{ "id": "087a87a3-97fa-4ca9-b481-e3d08ce92d90", "name": "PCAP verified workflow 2024-07-30 20260919", "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.", "status": "active", "domain": "enterprise-attack", "actor_ids": [], "technique_ids": [], "report_ids": [], "evidence_nodes": [ { "id": "log-pcap:29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "type": "log-pcap-analysis", "label": "2024-07-30-traffic-analysis-exercise.pcap", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2024-07-30-traffic-analysis-exercise.pcap\nCapture SHA-256: `c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68`\nSemantic result SHA-256: `58e5064c997e69544c60ecc184cfd57339f05da2cfc2b75e8bf8ed7582621e64`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 11562 packets across 45 IP endpoints and 199 transport flows. Observed 174 DNS events, 10 HTTP requests, 77 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 1 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 11562\n- Duration: 585.662377 seconds\n- Captured bytes: 11341372\n- Endpoints: 45\n- Flows: 199\n\n## Deterministic findings\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 194 / TCP stream 11, frame 196 / TCP stream 11, frame 198 / TCP stream 11, frame 200 / TCP stream 11, frame 663 / TCP stream 34.\n\nMetrics: `{\"destination\":\"172.16.1.66\",\"event_count\":33,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.1.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 44 / TCP stream 0, frame 45 / TCP stream 0, frame 49 / TCP stream 1, frame 50 / TCP stream 1, frame 136 / TCP stream 1.\n\nMetrics: `{\"destination\":\"172.16.1.66\",\"event_count\":87,\"operation_numbers\":[\"\",\"1\",\"4\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"172.16.1.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1056 / TCP stream 21, frame 1058 / TCP stream 21, frame 1060 / TCP stream 21, frame 1062 / TCP stream 21, frame 1064 / TCP stream 21.\n\nMetrics: `{\"destination\":\"172.16.1.66\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.1.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 193 / TCP stream 11, frame 195 / TCP stream 11, frame 197 / TCP stream 11, frame 199 / TCP stream 11, frame 662 / TCP stream 34.\n\nMetrics: `{\"destination\":\"172.16.1.4\",\"event_count\":33,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.1.66\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 42 / TCP stream 0, frame 46 / TCP stream 1, frame 128 / TCP stream 5, frame 130 / TCP stream 1, frame 133 / TCP stream 0.\n\nMetrics: `{\"destination\":\"172.16.1.4\",\"event_count\":99,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"172.16.1.66\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1055 / TCP stream 21, frame 1057 / TCP stream 21, frame 1059 / TCP stream 21, frame 1061 / TCP stream 21, frame 1063 / TCP stream 21.\n\nMetrics: `{\"destination\":\"172.16.1.4\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.1.66\"}`\n\n### HIGH — Client announces a software label and host identity\n\nAn otherwise unclassified TCP payload contains a structured ping, software label, client identifier, hostname and account. These are literal self-reported values, not authenticated identity or independent malware-family attribution.\n\nRule: `cleartext-tool-self-identification@pcap-rules-v3`; confidence: 0.98; evidence: frame 9119 / TCP stream 83, frame 9352 / TCP stream 83, frame 9530 / TCP stream 83, frame 9537 / TCP stream 83, frame 9563 / TCP stream 83.\n\nMetrics: `{\"claimed_account\":\"ccollier\",\"claimed_hostname\":\"DESKTOP-SKBR25F\",\"client_id\":\"1BE8292C\",\"destination\":\"141.98.10.79\",\"destination_port\":12132,\"message_count\":102,\"software_label\":\"STRRAT\",\"source\":\"172.16.1.66\"}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 9066 / TCP stream 83.\n\nMetrics: `{\"destination\":\"141.98.10.79\",\"destination_port\":12132,\"duration_seconds\":508.67,\"packets\":411,\"source\":\"172.16.1.66\",\"wire_bytes\":39064}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `ccollier`; client IPs: 172.16.1.66; frames: 913, 921, 923, 935, 956\n- account: `desktop-skbr25f$`; client IPs: 172.16.1.66; frames: 58, 59, 71, 73, 84\n- domain: `WIRESHARKWORKSH`; client IPs: 172.16.1.66; frames: 275\n- full-name: `Clark Collier`; client IPs: 172.16.1.66; frames: 1070\n- hostname: `DESKTOP-SKBR25F`; client IPs: 172.16.1.66; frames: 29, 30, 275, 499, 500\n- netbios-group: `WIRESHARKWORKSH`; client IPs: unbound subject; frames: 31, 501, 615, 616, 624\n\n## IOC and artifact candidates\n\n- domain: `a1834.dscg2.akamai.net`; roles: dns-cname\n- domain: `api-msn-com.a-0003.a-msedge.net`; roles: dns-cname\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `arc.msn.com`; roles: dns-query, tls-sni\n- domain: `assets.msn.com`; roles: dns-query, tls-sni\n- domain: `autodiscover-s.outlook.com`; roles: dns-query, tls-sni\n- domain: `autodiscover.wiresharkworkshop.online`; roles: dns-query\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `config.edge.skype.com`; roles: dns-query, tls-sni\n- domain: `default.exp-tas.com`; roles: dns-query, tls-sni\n- domain: `desktop-skbr25f.wiresharkworkshop.online`; roles: dns-query\n- domain: `dualstack.sonatype.map.fastly.net`; roles: dns-cname\n- domain: `ecn.dev.virtualearth.net`; roles: dns-query, tls-sni\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `fd.api.iris.microsoft.com`; roles: dns-query\n- domain: `g.live.com`; roles: dns-query, tls-sni\n- domain: `github.com`; roles: dns-query, tls-sni\n- domain: `go.microsoft.com`; roles: dns-query, tls-sni\n- domain: `img-s-msn-com.akamaized.net`; roles: dns-query, tls-sni\n- domain: `ip-api.com`; roles: dns-query, http-host\n- domain: `javadl-esd-secure.oracle.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `metadata.templates.cdn.office.net`; roles: dns-query, tls-sni\n- domain: `mobile.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `msedge.api.cdp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `objects.githubusercontent.com`; roles: dns-query, tls-sni\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `officeclient.microsoft.com`; roles: dns-query, tls-sni\n- domain: `oneclient.sfx.ms`; roles: dns-query, tls-sni\n- domain: `pti.store.microsoft.com`; roles: dns-query\n- domain: `repo1.maven.org`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `srtb.msn.com`; roles: dns-query, tls-sni\n- domain: `th.bing.