stream 57, frame 5825 / TCP stream 85", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a0e9f5d64349fb13191bc781f81f42e1", "type": "ioc", "value": "a0e9f5d64349fb13191bc781f81f42e1", "source": "log-pcap-analysis", "ioc_type": "ja3", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "tls-client-fingerprint; frame 770 / TCP stream 38, frame 1148 / TCP stream 54, frame 1189 / TCP stream 56, frame 4851 / TCP stream 66", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "type": "ioc", "value": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "type": "ioc", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "type": "ioc", "value": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "type": "ioc", "value": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "type": "ioc", "value": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "type": "ioc", "value": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "type": "ioc", "value": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "type": "ioc", "value": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "type": "ioc", "value": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "type": "ioc", "value": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "type": "ioc", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "type": "ioc", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "type": "ioc", "value": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "type": "ioc", "value": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "source": "log-pcap-analysis", "ioc_type": "sha256", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "exported-object; no frame reference", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk/", "type": "ioc", "value": "http://2.56.57.108/osk/", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 4816 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//1.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//1.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 1641 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//2.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//2.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 2225 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//3.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//3.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 2541 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//4.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//4.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 2691 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//5.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//5.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 3054 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//6.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//6.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 1501 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//7.jpg", "type": "ioc", "value": "http://2.56.57.108/osk//7.jpg", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 4194 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://2.56.57.108/osk//main.php", "type": "ioc", "value": "http://2.56.57.108/osk//main.php", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 4275 / TCP stream 65", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://239.255.255.250:1900*", "type": "ioc", "value": "http://239.255.255.250:1900*", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5688, frame 5689, frame 5690, frame 5691, frame 5692 +3 more", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "type": "ioc", "value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5309 / TCP stream 76, frame 5313 / TCP stream 77, frame 5317 / TCP stream 76", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d", "type": "ioc", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f622d06ddf57408d", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5779 / TCP stream 83", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "type": "ioc", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5058 / TCP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "type": "ioc", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5047 / TCP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "type": "ioc", "value": "http://download.windowsupdate.com/c/msdownload/update/others/2022/01/35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "source": "log-pcap-analysis", "ioc_type": "url", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "description": "http-request; frame 5069 / TCP stream 69", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "finding-d7b07e629e8e0f6702dd148e", "type": "pcap-finding", "label": "Script, archive, or executable transfer candidate", "source": "deterministic-pcap-analysis", "metrics": { "uri": "/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "source": "23.38.189.225", "destination": "192.168.1.216", "content_type": "application/octet-stream", "response_count": 2, "declared_body_bytes": 307634 }, "rule_id": "script-or-executable-transfer", "severity": "medium", "confidence": 0.86, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 76, "frame_number": 5309, "display_filter": "frame.number == 5309", "timestamp_epoch": "1641572062.462443000" }, { "tcp_stream": 76, "frame_number": 5315, "display_filter": "frame.number == 5315", "timestamp_epoch": "1641572062.488577000" }, { "tcp_stream": 76, "frame_number": 5317, "display_filter": "frame.number == 5317", "timestamp_epoch": "1641572062.491933000" }, { "tcp_stream": 76, "frame_number": 5636, "display_filter": "frame.number == 5636", "timestamp_epoch": "1641572062.587068000" } ] }, { "id": "finding-a5d772a1518cadd8ca9a6ccd", "type": "pcap-finding", "label": "Script, archive, or executable transfer candidate", "source": "deterministic-pcap-analysis", "metrics": { "uri": "/c/msdownload/update/software/defu/2022/01/am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81.exe", "source": "23.38.189.201", "destination": "192.168.1.216", "content_type": "application/octet-stream", "response_count": 1, "declared_body_bytes": 2 }, "rule_id": "script-or-executable-transfer", "severity": "medium", "confidence": 0.86, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 77, "frame_number": 5313, "display_filter": "frame.number == 5313", "timestamp_epoch": "1641572062.465939000" }, { "tcp_stream": 77, "frame_number": 5316, "display_filter": "frame.number == 5316", "timestamp_epoch": "1641572062.488580000" } ] }, { "id": "finding-2629b43176825e7ba8783aaf", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.2", "protocol": "drsuapi", "destination": "192.168.1.216", "event_count": 30, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 6, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1641571451.003845000" }, { "tcp_stream": 6, "frame_number": 253, "display_filter": "frame.number == 253", "timestamp_epoch": "1641571451.004569000" }, { "tcp_stream": 10, "frame_number": 254, "display_filter": "frame.number == 254", "timestamp_epoch": "1641571451.004734000" }, { "tcp_stream": 6, "frame_number": 257, "display_filter": "frame.number == 257", "timestamp_epoch": "1641571451.005072000" }, { "tcp_stream": 6, "frame_number": 262, "display_filter": "frame.number == 262", "timestamp_epoch": "1641571451.005520000" }, { "tcp_stream": 10, "frame_number": 263, "display_filter": "frame.number == 263", "timestamp_epoch": "1641571451.005596000" }, { "tcp_stream": 10, "frame_number": 265, "display_filter": "frame.number == 265", "timestamp_epoch": "1641571451.005981000" }, { "tcp_stream": 6, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1641571451.008749000" }, { "tcp_stream": 6, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1641571451.011706000" }, { "tcp_stream": 6, "frame_number": 286, "display_filter": "frame.number == 286", "timestamp_epoch": "1641571451.014021000" }, { "tcp_stream": 19, "frame_number": 330, "display_filter": "frame.number == 330", "timestamp_epoch": "1641571451.128893000" }, { "tcp_stream": 19, "frame_number": 337, "display_filter": "frame.number == 337", "timestamp_epoch": "1641571451.129893000" }, { "tcp_stream": 19, "frame_number": 339, "display_filter": "frame.number == 339", "timestamp_epoch": "1641571451.130453000" }, { "tcp_stream": 19, "frame_number": 341, "display_filter": "frame.number == 341", "timestamp_epoch": "1641571451.130833000" }, { "tcp_stream": 31, "frame_number": 622, "display_filter": "frame.number == 622", "timestamp_epoch": "1641571454.555556000" }, { "tcp_stream": 31, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1641571454.556869000" }, { "tcp_stream": 31, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1641571454.557533000" }, { "tcp_stream": 31, "frame_number": 630, "display_filter": "frame.number == 630", "timestamp_epoch": "1641571454.559408000" }, { "tcp_stream": 31, "frame_number": 632, "display_filter": "frame.number == 632", "timestamp_epoch": "1641571454.559994000" }, { "tcp_stream": 31, "frame_number": 634, "display_filter": "frame.number == 634", "timestamp_epoch": "1641571454.560773000" }, { "tcp_stream": 10, "frame_number": 903, "display_filter": "frame.number == 903", "timestamp_epoch": "1641571491.751288000" }, { "tcp_stream": 10, "frame_number": 905, "display_filter": "frame.number == 905", "timestamp_epoch": "1641571491.751833000" }, { "tcp_stream": 10, "frame_number": 907, "display_filter": "frame.number == 907", "timestamp_epoch": "1641571491.752292000" }, { "tcp_stream": 10, "frame_number": 910, "display_filter": "frame.number == 910", "timestamp_epoch": "1641571491.752713000" }, { "tcp_stream": 59, "frame_number": 1283, "display_filter": "frame.number == 1283", "timestamp_epoch": "1641571552.683126000" }, { "tcp_stream": 59, "frame_number": 1285, "display_filter": "frame.number == 1285", "timestamp_epoch": "1641571552.683986000" }, { "tcp_stream": 59, "frame_number": 1287, "display_filter": "frame.number == 1287", "timestamp_epoch": "1641571552.684546000" }, { "tcp_stream": 59, "frame_number": 1291, "display_filter": "frame.number == 1291", "timestamp_epoch": "1641571552.686361000" }, { "tcp_stream": 59, "frame_number": 1293, "display_filter": "frame.number == 1293", "timestamp_epoch": "1641571552.687064000" }, { "tcp_stream": 59, "frame_number": 1295, "display_filter": "frame.number == 1295", "timestamp_epoch": "1641571552.687556000" } ] }, { "id": "finding-9db47598ea52192f7844b3b1", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.2", "protocol": "ldap", "destination": "192.168.1.216", "event_count": 47, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 29, "display_filter": "frame.number == 29", "timestamp_epoch": "1641571449.760917000" }, { "tcp_stream": 15, "frame_number": 191, "display_filter": "frame.number == 191", "timestamp_epoch": "1641571450.989667000" }, { "tcp_stream": 15, "frame_number": 213, "display_filter": "frame.number == 213", "timestamp_epoch": "1641571450.993333000" }, { "tcp_stream": 15, "frame_number": 219, "display_filter": "frame.number == 219", "timestamp_epoch": "1641571450.994494000" }, { "tcp_stream": 15, "frame_number": 221, "display_filter": "frame.number == 221", "timestamp_epoch": "1641571450.995376000" }, { "tcp_stream": 0, "frame_number": 266, "display_filter": "frame.number == 266", "timestamp_epoch": "1641571451.006109000" }, { "tcp_stream": 15, "frame_number": 336, "display_filter": "frame.number == 336", "timestamp_epoch": "1641571451.129832000" }, { "tcp_stream": 15, "frame_number": 357, "display_filter": "frame.number == 357", "timestamp_epoch": "1641571451.296908000" }, { "tcp_stream": 15, "frame_number": 373, "display_filter": "frame.number == 373", "timestamp_epoch": "1641571451.429677000" }, { "tcp_stream": 15, "frame_number": 382, "display_filter": "frame.number == 382", "timestamp_epoch": "1641571451.460801000" }, { "tcp_stream": 15, "frame_number": 384, "display_filter": "frame.number == 384", "timestamp_epoch": "1641571451.461821000" }, { "tcp_stream": 25, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1641571452.071453000" }, { "tcp_stream": 25, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1641571452.073968000" }, { "tcp_stream": 25, "frame_number": 422, "display_filter": "frame.number == 422", "timestamp_epoch": "1641571452.365154000" }, { "tcp_stream": 27, "frame_number": 429, "display_filter": "frame.number == 429", "timestamp_epoch": "1641571452.369088000" }, { "tcp_stream": 27, "frame_number": 431, "display_filter": "frame.number == 431", "timestamp_epoch": "1641571452.369795000" }, { "tcp_stream": 27, "frame_number": 433, "display_filter": "frame.number == 433", "timestamp_epoch": "1641571452.370428000" }, { "tcp_stream": 25, "frame_number": 435, "display_filter": "frame.number == 435", "timestamp_epoch": "1641571452.371863000" }, { "tcp_stream": 32, "frame_number": 640, "display_filter": "frame.number == 640", "timestamp_epoch": "1641571454.565359000" }, { "tcp_stream": 32, "frame_number": 645, "display_filter": "frame.number == 645", "timestamp_epoch": "1641571454.567281000" }, { "tcp_stream": 32, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1641571454.568025000" }, { "tcp_stream": 32, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1641571454.568648000" }, { "tcp_stream": 32, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1641571454.569313000" }, { "tcp_stream": 33, "frame_number": 658, "display_filter": "frame.number == 658", "timestamp_epoch": "1641571454.575321000" }, { "tcp_stream": 33, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1641571454.576692000" }, { "tcp_stream": 33, "frame_number": 665, "display_filter": "frame.number == 665", "timestamp_epoch": "1641571454.577451000" }, { "tcp_stream": 34, "frame_number": 706, "display_filter": "frame.number == 706", "timestamp_epoch": "1641571460.157120000" }, { "tcp_stream": 34, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1641571460.159345000" }, { "tcp_stream": 34, "frame_number": 713, "display_filter": "frame.number == 713", "timestamp_epoch": "1641571460.162077000" }, { "tcp_stream": 34, "frame_number": 715, "display_filter": "frame.number == 715", "timestamp_epoch": "1641571460.162667000" }, { "tcp_stream": 34, "frame_number": 717, "display_filter": "frame.number == 717", "timestamp_epoch": "1641571460.163177000" }, { "tcp_stream": 34, "frame_number": 719, "display_filter": "frame.number == 719", "timestamp_epoch": "1641571460.163665000" }, { "tcp_stream": 34, "frame_number": 721, "display_filter": "frame.number == 721", "timestamp_epoch": "1641571460.164190000" }, { "tcp_stream": 49, "frame_number": 1009, "display_filter": "frame.number == 1009", "timestamp_epoch": "1641571492.072146000" }, { "tcp_stream": 49, "frame_number": 1011, "display_filter": "frame.number == 1011", "timestamp_epoch": "1641571492.078889000" }, { "tcp_stream": 50, "frame_number": 1018, "display_filter": "frame.number == 1018", "timestamp_epoch": "1641571492.088787000" }, { "tcp_stream": 50, "frame_number": 1020, "display_filter": "frame.number == 1020", "timestamp_epoch": "1641571492.090063000" }, { "tcp_stream": 50, "frame_number": 1022, "display_filter": "frame.number == 1022", "timestamp_epoch": "1641571492.090556000" }, { "tcp_stream": 49, "frame_number": 1024, "display_filter": "frame.number == 1024", "timestamp_epoch": "1641571492.091320000" }, { "tcp_stream": 60, "frame_number": 1301, "display_filter": "frame.number == 1301", "timestamp_epoch": "1641571552.690387000" }, { "tcp_stream": 60, "frame_number": 1306, "display_filter": "frame.number == 1306", "timestamp_epoch": "1641571552.692352000" }, { "tcp_stream": 60, "frame_number": 1308, "display_filter": "frame.number == 1308", "timestamp_epoch": "1641571552.693351000" }, { "tcp_stream": 60, "frame_number": 1310, "display_filter": "frame.number == 1310", "timestamp_epoch": "1641571552.693923000" }, { "tcp_stream": 60, "frame_number": 1312, "display_filter": "frame.number == 1312", "timestamp_epoch": "1641571552.694537000" }, { "tcp_stream": 61, "frame_number": 1319, "display_filter": "frame.number == 1319", "timestamp_epoch": "1641571552.698593000" }, { "tcp_stream": 61, "frame_number": 1323, "display_filter": "frame.number == 1323", "timestamp_epoch": "1641571552.699332000" }, { "tcp_stream": 61, "frame_number": 1326, "display_filter": "frame.number == 1326", "timestamp_epoch": "1641571552.700008000" } ] }, { "id": "finding-91ee3e149e111692dc445e62", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.2", "protocol": "samr", "destination": "192.168.1.216", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 43, "frame_number": 931, "display_filter": "frame.number == 931", "timestamp_epoch": "1641571491.762873000" }, { "tcp_stream": 43, "frame_number": 933, "display_filter": "frame.number == 933", "timestamp_epoch": "1641571491.763490000" }, { "tcp_stream": 43, "frame_number": 935, "display_filter": "frame.number == 935", "timestamp_epoch": "1641571491.764023000" }, { "tcp_stream": 43, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1641571491.765022000" }, { "tcp_stream": 43, "frame_number": 939, "display_filter": "frame.number == 939", "timestamp_epoch": "1641571491.765641000" }, { "tcp_stream": 43, "frame_number": 941, "display_filter": "frame.number == 941", "timestamp_epoch": "1641571491.766298000" }, { "tcp_stream": 43, "frame_number": 943, "display_filter": "frame.number == 943", "timestamp_epoch": "1641571491.766964000" }, { "tcp_stream": 43, "frame_number": 945, "display_filter": "frame.number == 945", "timestamp_epoch": "1641571491.767646000" }, { "tcp_stream": 43, "frame_number": 947, "display_filter": "frame.number == 947", "timestamp_epoch": "1641571491.768351000" }, { "tcp_stream": 43, "frame_number": 949, "display_filter": "frame.number == 949", "timestamp_epoch": "1641571491.769000000" }, { "tcp_stream": 43, "frame_number": 951, "display_filter": "frame.number == 951", "timestamp_epoch": "1641571491.769604000" }, { "tcp_stream": 43, "frame_number": 953, "display_filter": "frame.number == 953", "timestamp_epoch": "1641571491.770231000" }, { "tcp_stream": 43, "frame_number": 955, "display_filter": "frame.number == 955", "timestamp_epoch": "1641571491.770746000" }, { "tcp_stream": 43, "frame_number": 957, "display_filter": "frame.number == 957", "timestamp_epoch": "1641571491.771295000" }, { "tcp_stream": 43, "frame_number": 959, "display_filter": "frame.number == 959", "timestamp_epoch": "1641571491.771855000" } ] }, { "id": "finding-f921ff23cf0e8136c3155ef5", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.216", "protocol": "drsuapi", "destination": "192.168.1.2", "event_count": 30, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 6, "frame_number": 241, "display_filter": "frame.number == 241", "timestamp_epoch": "1641571451.003468000" }, { "tcp_stream": 6, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1641571451.004195000" }, { "tcp_stream": 10, "frame_number": 252, "display_filter": "frame.number == 252", "timestamp_epoch": "1641571451.004462000" }, { "tcp_stream": 6, "frame_number": 255, "display_filter": "frame.number == 255", "timestamp_epoch": "1641571451.004759000" }, { "tcp_stream": 10, "frame_number": 256, "display_filter": "frame.number == 256", "timestamp_epoch": "1641571451.005062000" }, { "tcp_stream": 6, "frame_number": 261, "display_filter": "frame.number == 261", "timestamp_epoch": "1641571451.005293000" }, { "tcp_stream": 10, "frame_number": 264, "display_filter": "frame.number == 264", "timestamp_epoch": "1641571451.005796000" }, { "tcp_stream": 6, "frame_number": 279, "display_filter": "frame.number == 279", "timestamp_epoch": "1641571451.008528000" }, { "tcp_stream": 6, "frame_number": 283, "display_filter": "frame.number == 283", "timestamp_epoch": "1641571451.011418000" }, { "tcp_stream": 6, "frame_number": 285, "display_filter": "frame.number == 285", "timestamp_epoch": "1641571451.013823000" }, { "tcp_stream": 19, "frame_number": 329, "display_filter": "frame.number == 329", "timestamp_epoch": "1641571451.128651000" }, { "tcp_stream": 19, "frame_number": 331, "display_filter": "frame.number == 331", "timestamp_epoch": "1641571451.129114000" }, { "tcp_stream": 19, "frame_number": 338, "display_filter": "frame.number == 338", "timestamp_epoch": "1641571451.130065000" }, { "tcp_stream": 19, "frame_number": 340, "display_filter": "frame.number == 340", "timestamp_epoch": "1641571451.130682000" }, { "tcp_stream": 31, "frame_number": 621, "display_filter": "frame.number == 621", "timestamp_epoch": "1641571454.554962000" }, { "tcp_stream": 31, "frame_number": 623, "display_filter": "frame.number == 623", "timestamp_epoch": "1641571454.556207000" }, { "tcp_stream": 31, "frame_number": 625, "display_filter": "frame.number == 625", "timestamp_epoch": "1641571454.557228000" }, { "tcp_stream": 31, "frame_number": 629, "display_filter": "frame.number == 629", "timestamp_epoch": "1641571454.559129000" }, { "tcp_stream": 31, "frame_number": 631, "display_filter": "frame.number == 631", "timestamp_epoch": "1641571454.559666000" }, { "tcp_stream": 31, "frame_number": 633, "display_filter": "frame.number == 633", "timestamp_epoch": "1641571454.560505000" }, { "tcp_stream": 10, "frame_number": 902, "display_filter": "frame.number == 902", "timestamp_epoch": "1641571491.751061000" }, { "tcp_stream": 10, "frame_number": 904, "display_filter": "frame.number == 904", "timestamp_epoch": "1641571491.751508000" }, { "tcp_stream": 10, "frame_number": 906, "display_filter": "frame.number == 906", "timestamp_epoch": "1641571491.752019000" }, { "tcp_stream": 10, "frame_number": 908, "display_filter": "frame.number == 908", "timestamp_epoch": "1641571491.752465000" }, { "tcp_stream": 59, "frame_number": 1282, "display_filter": "frame.number == 1282", "timestamp_epoch": "1641571552.682757000" }, { "tcp_stream": 59, "frame_number": 1284, "display_filter": "frame.number == 1284", "timestamp_epoch": "1641571552.683595000" }, { "tcp_stream": 59, "frame_number": 1286, "display_filter": "frame.number == 1286", "timestamp_epoch": "1641571552.684309000" }, { "tcp_stream": 59, "frame_number": 1290, "display_filter": "frame.number == 1290", "timestamp_epoch": "1641571552.686083000" }, { "tcp_stream": 59, "frame_number": 1292, "display_filter": "frame.number == 1292", "timestamp_epoch": "1641571552.686716000" }, { "tcp_stream": 59, "frame_number": 1294, "display_filter": "frame.number == 1294", "timestamp_epoch": "1641571552.687333000" } ] }, { "id": "finding-9d5591aa667e378ce0d979d4", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.216", "protocol": "ldap", "destination": "192.168.1.2", "event_count": 58, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 27, "display_filter": "frame.number == 27", "timestamp_epoch": "1641571449.760632000" }, { "tcp_stream": 15, "frame_number": 189, "display_filter": "frame.number == 189", "timestamp_epoch": "1641571450.989411000" }, { "tcp_stream": 15, "frame_number": 210, "display_filter": "frame.number == 210", "timestamp_epoch": "1641571450.992655000" }, { "tcp_stream": 15, "frame_number": 218, "display_filter": "frame.number == 218", "timestamp_epoch": "1641571450.994306000" }, { "tcp_stream": 15, "frame_number": 220, "display_filter": "frame.number == 220", "timestamp_epoch": "1641571450.995080000" }, { "tcp_stream": 0, "frame_number": 259, "display_filter": "frame.number == 259", "timestamp_epoch": "1641571451.005120000" }, { "tcp_stream": 0, "frame_number": 274, "display_filter": "frame.number == 274", "timestamp_epoch": "1641571451.007930000" }, { "tcp_stream": 15, "frame_number": 333, "display_filter": "frame.number == 333", "timestamp_epoch": "1641571451.129551000" }, { "tcp_stream": 15, "frame_number": 354, "display_filter": "frame.number == 354", "timestamp_epoch": "1641571451.296482000" }, { "tcp_stream": 15, "frame_number": 