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `windows.msn.com`; roles: dns-query, tls-sni\n- domain: `wireshark-ws-dc.wiresharkworkshop.online`; roles: dns-query\n- domain: `wiresharkworkshop.online`; roles: dns-query\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.wiresharkworkshop.online`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.msftconnecttest.com`; roles: dns-query, http-host\n- domain: `www.msn.com`; roles: dns-query, tls-sni\n- ipv4: `13.107.42.16`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.93`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.239.79`; roles: dns-answer, network-endpoint\n- ipv4: `140.82.113.3`; roles: dns-answer, network-endpoint\n- ipv4: `141.98.10.79`; roles: network-endpoint\n- ipv4: `172.16.1.255`; roles: network-endpoint\n- ipv4: `172.16.1.4`; roles: dns-answer, network-endpoint\n- ipv4: `172.16.1.66`; roles: dns-answer, network-endpoint\n- ipv4: `185.199.108.133`; roles: dns-answer\n- ipv4: `185.199.109.133`; roles: dns-answer\n- ipv4: `185.199.110.133`; roles: dns-answer, network-endpoint\n- ipv4: `185.199.111.133`; roles: dns-answer\n- ipv4: `199.232.192.209`; roles: dns-answer\n- ipv4: `199.232.196.209`; roles: dns-answer, network-endpoint\n- ipv4: `20.166.2.191`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.10`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.16`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.26`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.157.11`; roles: dns-answer\n- ipv4: `20.190.157.9`; roles: dns-answer\n- ipv4: `20.241.44.114`; roles: dns-answer, network-endpoint\n- ipv4: `20.7.1.246`; roles: network-endpoint\n- ipv4: `20.7.2.167`; roles: dns-answer, network-endpoint\n- ipv4: `20.96.153.111`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `208.95.112.1`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.194.164.136`; roles: dns-answer, network-endpoint\n- ipv4: `23.198.7.167`; roles: dns-answer\n- ipv4: `23.198.7.168`; roles: dns-answer, network-endpoint\n- ipv4: `23.198.7.169`; roles: dns-answer\n- ipv4: `23.198.7.170`; roles: dns-answer\n- ipv4: `23.198.7.172`; roles: dns-answer\n- ipv4: `23.198.7.173`; roles: dns-answer\n- ipv4: `23.198.7.174`; roles: dns-answer\n- ipv4: `23.198.7.175`; roles: dns-answer, network-endpoint\n- ipv4: `23.198.7.176`; roles: dns-answer\n- ipv4: `23.198.7.177`; roles: dns-answer, network-endpoint\n- ipv4: `23.198.7.182`; roles: dns-answer\n- ipv4: `23.198.7.183`; roles: dns-answer\n- ipv4: `23.198.7.186`; roles: dns-answer\n- ipv4: `23.215.55.133`; roles: dns-answer, network-endpoint\n- ipv4: `23.215.55.137`; roles: dns-answer\n- ipv4: `23.215.55.140`; roles: dns-answer, network-endpoint\n- ipv4: `23.215.55.144`; roles: dns-answer\n- ipv4: `23.221.22.68`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.22.87`; roles: dns-answer\n- ipv4: `23.46.192.165`; roles: dns-answer, network-endpoint\n- ipv4: `23.48.203.199`; roles: dns-answer\n- ipv4: `23.48.203.200`; roles: dns-answer\n- ipv4: `23.48.203.201`; roles: dns-answer\n- ipv4: `23.48.203.203`; roles: dns-answer, network-endpoint\n- ipv4: `23.48.203.204`; roles: dns-answer\n- ipv4: `23.48.203.205`; roles: dns-answer\n- ipv4: `23.48.203.206`; roles: dns-answer\n- ipv4: `23.48.203.207`; roles: dns-answer\n- ipv4: `23.48.203.208`; roles: dns-answer, network-endpoint\n- ipv4: `23.48.203.210`; roles: dns-answer\n- ipv4: `23.52.9.140`; roles: dns-answer, network-endpoint\n- ipv4: `23.52.9.222`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.11.164`; roles: dns-answer\n- ipv4: `23.53.11.165`; roles: dns-answer\n- ipv4: `23.53.11.166`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.11.174`; roles: dns-answer\n- ipv4: `23.53.11.175`; roles: dns-answer\n- ipv4: `23.53.11.176`; roles: dns-answer\n- ipv4: `23.53.11.177`; roles: dns-answer\n- ipv4: `23.53.11.178`; roles: dns-answer\n- ipv4: `23.53.11.179`; roles: dns-answer\n- ipv4: `23.96.180.189`; roles: dns-answer\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `40.126.29.11`; roles: dns-answer\n- ipv4: `40.126.29.13`; roles: dns-answer\n- ipv4: `40.126.29.14`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.5`; roles: dns-answer\n- ipv4: `40.126.29.7`; roles: dns-answer\n- ipv4: `40.126.29.8`; roles: dns-answer\n- ipv4: `40.97.199.114`; roles: dns-answer, network-endpoint\n- ipv4: `40.99.169.130`; roles: dns-answer\n- ipv4: `52.109.0.142`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.0.91`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.47`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.6.53`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.191.219.104`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.121.130`; roles: dns-answer\n- ipv4: `52.96.57.2`; roles: dns-answer\n- ja3: `026e5ca865ce1f09da3a81d8a4e3effb`; roles: tls-client-fingerprint\n- ja3: `091f51a7a1c3a4504a224cc081ce9cee`; roles: tls-client-fingerprint\n- ja3: `1541459f873df5079e5cf7ff2c951ca0`; roles: tls-client-fingerprint\n- ja3: `17e7f892bd0cb5409482f240c9ca2934`; roles: tls-client-fingerprint\n- ja3: `1968767952a7e119234b43165830caaf`; roles: tls-client-fingerprint\n- ja3: `258a5a1e95b8a911872bae9081526644`; roles: tls-client-fingerprint\n- ja3: `292a36e182b3281950ca910a639428ec`; roles: tls-client-fingerprint\n- ja3: `3c293bdf2a25c07559b560ba86debc77`; roles: tls-client-fingerprint\n- ja3: `3c4eb72b882d4d1442c67ce73f1292a9`; roles: tls-client-fingerprint\n- ja3: `46f5131e766d248db0248a86c494b71c`; roles: tls-client-fingerprint\n- ja3: `54e118fb6c893793f9955efcc86a6132`; roles: tls-client-fingerprint\n- ja3: `65005c9d9ae0f0ebeaf22c210571d482`; roles: tls-client-fingerprint\n- ja3: `6764675c1ca709250abb58a1ed36b1a9`; roles: tls-client-fingerprint\n- ja3: `6a5d235ee78c6aede6a61448b4e9ff1e`; roles: tls-client-fingerprint\n- ja3: `6d162fd4fcafeafc279a32732bb583ab`; roles: tls-client-fingerprint\n- ja3: `7dcea60ae4f829abcfa00bd64ab6f937`; roles: tls-client-fingerprint\n- ja3: `930a922a3aeaa3a5590435675e8a4bb9`; roles: tls-client-fingerprint\n- sha256: `47729774d301b648e888dee3b5e215d63adabb069700e1d81671fcbdfb80e4bb`; roles: exported-object\n- sha256: `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://ip-api.com/json/`; roles: http-request\n- url: `http://www.msftconnecttest.com/connecttest.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36`; roles: http-client\n- exported object `json`; SHA-256 `47729774d301b648e888dee3b5e215d63adabb069700e1d81671fcbdfb80e4bb`; size 294 bytes\n- exported object `connecttest.txt`; SHA-256 `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; size 22 bytes\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `32e9d5fcf77c5a465a8b3ffc21d77a172a52a6eb0c40ad986ced99d0994dd0d3`; recorded 2026-09-19T12:09:03.146463+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":157,\"observable_limit\":5000,\"observables_checked\":157,\"observables_total\":157,\"prior_case_limit_reached\":false,\"prior_cases_checked\":9,\"truncated\":false}`\n\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 45 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 33 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 33 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 27 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 31 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 48 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":2,\"exported_objects\":2,\"hashed_bytes\":316,\"hashed_objects\":2,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":2,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":2}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 6/6, observables 157/157, artifacts 2/2. Full returned inventory is in the JSON result.