370, "display_filter": "frame.number == 370", "timestamp_epoch": "1641571451.429300000" }, { "tcp_stream": 15, "frame_number": 379, "display_filter": "frame.number == 379", "timestamp_epoch": "1641571451.460400000" }, { "tcp_stream": 15, "frame_number": 383, "display_filter": "frame.number == 383", "timestamp_epoch": "1641571451.461512000" }, { "tcp_stream": 15, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1641571451.462109000" }, { "tcp_stream": 25, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1641571452.071100000" }, { "tcp_stream": 25, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1641571452.073024000" }, { "tcp_stream": 25, "frame_number": 421, "display_filter": "frame.number == 421", "timestamp_epoch": "1641571452.364742000" }, { "tcp_stream": 27, "frame_number": 427, "display_filter": "frame.number == 427", "timestamp_epoch": "1641571452.367990000" }, { "tcp_stream": 27, "frame_number": 430, "display_filter": "frame.number == 430", "timestamp_epoch": "1641571452.369578000" }, { "tcp_stream": 27, "frame_number": 432, "display_filter": "frame.number == 432", "timestamp_epoch": "1641571452.370081000" }, { "tcp_stream": 25, "frame_number": 434, "display_filter": "frame.number == 434", "timestamp_epoch": "1641571452.371397000" }, { "tcp_stream": 27, "frame_number": 586, "display_filter": "frame.number == 586", "timestamp_epoch": "1641571452.658399000" }, { "tcp_stream": 25, "frame_number": 591, "display_filter": "frame.number == 591", "timestamp_epoch": "1641571452.719218000" }, { "tcp_stream": 32, "frame_number": 638, "display_filter": "frame.number == 638", "timestamp_epoch": "1641571454.564967000" }, { "tcp_stream": 32, "frame_number": 643, "display_filter": "frame.number == 643", "timestamp_epoch": "1641571454.566408000" }, { "tcp_stream": 32, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1641571454.567691000" }, { "tcp_stream": 32, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1641571454.568306000" }, { "tcp_stream": 32, "frame_number": 650, "display_filter": "frame.number == 650", "timestamp_epoch": "1641571454.568981000" }, { "tcp_stream": 33, "frame_number": 656, "display_filter": "frame.number == 656", "timestamp_epoch": "1641571454.574377000" }, { "tcp_stream": 33, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1641571454.576382000" }, { "tcp_stream": 33, "frame_number": 664, "display_filter": "frame.number == 664", "timestamp_epoch": "1641571454.577162000" }, { "tcp_stream": 33, "frame_number": 666, "display_filter": "frame.number == 666", "timestamp_epoch": "1641571454.577816000" }, { "tcp_stream": 32, "frame_number": 670, "display_filter": "frame.number == 670", "timestamp_epoch": "1641571454.578524000" }, { "tcp_stream": 34, "frame_number": 704, "display_filter": "frame.number == 704", "timestamp_epoch": "1641571460.156613000" }, { "tcp_stream": 34, "frame_number": 709, "display_filter": "frame.number == 709", "timestamp_epoch": "1641571460.158393000" }, { "tcp_stream": 34, "frame_number": 712, "display_filter": "frame.number == 712", "timestamp_epoch": "1641571460.161773000" }, { "tcp_stream": 34, "frame_number": 714, "display_filter": "frame.number == 714", "timestamp_epoch": "1641571460.162404000" }, { "tcp_stream": 34, "frame_number": 716, "display_filter": "frame.number == 716", "timestamp_epoch": "1641571460.162900000" }, { "tcp_stream": 34, "frame_number": 718, "display_filter": "frame.number == 718", "timestamp_epoch": "1641571460.163374000" }, { "tcp_stream": 34, "frame_number": 720, "display_filter": "frame.number == 720", "timestamp_epoch": "1641571460.163945000" }, { "tcp_stream": 34, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1641571460.176928000" }, { "tcp_stream": 49, "frame_number": 1007, "display_filter": "frame.number == 1007", "timestamp_epoch": "1641571492.071286000" }, { "tcp_stream": 49, "frame_number": 1010, "display_filter": "frame.number == 1010", "timestamp_epoch": "1641571492.078435000" }, { "tcp_stream": 50, "frame_number": 1016, "display_filter": "frame.number == 1016", "timestamp_epoch": "1641571492.087887000" }, { "tcp_stream": 50, "frame_number": 1019, "display_filter": "frame.number == 1019", "timestamp_epoch": "1641571492.089840000" }, { "tcp_stream": 50, "frame_number": 1021, "display_filter": "frame.number == 1021", "timestamp_epoch": "1641571492.090311000" }, { "tcp_stream": 49, "frame_number": 1023, "display_filter": "frame.number == 1023", "timestamp_epoch": "1641571492.090801000" }, { "tcp_stream": 50, "frame_number": 1027, "display_filter": "frame.number == 1027", "timestamp_epoch": "1641571492.410630000" }, { "tcp_stream": 49, "frame_number": 1031, "display_filter": "frame.number == 1031", "timestamp_epoch": "1641571492.418679000" }, { "tcp_stream": 60, "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1641571552.690072000" }, { "tcp_stream": 60, "frame_number": 1304, "display_filter": "frame.number == 1304", "timestamp_epoch": "1641571552.691378000" }, { "tcp_stream": 60, "frame_number": 1307, "display_filter": "frame.number == 1307", "timestamp_epoch": "1641571552.692973000" }, { "tcp_stream": 60, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1641571552.693680000" }, { "tcp_stream": 60, "frame_number": 1311, "display_filter": "frame.number == 1311", "timestamp_epoch": "1641571552.694215000" }, { "tcp_stream": 61, "frame_number": 1317, "display_filter": "frame.number == 1317", "timestamp_epoch": "1641571552.697751000" }, { "tcp_stream": 61, "frame_number": 1320, "display_filter": "frame.number == 1320", "timestamp_epoch": "1641571552.699027000" }, { "tcp_stream": 61, "frame_number": 1325, "display_filter": "frame.number == 1325", "timestamp_epoch": "1641571552.699715000" }, { "tcp_stream": 61, "frame_number": 1327, "display_filter": "frame.number == 1327", "timestamp_epoch": "1641571552.700270000" }, { "tcp_stream": 60, "frame_number": 1330, "display_filter": "frame.number == 1330", "timestamp_epoch": "1641571552.700472000" } ] }, { "id": "finding-e15ebfc8332800559cc11421", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "192.168.1.216", "protocol": "samr", "destination": "192.168.1.2", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 43, "frame_number": 930, "display_filter": "frame.number == 930", "timestamp_epoch": "1641571491.762466000" }, { "tcp_stream": 43, "frame_number": 932, "display_filter": "frame.number == 932", "timestamp_epoch": "1641571491.763188000" }, { "tcp_stream": 43, "frame_number": 934, "display_filter": "frame.number == 934", "timestamp_epoch": "1641571491.763726000" }, { "tcp_stream": 43, "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1641571491.764652000" }, { "tcp_stream": 43, "frame_number": 938, "display_filter": "frame.number == 938", "timestamp_epoch": "1641571491.765254000" }, { "tcp_stream": 43, "frame_number": 940, "display_filter": "frame.number == 940", "timestamp_epoch": "1641571491.765851000" }, { "tcp_stream": 43, "frame_number": 942, "display_filter": "frame.number == 942", "timestamp_epoch": "1641571491.766518000" }, { "tcp_stream": 43, "frame_number": 944, "display_filter": "frame.number == 944", "timestamp_epoch": "1641571491.767254000" }, { "tcp_stream": 43, "frame_number": 946, "display_filter": "frame.number == 946", "timestamp_epoch": "1641571491.767888000" }, { "tcp_stream": 43, "frame_number": 948, "display_filter": "frame.number == 948", "timestamp_epoch": "1641571491.768616000" }, { "tcp_stream": 43, "frame_number": 950, "display_filter": "frame.number == 950", "timestamp_epoch": "1641571491.769247000" }, { "tcp_stream": 43, "frame_number": 952, "display_filter": "frame.number == 952", "timestamp_epoch": "1641571491.769906000" }, { "tcp_stream": 43, "frame_number": 954, "display_filter": "frame.number == 954", "timestamp_epoch": "1641571491.770452000" }, { "tcp_stream": 43, "frame_number": 956, "display_filter": "frame.number == 956", "timestamp_epoch": "1641571491.770996000" }, { "tcp_stream": 43, "frame_number": 958, "display_filter": "frame.number == 958", "timestamp_epoch": "1641571491.771531000" } ] }, { "id": "identity-abb2d446808afab74c49aa3a", "type": "identity", "label": "account: desktop-gxmyno2$", "value": "desktop-gxmyno2$", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 2, "frame_number": 75, "display_filter": "frame.number == 75", "timestamp_epoch": "1641571450.952502000" }, { "tcp_stream": 7, "frame_number": 108, "display_filter": "frame.number == 108", "timestamp_epoch": "1641571450.966124000" }, { "tcp_stream": 9, "frame_number": 126, "display_filter": "frame.number == 126", "timestamp_epoch": "1641571450.978225000" }, { "tcp_stream": 8, "frame_number": 127, "display_filter": "frame.number == 127", "timestamp_epoch": "1641571450.978271000" }, { "tcp_stream": 8, "frame_number": 129, "display_filter": "frame.number == 129", "timestamp_epoch": "1641571450.978973000" }, { "tcp_stream": 9, "frame_number": 131, "display_filter": "frame.number == 131", "timestamp_epoch": "1641571450.979011000" }, { "tcp_stream": 11, "frame_number": 147, "display_filter": "frame.number == 147", "timestamp_epoch": "1641571450.983292000" }, { "tcp_stream": 12, "frame_number": 155, "display_filter": "frame.number == 155", "timestamp_epoch": "1641571450.984540000" }, { "tcp_stream": 12, "frame_number": 157, "display_filter": "frame.number == 157", "timestamp_epoch": "1641571450.985092000" }, { "tcp_stream": 13, "frame_number": 175, "display_filter": "frame.number == 175", "timestamp_epoch": "1641571450.987159000" }, { "tcp_stream": 14, "frame_number": 177, "display_filter": "frame.number == 177", "timestamp_epoch": "1641571450.987278000" }, { "tcp_stream": 16, "frame_number": 200, "display_filter": "frame.number == 200", "timestamp_epoch": "1641571450.991397000" }, { "tcp_stream": 17, "frame_number": 243, "display_filter": "frame.number == 243", "timestamp_epoch": "1641571451.003567000" }, { "tcp_stream": 20, "frame_number": 318, "display_filter": "frame.number == 318", "timestamp_epoch": "1641571451.124781000" }, { "tcp_stream": 26, "frame_number": 416, "display_filter": "frame.number == 416", "timestamp_epoch": "1641571452.357882000" }, { "tcp_stream": 28, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1641571452.580512000" }, { "tcp_stream": 29, "frame_number": 457, "display_filter": "frame.number == 457", "timestamp_epoch": "1641571452.582126000" }, { "tcp_stream": 35, "frame_number": 725, "display_filter": "frame.number == 725", "timestamp_epoch": "1641571460.169844000" }, { "tcp_stream": 36, "frame_number": 733, "display_filter": "frame.number == 733", "timestamp_epoch": "1641571460.171188000" }, { "tcp_stream": 36, "frame_number": 735, "display_filter": "frame.number == 735", "timestamp_epoch": "1641571460.171965000" } ] }, { "id": "identity-365401ea82bb1bcf88b24846", "type": "identity", "label": "account: steve.smith", "value": "steve.smith", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 39, "frame_number": 829, "display_filter": "frame.number == 829", "timestamp_epoch": "1641571491.641944000" }, { "tcp_stream": 40, "frame_number": 837, "display_filter": "frame.number == 837", "timestamp_epoch": "1641571491.650430000" }, { "tcp_stream": 40, "frame_number": 839, "display_filter": "frame.number == 839", "timestamp_epoch": "1641571491.651134000" }, { "tcp_stream": 41, "frame_number": 851, "display_filter": "frame.number == 851", "timestamp_epoch": "1641571491.653884000" }, { "tcp_stream": 45, "frame_number": 891, "display_filter": "frame.number == 891", "timestamp_epoch": "1641571491.749061000" }, { "tcp_stream": 43, "frame_number": 914, "display_filter": "frame.number == 914", "timestamp_epoch": "1641571491.757908000" }, { "tcp_stream": 43, "frame_number": 945, "display_filter": "frame.number == 945", "timestamp_epoch": "1641571491.767646000" }, { "tcp_stream": 47, "frame_number": 976, "display_filter": "frame.number == 976", "timestamp_epoch": "1641571491.976783000" }, { "tcp_stream": 