\n", "summary": "Decoded 11562 packets across 45 IP endpoints and 199 transport flows. Observed 174 DNS events, 10 HTTP requests, 77 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 1 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net", "confidence": 1, "description": "dns-cname; frame 10959 / UDP stream 39, frame 10972 / UDP stream 40" }, { "type": "domain", "value": "api-msn-com.a-0003.a-msedge.net", "confidence": 1, "description": "dns-cname; frame 10886 / UDP stream 32" }, { "type": "domain", "value": "api.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 10882 / UDP stream 31, frame 10883 / UDP stream 32, frame 10886 / UDP stream 32, frame 10887 / UDP stream 31, frame 10896 / TCP stream 143 +1 more" }, { "type": "domain", "value": "arc.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1173 / UDP stream 12, frame 1176 / UDP stream 12, frame 1190 / TCP stream 61" }, { "type": "domain", "value": "assets.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1232 / UDP stream 17, frame 1255 / UDP stream 17, frame 1415 / UDP stream 17, frame 1448 / UDP stream 17, frame 1514 / UDP stream 17 +13 more" }, { "type": "domain", "value": "autodiscover-s.outlook.com", "confidence": 1, "description": "dns-query, tls-sni; frame 10277 / UDP stream 25, frame 10278 / UDP stream 25, frame 10282 / TCP stream 124" }, { "type": "domain", "value": "autodiscover.wiresharkworkshop.online", "confidence": 1, "description": "dns-query; frame 10334 / UDP stream 25, frame 10335 / UDP stream 25" }, { "type": "domain", "value": "client.wns.windows.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1231 / UDP stream 12, frame 1233 / UDP stream 12, frame 1356 / UDP stream 12, frame 1447 / UDP stream 12, frame 1504 / UDP stream 12 +3 more" }, { "type": "domain", "value": "config.edge.skype.com", "confidence": 1, "description": "dns-query, tls-sni; frame 9807 / UDP stream 23, frame 9808 / UDP stream 23, frame 9812 / TCP stream 113, frame 9815 / TCP stream 113" }, { "type": "domain", "value": "default.exp-tas.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1664 / UDP stream 18, frame 1665 / UDP stream 18, frame 1671 / TCP stream 72, frame 1676 / TCP stream 72" }, { "type": "domain", "value": "desktop-skbr25f.wiresharkworkshop.online", "confidence": 1, "description": "dns-query; frame 674 / UDP stream 12, frame 675 / UDP stream 12" }, { "type": "domain", "value": "dualstack.sonatype.map.fastly.net", "confidence": 1, "description": "dns-cname; frame 2509 / UDP stream 19" }, { "type": "domain", "value": "ecn.dev.virtualearth.net", "confidence": 1, "description": "dns-query, tls-sni; frame 11000 / UDP stream 41, frame 11001 / UDP stream 42, frame 11031 / UDP stream 41, frame 11039 / UDP stream 42, frame 11040 / UDP stream 42 +1 more" }, { "type": "domain", "value": "ecs.office.com", "confidence": 1, "description": "dns-query, tls-sni; frame 10131 / UDP stream 25, frame 10132 / UDP stream 25, frame 10141 / TCP stream 119" }, { "type": "domain", "value": "fd.api.iris.microsoft.com", "confidence": 1, "description": "dns-query; frame 9777 / UDP stream 18, frame 9803 / UDP stream 18, frame 9845 / UDP stream 18, frame 9850 / UDP stream 18, frame 9851 / UDP stream 18" }, { "type": "domain", "value": "g.live.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1449 / UDP stream 18, frame 1453 / UDP stream 18, frame 1459 / TCP stream 67" }, { "type": "domain", "value": "github.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1826 / UDP stream 18, frame 1828 / UDP stream 18, frame 1832 / TCP stream 78" }, { "type": "domain", "value": "go.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 626 / UDP stream 6, frame 672 / UDP stream 6, frame 680 / UDP stream 6, frame 683 / UDP stream 6, frame 684 / UDP stream 6 +11 more" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net", "confidence": 1, "description": "dns-query, tls-sni; frame 10951 / UDP stream 39, frame 10952 / UDP stream 40, frame 10959 / UDP stream 39, frame 10972 / UDP stream 40, frame 10983 / TCP stream 148" }, { "type": "domain", "value": "ip-api.com", "confidence": 1, "description": "dns-query, http-host; frame 9106 / UDP stream 18, frame 9107 / UDP stream 18, frame 9111 / TCP stream 84" }, { "type": "domain", "value": "javadl-esd-secure.oracle.com", "confidence": 1, "description": "dns-query, tls-sni; frame 11231 / UDP stream 25, frame 11232 / UDP stream 25, frame 11233 / UDP stream 25, frame 11237 / TCP stream 150" }, { "type": "domain", "value": "login.microsoftonline.com", "confidence": 1, "description": "dns-query, tls-sni; frame 9500 / UDP stream 18, frame 9501 / UDP stream 18, frame 9505 / TCP stream 100, frame 9509 / TCP stream 100, frame 9705 / TCP stream 108 +1 more" }, { "type": "domain", "value": "metadata.templates.cdn.office.net", "confidence": 1, "description": "dns-query, tls-sni; frame 10419 / UDP stream 25, frame 10420 / UDP stream 25, frame 10424 / TCP stream 132" }, { "type": "domain", "value": "mobile.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 235 / UDP stream 6, frame 239 / UDP stream 6, frame 10336 / UDP stream 23, frame 10337 / UDP stream 23, frame 10338 / UDP stream 23 +5 more" }, { "type": "domain", "value": "msedge.api.cdp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 9778 / UDP stream 23, frame 9779 / UDP stream 23, frame 9783 / TCP stream 112" }, { "type": "domain", "value": "objects.githubusercontent.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1855 / UDP stream 18, frame 1856 / UDP stream 18, frame 1862 / TCP stream 79" }, { "type": "domain", "value": "odc.officeapps.live.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1402 / UDP stream 19, frame 1413 / UDP stream 19, frame 10130 / UDP stream 23, frame 10134 / UDP stream 23, frame 1418 / TCP stream 65 +5 more" }, { "type": "domain", "value": "officeclient.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1239 / UDP stream 18, frame 1252 / UDP stream 18, frame 10061 / UDP stream 23, frame 10080 / UDP stream 23, frame 1298 / TCP stream 63 +1 more" }, { "type": "domain", "value": "oneclient.sfx.ms", "confidence": 1, "description": "dns-query, tls-sni; frame 1493 / UDP stream 19, frame 1494 / UDP stream 19, frame 1498 / TCP stream 68" }, { "type": "domain", "value": "pti.store.microsoft.com", "confidence": 1, "description": "dns-query; frame 11474 / UDP stream 43, frame 11475 / UDP stream 43, frame 11476 / UDP stream 43" }, { "type": "domain", "value": "repo1.maven.org", "confidence": 1, "description": "dns-query, tls-sni; frame 1827 / UDP stream 19, frame 1874 / UDP stream 19, frame 2507 / UDP stream 19, frame 2508 / UDP stream 19, frame 2509 / UDP stream 19 +3 more" }, { "type": "domain", "value": "settings-win.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 9162 / UDP stream 18, frame 9163 / UDP stream 18, frame 9167 / TCP stream 85" }, { "type": "domain", "value": "srtb.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 10909 / UDP stream 35, frame 10910 / UDP stream 36, frame 10911 / UDP stream 35, frame 10912 / UDP stream 36, frame 10940 / TCP stream 146 +1 more" }, { "type": "domain", "value": "th.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 9177 / UDP stream 18, frame 9189 / UDP stream 18, frame 10949 / UDP stream 37, frame 10950 / UDP stream 38, frame 10957 / UDP stream 38 +8 more" }, { "type": "domain", "value": "v10.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 10448 / UDP stream 25, frame 10449 / UDP stream 25, frame 10453 / TCP stream 133" }, { "type": "domain", "value": "v20.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1157 / UDP stream 12, frame 1158 / UDP stream 12, frame 1162 / TCP stream 59" }, { "type": "domain", "value": "windows.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 10768 / UDP stream 27, frame 10769 / UDP stream 28, frame 10770 / UDP stream 27, frame 10773 / UDP stream 28, frame 10774 / UDP stream 28 +4 more" }, { "type": "domain", "value": "wireshark-ws-dc.wiresharkworkshop.online", "confidence": 1, "description": "dns-query; frame 14 / UDP stream 1, frame 15 / UDP stream 1, frame 201 / UDP stream 6, frame 202 / UDP stream 6" }, { "type": "domain", "value": "wiresharkworkshop.online", "confidence": 1, "description": "dns-query; frame 254 / UDP stream 6, frame 255 / UDP stream 6, frame 676 / UDP stream 12, frame 677 / UDP stream 12" }, { "type": "domain", "value": "wns.notify.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 1504 / UDP stream 12, frame 1512 / UDP stream 9" }, { "type": "domain", "value": "wpad.wiresharkworkshop.online", "confidence": 1, "description": "dns-query; frame 293 / UDP stream 10, frame 294 / UDP stream 10, frame 532 / UDP stream 11, frame 533 / UDP stream 11, frame 906 / UDP stream 10 +11 more" }, { "type": "domain", "value": "www.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1125 / UDP stream 12, frame 1127 / UDP stream 12, frame 1131 / TCP stream 58, frame 1237 / TCP stream 62" }, { "type": "domain", "value": "www.msftconnecttest.com", "confidence": 1, "description": "dns-query, http-host; frame 292 / UDP stream 9, frame 433 / UDP stream 9, frame 466 / TCP stream 24" }, { "type": "domain", "value": "www.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1253 / UDP stream 19, frame 1254 / UDP stream 19, frame 10813 / UDP stream 29, frame 10814 / UDP stream 30, frame 10815 / UDP stream 30 +5 more" }, { "type": "ipv4", "value": "13.107.42.16", "confidence": 1, "description": "dns-answer, network-endpoint; frame 9808 / UDP stream 23" }, { "type": "ipv4", "value": "13.107.5.93", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1665 / UDP stream 18" }, { "type": "ipv4", "value": "13.69.239.79", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1158 / UDP stream 12" }, { "type": "ipv4", "value": "140.82.113.3", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1828 / UDP stream 18" }, { "type": "ipv4", "value": "141.98.10.79", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "172.16.1.255", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "172.16.1.4", "confidence": 1, "description": "dns-answer, network-endpoint; frame 13 / UDP stream 1, frame 15 / UDP stream 1, frame 33 / UDP stream 5, frame 202 / UDP stream 6, frame 231 / UDP stream 6 +6 more" }, { "type": "ipv4", "value": "172.16.1.66", "confidence": 1, "description": "dns-answer, network-endpoint; frame 676 / UDP stream 12, frame 677 / UDP stream 12" }, { "type": "ipv4", "value": "185.199.108.133", "confidence": 1, "description": "dns-answer; frame 1856 / UDP stream 18" }, { "type": "ipv4", "value": "185.199.109.133", "confidence": 1, "description": "dns-answer; frame 1856 / UDP stream 18" }, { "type": "ipv4", "value": "185.199.110.133", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1856 / UDP stream 18" }, { "type": "ipv4", "value": "185.199.111.133", "confidence": 1, "description": "dns-answer; frame 1856 / UDP stream 18" }, { "type": "ipv4", "value": "199.232.192.209", "confidence": 1, "description": "dns-answer; frame 2509 / UDP stream 19" }, { "type": "ipv4", "value": "199.232.196.209", "confidence": 1, "description": "dns-answer, network-endpoint; frame 2509 / UDP stream 19" }, { "type": "ipv4", "value": "20.166.2.191", "confidence": 1, "description": "dns-answer, network-endpoint; frame 9779 / UDP stream 23" }, { "type": "ipv4", "value": "20.189.173.10", "confidence": 1, "description": "dns-answer, network-endpoint; frame 10345 / UDP stream 23" }, { "type": "ipv4", "value": "20.189.173.16", "confidence": 1, "description": "dns-answer, network-endpoint; frame 239 / UDP stream 6" }, { "type": "ipv4", "value": "20.189.173.26", "confidence": 1, "description": "dns-answer, network-endpoint; frame 10449 / UDP stream 25" }, { "type": "ipv4", "value": "20.190.157.11", "confidence": 1, "description": "dns-answer; frame 9501 / UDP stream 18" }, { "type": "ipv4", "value": "20.190.157.9", "confidence": 1, "description": "dns-answer; frame 9501 / UDP stream 18" }, { "type": "ipv4", "value": "20.241.44.114", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1453 / UDP stream 18" }, { "type": "ipv4", "value": "20.7.1.246", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "20.7.2.167", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1512 / UDP stream 9" }, { "type": "ipv4", "value": "20.96.153.111", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1176 / UDP stream 12" }, { "type": "ipv4", "value": "204.79.197.203", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1254 / UDP stream 19, frame 10770 / UDP stream 27, frame 10816 / UDP stream 29, frame 10887 / UDP stream 31, frame 10911 / UDP stream 35" }, { "type": "ipv4", "value": "208.95.112.1", "confidence": 1, "description": "dns-answer, network-endpoint; frame 9107 / UDP stream 18" }, { "type": "ipv4", "value": "224.0.0.22", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "224.0.0.251", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "224.0.0.252", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "23.194.164.136", "confidence": 1, "description": "dns-answer, network-endpoint; frame 11233 / UDP stream 25" }, { "type": "ipv4", "value": "23.198.7.167", "confidence": 1, "description": "dns-answer; frame 1127 / UDP stream 12, frame 10958 / UDP stream 37" }, { "type": "ipv4", "value": "23.198.7.168", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37" }, { "type": "ipv4", "value": "23.198.7.169", "confidence": 1, "description": "dns-answer; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37" }, { "type": "ipv4", "value": "23.198.7.170", "confidence": 1, "description": "dns-answer; frame 9189 / UDP stream 18, frame 10958 / UDP stream 37" }, { "type": "ipv4", "value": "23.198.7.172", "confidence": 1, "description": "dns-answer; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37" }, { "type": "ipv4", "value": "23.198.7.173", "confidence": 1, "description": "dns-answer; frame 1127 / UDP stream 