48, "frame_number": 988, "display_filter": "frame.number == 988", "timestamp_epoch": "1641571491.978061000" } ] }, { "id": "identity-5bd6742609b9581037c4c48a", "type": "identity", "label": "domain: SPOONWATCH", "value": "SPOONWATCH", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "domain", "frame_evidence": [ { "tcp_stream": 43, "frame_number": 914, "display_filter": "frame.number == 914", "timestamp_epoch": "1641571491.757908000" } ] }, { "id": "identity-6dae22143111db7ea808966a", "type": "identity", "label": "full-name: Steve Smith", "value": "Steve Smith", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "full-name", "frame_evidence": [ { "tcp_stream": 43, "frame_number": 945, "display_filter": "frame.number == 945", "timestamp_epoch": "1641571491.767646000" } ] }, { "id": "identity-39f8d603084a921de3d8af92", "type": "identity", "label": "hostname: DESKTOP-GXMYNO2", "value": "DESKTOP-GXMYNO2", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1641571449.195191000" }, { "udp_stream": 32, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1641571458.269061000" }, { "udp_stream": 32, "frame_number": 756, "display_filter": "frame.number == 756", "timestamp_epoch": "1641571460.439069000" }, { "udp_stream": 32, "frame_number": 757, "display_filter": "frame.number == 757", "timestamp_epoch": "1641571460.447405000" }, { "tcp_stream": 43, "frame_number": 914, "display_filter": "frame.number == 914", "timestamp_epoch": "1641571491.757908000" }, { "udp_stream": 32, "frame_number": 4898, "display_filter": "frame.number == 4898", "timestamp_epoch": "1641571941.773819000" }, { "udp_stream": 32, "frame_number": 5789, "display_filter": "frame.number == 5789", "timestamp_epoch": "1641572165.411535000" }, { "tcp_stream": 84, "frame_number": 5804, "display_filter": "frame.number == 5804", "timestamp_epoch": "1641572169.963306000" }, { "udp_stream": 32, "frame_number": 5810, "display_filter": "frame.number == 5810", "timestamp_epoch": "1641572169.966188000" }, { "udp_stream": 32, "frame_number": 5813, "display_filter": "frame.number == 5813", "timestamp_epoch": "1641572169.974570000" }, { "tcp_stream": 86, "frame_number": 5870, "display_filter": "frame.number == 5870", "timestamp_epoch": "1641572199.980643000" }, { "udp_stream": 32, "frame_number": 5876, "display_filter": "frame.number == 5876", "timestamp_epoch": "1641572199.983522000" }, { "udp_stream": 32, "frame_number": 5879, "display_filter": "frame.number == 5879", "timestamp_epoch": "1641572199.992120000" } ] }, { "id": "identity-02fbdd3de412f87f2ca963b7", "type": "identity", "label": "hostname: DESKTOP-GXNYNO2", "value": "DESKTOP-GXNYNO2", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "192.168.1.216" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 9, "frame_number": 35, "display_filter": "frame.number == 35", "timestamp_epoch": "1641571449.914853000" }, { "udp_stream": 9, "frame_number": 51, "display_filter": "frame.number == 51", "timestamp_epoch": "1641571450.508277000" }, { "udp_stream": 9, "frame_number": 367, "display_filter": "frame.number == 367", "timestamp_epoch": "1641571451.419654000" }, { "udp_stream": 9, "frame_number": 395, "display_filter": "frame.number == 395", "timestamp_epoch": "1641571452.013737000" }, { "udp_stream": 9, "frame_number": 595, "display_filter": "frame.number == 595", "timestamp_epoch": "1641571452.919844000" }, { "udp_stream": 9, "frame_number": 597, "display_filter": "frame.number == 597", "timestamp_epoch": "1641571453.529149000" }, { "udp_stream": 31, "frame_number": 604, "display_filter": "frame.number == 604", "timestamp_epoch": "1641571454.466774000" }, { "udp_stream": 31, "frame_number": 676, "display_filter": "frame.number == 676", "timestamp_epoch": "1641571455.091589000" }, { "udp_stream": 31, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1641571455.216798000" }, { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1641571455.858375000" }, { "udp_stream": 31, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1641571455.967816000" }, { "udp_stream": 31, "frame_number": 688, "display_filter": "frame.number == 688", "timestamp_epoch": "1641571456.655208000" }, { "udp_stream": 31, "frame_number": 689, "display_filter": "frame.number == 689", "timestamp_epoch": "1641571456.732270000" }, { "udp_stream": 31, "frame_number": 692, "display_filter": "frame.number == 692", "timestamp_epoch": "1641571457.421213000" } ] }, { "id": "identity-5eddb325abca3c4744cca6ba", "type": "identity", "label": "netbios-group: SPOONWATCH", "value": "SPOONWATCH", "source": "deterministic-pcap-analysis", "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [], "identity_type": "netbios-group", "frame_evidence": [ { "udp_stream": 9, "frame_number": 34, "display_filter": "frame.number == 34", "timestamp_epoch": "1641571449.914575000" }, { "udp_stream": 9, "frame_number": 366, "display_filter": "frame.number == 366", "timestamp_epoch": "1641571451.419583000" }, { "udp_stream": 9, "frame_number": 581, "display_filter": "frame.number == 581", "timestamp_epoch": "1641571452.634484000" }, { "udp_stream": 9, "frame_number": 596, "display_filter": "frame.number == 596", "timestamp_epoch": "1641571452.919945000" }, { "udp_stream": 9, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1641571454.122849000" }, { "udp_stream": 31, "frame_number": 603, "display_filter": "frame.number == 603", "timestamp_epoch": "1641571454.466709000" }, { "udp_stream": 31, "frame_number": 678, "display_filter": "frame.number == 678", "timestamp_epoch": "1641571455.217047000" }, { "udp_stream": 9, "frame_number": 684, "display_filter": "frame.number == 684", "timestamp_epoch": "1641571455.669911000" }, { "udp_stream": 31, "frame_number": 686, "display_filter": "frame.number == 686", "timestamp_epoch": "1641571455.967670000" }, { "udp_stream": 31, "frame_number": 690, "display_filter": "frame.number == 690", "timestamp_epoch": "1641571456.732412000" }, { "udp_stream": 31, "frame_number": 