12" }, { "type": "ipv4", "value": "23.198.7.174", "confidence": 1, "description": "dns-answer; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37" }, { "type": "ipv4", "value": "23.198.7.175", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37" }, { "type": "ipv4", "value": "23.198.7.176", "confidence": 1, "description": "dns-answer; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18" }, { "type": "ipv4", "value": "23.198.7.177", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18" }, { "type": "ipv4", "value": "23.198.7.182", "confidence": 1, "description": "dns-answer; frame 10958 / UDP stream 37" }, { "type": "ipv4", "value": "23.198.7.183", "confidence": 1, "description": "dns-answer; frame 10958 / UDP stream 37" }, { "type": "ipv4", "value": "23.198.7.186", "confidence": 1, "description": "dns-answer; frame 9189 / UDP stream 18" }, { "type": "ipv4", "value": "23.215.55.133", "confidence": 1, "description": "dns-answer, network-endpoint; frame 10959 / UDP stream 39" }, { "type": "ipv4", "value": "23.215.55.137", "confidence": 1, "description": "dns-answer; frame 10959 / UDP stream 39" }, { "type": "ipv4", "value": "23.215.55.140", "confidence": 1, "description": "dns-answer, network-endpoint; frame 433 / UDP stream 9" }, { "type": "ipv4", "value": "23.215.55.144", "confidence": 1, "description": "dns-answer; frame 433 / UDP stream 9" }, { "type": "ipv4", "value": "23.221.22.68", "confidence": 1, "description": "dns-answer, network-endpoint; frame 10420 / UDP stream 25" }, { "type": "ipv4", "value": "23.221.22.87", "confidence": 1, "description": "dns-answer; frame 10420 / UDP stream 25" }, { "type": "ipv4", "value": "23.46.192.165", "confidence": 1, "description": "dns-answer, network-endpoint; frame 11031 / UDP stream 41" }, { "type": "ipv4", "value": "23.48.203.199", "confidence": 1, "description": "dns-answer; frame 1514 / UDP stream 17" }, { "type": "ipv4", "value": "23.48.203.200", "confidence": 1, "description": "dns-answer; frame 1514 / UDP stream 17" }, { "type": "ipv4", "value": "23.48.203.201", "confidence": 1, "description": "dns-answer; frame 1514 / UDP stream 17" }, { "type": "ipv4", "value": "23.48.203.203", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1514 / UDP stream 17, frame 9540 / UDP stream 18" }, { "type": "ipv4", "value": "23.48.203.204", "confidence": 1, "description": "dns-answer; frame 1514 / UDP stream 17" }, { "type": "ipv4", "value": "23.48.203.205", "confidence": 1, "description": "dns-answer; frame 1514 / UDP stream 17, frame 9540 / UDP stream 18" } ], "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap" ], "source_sha256": "c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68", "semantic_sha256": "58e5064c997e69544c60ecc184cfd57339f05da2cfc2b75e8bf8ed7582621e64", "observable_count": 157, "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis", "source_analysis_ref": "/api/pcap/analyses/29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "suspicious_findings": [ { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 194 / TCP stream 11, frame 196 / TCP stream 11, frame 198 / TCP stream 11, frame 200 / TCP stream 11, frame 663 / TCP stream 34 +28 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 44 / TCP stream 0, frame 45 / TCP stream 0, frame 49 / TCP stream 1, frame 50 / TCP stream 1, frame 136 / TCP stream 1 +82 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 1056 / TCP stream 21, frame 1058 / TCP stream 21, frame 1060 / TCP stream 21, frame 1062 / TCP stream 21, frame 1064 / TCP stream 21 +10 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 193 / TCP stream 11, frame 195 / TCP stream 11, frame 197 / TCP stream 11, frame 199 / TCP stream 11, frame 662 / TCP stream 34 +28 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 42 / TCP stream 0, frame 46 / TCP stream 1, frame 128 / TCP stream 5, frame 130 / TCP stream 1, frame 133 / TCP stream 0 +94 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 1055 / TCP stream 21, frame 1057 / TCP stream 21, frame 1059 / TCP stream 21, frame 1061 / TCP stream 21, frame 1063 / TCP stream 21 +10 more", "severity": "low" }, { "reason": "An otherwise unclassified TCP payload contains a structured ping, software label, client identifier, hostname and account. These are literal self-reported values, not authenticated identity or independent malware-family attribution. Rule cleartext-tool-self-identification@pcap-rules-v3; confidence 98%.", "category": "Client announces a software label and host identity", "evidence": "frame 9119 / TCP stream 83, frame 9352 / TCP stream 83, frame 9530 / TCP stream 83, frame 9537 / TCP stream 83, frame 9563 / TCP stream 83 +95 more", "severity": "high" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 9066 / TCP stream 83", "severity": "medium" } ], "observables_truncated": true, "actor_similarity_leads": [], "expected_suspicious_behaviors": [] }, { "id": "ioc:a1834.dscg2.akamai.net", "type": "ioc", "value": "a1834.dscg2.akamai.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-cname; frame 10959 / UDP stream 39, frame 10972 / UDP stream 40", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:api-msn-com.a-0003.a-msedge.net", "type": "ioc", "value": "api-msn-com.a-0003.a-msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-cname; frame 10886 / UDP stream 32", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:api.msn.com", "type": "ioc", "value": "api.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 10882 / UDP stream 31, frame 10883 / UDP stream 32, frame 10886 / UDP stream 32, frame 10887 / UDP stream 31, frame 10896 / TCP stream 143 +1 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:arc.msn.com", "type": "ioc", "value": "arc.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1173 / UDP stream 12, frame 1176 / UDP stream 12, frame 1190 / TCP stream 61", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:assets.msn.com", "type": "ioc", "value": "assets.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1232 / UDP stream 17, frame 1255 / UDP stream 17, frame 1415 / UDP stream 17, frame 1448 / UDP stream 17, frame 1514 / UDP stream 17 +13 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:autodiscover-s.outlook.com", "type": "ioc", "value": "autodiscover-s.outlook.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 10277 / UDP stream 25, frame 10278 / UDP stream 25, frame 10282 / TCP stream 124", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:autodiscover.wiresharkworkshop.online", "type": "ioc", "value": "autodiscover.wiresharkworkshop.online", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query; frame 10334 / UDP stream 25, frame 10335 / UDP stream 25", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:client.wns.windows.com", "type": "ioc", "value": "client.wns.windows.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1231 / UDP stream 12, frame 1233 / UDP stream 12, frame 1356 / UDP stream 12, frame 1447 / UDP stream 12, frame 1504 / UDP stream 12 +3 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:config.edge.skype.com", "type": "ioc", "value": "config.edge.skype.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 9807 / UDP stream 23, frame 9808 / UDP stream 23, frame 9812 / TCP stream 113, frame 9815 / TCP stream 113", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:default.exp-tas.com", "type": "ioc", "value": "default.exp-tas.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1664 / UDP stream 18, frame 1665 / UDP stream 18, frame 1671 / TCP stream 72, frame 1676 / TCP stream 72", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:desktop-skbr25f.wiresharkworkshop.online", "type": "ioc", "value": "desktop-skbr25f.wiresharkworkshop.online", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query; frame 674 / UDP stream 12, frame 675 / UDP stream 12", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:dualstack.sonatype.map.fastly.net", "type": "ioc", "value": "dualstack.sonatype.map.fastly.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-cname; frame 2509 / UDP stream 19", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ecn.dev.virtualearth.net", "type": "ioc", "value": "ecn.dev.virtualearth.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 11000 / UDP stream 41, frame 11001 / UDP stream 42, frame 11031 / UDP stream 41, frame 11039 / UDP stream 42, frame 11040 / UDP stream 42 +1 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ecs.office.com", "type": "ioc", "value": "ecs.office.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 10131 / UDP stream 25, frame 10132 / UDP stream 25, frame 10141 / TCP stream 119", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fd.api.iris.microsoft.com", "type": "ioc", "value": "fd.api.iris.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query; frame 9777 / UDP stream 18, frame 9803 / UDP stream 18, frame 9845 / UDP stream 18, frame 9850 / UDP stream 18, frame 9851 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:g.live.com", "type": "ioc", "value": "g.live.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1449 / UDP stream 18, frame 1453 / UDP stream 18, frame 1459 / TCP stream 67", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:github.com", "type": "ioc", "value": "github.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1826 / UDP stream 18, frame 1828 / UDP stream 18, frame 1832 / TCP stream 78", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:go.microsoft.com", "type": "ioc", "value": "go.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 626 / UDP stream 6, frame 672 / UDP stream 6, frame 680 / UDP stream 6, frame 683 / UDP stream 6, frame 684 / UDP stream 6 +11 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:img-s-msn-com.akamaized.net", "type": "ioc", "value": "img-s-msn-com.akamaized.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 10951 / UDP stream 39, frame 10952 / UDP stream 40, frame 10959 / UDP stream 39, frame 10972 / UDP stream 40, frame 10983 / TCP stream 148", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ip-api.com", "type": "ioc", "value": "ip-api.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, http-host; frame 9106 / UDP stream 18, frame 9107 / UDP stream 18, frame 9111 / TCP stream 84", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:javadl-esd-secure.oracle.com", "type": "ioc", "value": "javadl-esd-secure.oracle.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 11231 / UDP stream 25, frame 11232 / UDP stream 25, frame 11233 / UDP stream 25, frame 11237 / TCP stream 150", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:login.microsoftonline.com", "type": "ioc", "value": "login.microsoftonline.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 9500 / UDP stream 18, frame 9501 / UDP stream 18, frame 9505 / TCP stream 100, frame 9509 / TCP stream 100, frame 9705 / TCP stream 108 +1 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:metadata.templates.cdn.office.net", "type": "ioc", "value": "metadata.templates.cdn.office.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 10419 / UDP stream 25, frame 10420 / UDP stream 25, frame 10424 / TCP stream 132", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mobile.events.data.microsoft.com", "type": "ioc", "value": "mobile.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 235 / UDP stream 6, frame 239 / UDP stream 6, frame 10336 / UDP stream 23, frame 10337 / UDP stream 23, frame 10338 / UDP stream 23 +5 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:msedge.api.cdp.microsoft.com", "type": "ioc", "value": "msedge.api.cdp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 9778 / UDP stream 23, frame 9779 / UDP stream 23, frame 9783 / TCP stream 112", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:objects.githubusercontent.com", "type": "ioc", "value": "objects.githubusercontent.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1855 / UDP stream 18, frame 1856 / UDP stream 18, frame 1862 / TCP stream 79", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:odc.officeapps.live.com", "type": "ioc", "value": "odc.officeapps.live.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1402 / UDP stream 19, frame 1413 / UDP stream 19, frame 10130 / UDP stream 23, frame 10134 / UDP stream 23, frame 1418 / TCP stream 65 +5 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:officeclient.microsoft.com", "type": "ioc", "value": "officeclient.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1239 / UDP stream 18, frame 1252 / UDP stream 18, frame 10061 / UDP stream 23, frame 10080 / UDP stream 23, frame 1298 / TCP stream 63 +1 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:oneclient.sfx.ms", "type": "ioc", "value": "oneclient.sfx.ms", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1493 / UDP stream 19, frame 1494 / UDP stream 19, frame 1498 / TCP stream 68", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:pti.store.microsoft.com", "type": "ioc", "value": "pti.store.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query; frame 11474 / UDP stream 43, frame 11475 / UDP stream 43, frame 11476 / UDP stream 43", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:repo1.maven.org", "type": "ioc", "value": "repo1.maven.org", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1827 / UDP stream 19, frame 1874 / UDP stream 19, frame 2507 / UDP stream 19, frame 2508 / UDP stream 19, frame 2509 / UDP stream 19 +3 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:settings-win.data.microsoft.com", "type": "ioc", "value": "settings-win.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 9162 / UDP stream 18, frame 9163 / UDP stream 18, frame 9167 / TCP stream 85", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:srtb.msn.com", "type": "ioc", "value": "srtb.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 10909 / UDP stream 35, frame 10910 / UDP stream 36, frame 10911 / UDP stream 35, frame 10912 / UDP stream 36, frame 10940 / TCP stream 146 +1 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:th.bing.com", "type": "ioc", "value": "th.