691, "display_filter": "frame.number == 691", "timestamp_epoch": "1641571457.280575000" }, { "udp_stream": 31, "frame_number": 693, "display_filter": "frame.number == 693", "timestamp_epoch": "1641571458.061405000" }, { "udp_stream": 31, "frame_number": 695, "display_filter": "frame.number == 695", "timestamp_epoch": "1641571458.842505000" }, { "udp_stream": 31, "frame_number": 698, "display_filter": "frame.number == 698", "timestamp_epoch": "1641571459.639695000" } ] }, { "id": "artifact-d97603f25e66cddb706fcb20", "type": "file-artifact", "label": "5(1).jpg", "value": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "sha256": "e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78", "source": "deterministic-pcap-analysis", "size_bytes": 1246160, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-ba77ea8a3332a19a181b9027", "type": "file-artifact", "label": "1(1).jpg", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "sha256": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "source": "deterministic-pcap-analysis", "size_bytes": 645592, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-8b9b0493a287d17c5f1eecc5", "type": "file-artifact", "label": "4(1).jpg", "value": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "sha256": "334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4", "source": "deterministic-pcap-analysis", "size_bytes": 440120, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-bd16fd17c273bd4649e10555", "type": "file-artifact", "label": "2(1).jpg", "value": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "sha256": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "source": "deterministic-pcap-analysis", "size_bytes": 334288, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-30b70f8f317e596afba72144", "type": "file-artifact", "label": "am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(2).exe", "value": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "sha256": "6482cf553a8dd0d2b4812ed1e4916423e9b233e77b3f73e8dcf1e1afdef0d1e9", "source": "deterministic-pcap-analysis", "size_bytes": 307632, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-3df279c0ad09da471f95cba4", "type": "file-artifact", "label": "6(1).jpg", "value": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "sha256": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "source": "deterministic-pcap-analysis", "size_bytes": 144848, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-b63db24888c4d881e4ad1cb1", "type": "file-artifact", "label": "3(1).jpg", "value": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "sha256": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "source": "deterministic-pcap-analysis", "size_bytes": 137168, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-2b220b474ce8fb1830deb524", "type": "file-artifact", "label": "7(1).jpg", "value": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "sha256": "c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d", "source": "deterministic-pcap-analysis", "size_bytes": 83784, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-c63ac0bd2578aef5d655ca36", "type": "file-artifact", "label": "osk", "value": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "sha256": "1ecee6ff37e03c1160b8bf66d5ca8dc784e0b35fb9fd105f0964b314d310c07f", "source": "deterministic-pcap-analysis", "size_bytes": 379629, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-4eba74982d2765516cf1de50", "type": "file-artifact", "label": "35969632_c422aaaf8becdd90e50fb6936708c77c7f97631f.cab", "value": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "sha256": "18180895844cba1cd9d310f04e0cfa26cff43b84eebacdc74809edf0e165d082", "source": "deterministic-pcap-analysis", "size_bytes": 10885, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-cf32cd5e7ba8303d854bb0db", "type": "file-artifact", "label": "35969516_5bcaf676a3e98426394e538836033ea5ce2bb8c3.cab", "value": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "sha256": "0cb0222fbde977f15ebc3a7d555ed658763d9a3f507b3f7869416e1b2885adf2", "source": "deterministic-pcap-analysis", "size_bytes": 7317, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-be106ab865a5b9976c83cb52", "type": "file-artifact", "label": "35969515_2975e5b79f9857b7a2d7aa07e0d43359735c8e80.cab", "value": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "sha256": "835eb064fabd072bd2aa6079f0b0949fbaf6fb677369c1a0cadcec666dbfffc7", "source": "deterministic-pcap-analysis", "size_bytes": 7313, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-d36bed8c61ca4d283e8647d0", "type": "file-artifact", "label": "1.jpg", "value": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "sha256": "7b8ab07521c24e8ec610611e7e15d2fd39336166db6509885b8500d2a2bbfb14", "source": "deterministic-pcap-analysis", "size_bytes": 25, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "image/jpeg" }, { "id": "artifact-5f9d35a4b989c4ac72ebc230", "type": "file-artifact", "label": "am_delta_patch_1.355.1569.0_f5fe52e10a18f6ce4bc39541e4aae4a97c270c81(1).exe", "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "sha256": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d", "source": "deterministic-pcap-analysis", "size_bytes": 2, "source_ref": "2022-01-07-traffic-analysis-exercise.pcap", "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d", "source_refs": [ "2022-01-07-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" } ], "evidence_edges": [], "timeline": [ { "at": "2026-09-19T12:50:08.997Z", "event": "Added Log/PCAP analysis 2022-01-07-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2022-01-07-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 1 }, { "at": "2026-09-19T12:57:57.926Z", "event": "Added Log/PCAP analysis 2022-01-07-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2022-01-07-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 1 } ], "created_at": "2026-09-19T12:50:05.686337+00:00", "updated_at": "2026-09-19T12:57:57.951896+00:00" }