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 9177 / UDP stream 18, frame 9189 / UDP stream 18, frame 10949 / UDP stream 37, frame 10950 / UDP stream 38, frame 10957 / UDP stream 38 +8 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:v10.events.data.microsoft.com", "type": "ioc", "value": "v10.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 10448 / UDP stream 25, frame 10449 / UDP stream 25, frame 10453 / TCP stream 133", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:v20.events.data.microsoft.com", "type": "ioc", "value": "v20.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1157 / UDP stream 12, frame 1158 / UDP stream 12, frame 1162 / TCP stream 59", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:windows.msn.com", "type": "ioc", "value": "windows.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 10768 / UDP stream 27, frame 10769 / UDP stream 28, frame 10770 / UDP stream 27, frame 10773 / UDP stream 28, frame 10774 / UDP stream 28 +4 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wireshark-ws-dc.wiresharkworkshop.online", "type": "ioc", "value": "wireshark-ws-dc.wiresharkworkshop.online", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query; frame 14 / UDP stream 1, frame 15 / UDP stream 1, frame 201 / UDP stream 6, frame 202 / UDP stream 6", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wiresharkworkshop.online", "type": "ioc", "value": "wiresharkworkshop.online", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query; frame 254 / UDP stream 6, frame 255 / UDP stream 6, frame 676 / UDP stream 12, frame 677 / UDP stream 12", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wns.notify.trafficmanager.net", "type": "ioc", "value": "wns.notify.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-cname; frame 1504 / UDP stream 12, frame 1512 / UDP stream 9", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wpad.wiresharkworkshop.online", "type": "ioc", "value": "wpad.wiresharkworkshop.online", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query; frame 293 / UDP stream 10, frame 294 / UDP stream 10, frame 532 / UDP stream 11, frame 533 / UDP stream 11, frame 906 / UDP stream 10 +11 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.bing.com", "type": "ioc", "value": "www.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1125 / UDP stream 12, frame 1127 / UDP stream 12, frame 1131 / TCP stream 58, frame 1237 / TCP stream 62", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.msftconnecttest.com", "type": "ioc", "value": "www.msftconnecttest.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, http-host; frame 292 / UDP stream 9, frame 433 / UDP stream 9, frame 466 / TCP stream 24", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.msn.com", "type": "ioc", "value": "www.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-query, tls-sni; frame 1253 / UDP stream 19, frame 1254 / UDP stream 19, frame 10813 / UDP stream 29, frame 10814 / UDP stream 30, frame 10815 / UDP stream 30 +5 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.42.16", "type": "ioc", "value": "13.107.42.16", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 9808 / UDP stream 23", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.5.93", "type": "ioc", "value": "13.107.5.93", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1665 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.69.239.79", "type": "ioc", "value": "13.69.239.79", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1158 / UDP stream 12", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:140.82.113.3", "type": "ioc", "value": "140.82.113.3", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1828 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:141.98.10.79", "type": "ioc", "value": "141.98.10.79", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "network-endpoint; no frame reference", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:172.16.1.255", "type": "ioc", "value": "172.16.1.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "network-endpoint; no frame reference", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:172.16.1.4", "type": "ioc", "value": "172.16.1.4", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 13 / UDP stream 1, frame 15 / UDP stream 1, frame 33 / UDP stream 5, frame 202 / UDP stream 6, frame 231 / UDP stream 6 +6 more", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:172.16.1.66", "type": "ioc", "value": "172.16.1.66", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 676 / UDP stream 12, frame 677 / UDP stream 12", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:185.199.108.133", "type": "ioc", "value": "185.199.108.133", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1856 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:185.199.109.133", "type": "ioc", "value": "185.199.109.133", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1856 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:185.199.110.133", "type": "ioc", "value": "185.199.110.133", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1856 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:185.199.111.133", "type": "ioc", "value": "185.199.111.133", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1856 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:199.232.192.209", "type": "ioc", "value": "199.232.192.209", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 2509 / UDP stream 19", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:199.232.196.209", "type": "ioc", "value": "199.232.196.209", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 2509 / UDP stream 19", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.166.2.191", "type": "ioc", "value": "20.166.2.191", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 9779 / UDP stream 23", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.189.173.10", "type": "ioc", "value": "20.189.173.10", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 10345 / UDP stream 23", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.189.173.16", "type": "ioc", "value": "20.189.173.16", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 239 / UDP stream 6", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.189.173.26", "type": "ioc", "value": "20.189.173.26", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 10449 / UDP stream 25", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.157.11", "type": "ioc", "value": "20.190.157.11", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 9501 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.157.9", "type": "ioc", "value": "20.190.157.9", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 9501 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.241.44.114", "type": "ioc", "value": "20.241.44.114", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1453 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.7.1.246", "type": "ioc", "value": "20.7.1.246", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "network-endpoint; no frame reference", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.7.2.167", "type": "ioc", "value": "20.7.2.167", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1512 / UDP stream 9", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.96.153.111", "type": "ioc", "value": "20.96.153.111", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1176 / UDP stream 12", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:204.79.197.203", "type": "ioc", "value": "204.79.197.203", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1254 / UDP stream 19, frame 10770 / UDP stream 27, frame 10816 / UDP stream 29, frame 10887 / UDP stream 31, frame 10911 / UDP stream 35", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:208.95.112.1", "type": "ioc", "value": "208.95.112.1", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 9107 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:224.0.0.22", "type": "ioc", "value": "224.0.0.22", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "network-endpoint; no frame reference", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:224.0.0.251", "type": "ioc", "value": "224.0.0.251", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "network-endpoint; no frame reference", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:224.0.0.252", "type": "ioc", "value": "224.0.0.252", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "network-endpoint; no frame reference", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.194.164.136", "type": "ioc", "value": "23.194.164.136", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 11233 / UDP stream 25", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.167", "type": "ioc", "value": "23.198.7.167", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1127 / UDP stream 12, frame 10958 / UDP stream 37", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.168", "type": "ioc", "value": "23.198.7.168", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.169", "type": "ioc", "value": "23.198.7.169", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.170", "type": "ioc", "value": "23.198.7.170", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 9189 / UDP stream 18, frame 10958 / UDP stream 37", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.172", "type": "ioc", "value": "23.198.7.172", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.173", "type": "ioc", "value": "23.198.7.173", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1127 / UDP stream 12", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.174", "type": "ioc", "value": "23.198.7.174", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.175", "type": "ioc", "value": "23.198.7.175", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18, frame 10958 / UDP stream 37", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.176", "type": "ioc", "value": "23.198.7.176", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.177", "type": "ioc", "value": "23.198.7.177", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1127 / UDP stream 12, frame 9189 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.182", "type": "ioc", "value": "23.198.7.182", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 10958 / UDP stream 37", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.183", "type": "ioc", "value": "23.198.7.183", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 10958 / UDP stream 37", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.198.7.186", "type": "ioc", "value": "23.198.7.186", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 9189 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.215.55.133", "type": "ioc", "value": "23.215.55.133", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 10959 / UDP stream 39", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.215.55.137", "type": "ioc", "value": "23.215.55.137", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 10959 / UDP stream 39", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.215.55.140", "type": "ioc", "value": "23.215.55.140", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 433 / UDP stream 9", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.215.55.144", "type": "ioc", "value": "23.215.55.144", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 433 / UDP stream 9", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.221.22.68", "type": "ioc", "value": "23.221.22.68", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 10420 / UDP stream 25", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.221.22.87", "type": "ioc", "value": "23.221.22.87", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 10420 / UDP stream 25", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.46.192.165", "type": "ioc", "value": "23.46.192.165", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 11031 / UDP stream 41", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.48.203.199", "type": "ioc", "value": "23.48.203.199", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1514 / UDP stream 17", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.48.203.200", "type": "ioc", "value": "23.48.203.200", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1514 / UDP stream 17", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.48.203.201", "type": "ioc", "value": "23.48.203.201", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1514 / UDP stream 17", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.48.203.203", "type": "ioc", "value": "23.48.203.203", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer, network-endpoint; frame 1514 / UDP stream 17, frame 9540 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.48.203.204", "type": "ioc", "value": "23.48.203.204", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1514 / UDP stream 17", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:23.48.203.205", "type": "ioc", "value": "23.48.203.205", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "description": "dns-answer; frame 1514 / UDP stream 17, frame 9540 / UDP stream 18", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "finding-82359a038f0aa2693e2743de", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "172.16.1.4", "protocol": "drsuapi", "destination": "172.16.1.66", "event_count": 33, "operation_numbers": [ "0", "1", "12", "13" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 11, "frame_number": 194, "display_filter": "frame.number == 194", "timestamp_epoch": "1722307129.246973000" }, { "tcp_stream": 11, "frame_number": 196, "display_filter": "frame.number == 196", "timestamp_epoch": "1722307129.247559000" }, { "tcp_stream": 11, "frame_number": 198, "display_filter": "frame.number == 198", "timestamp_epoch": "1722307129.248055000" }, { "tcp_stream": 11, "frame_number": 200, "display_filter": "frame.number == 200", "timestamp_epoch": "1722307129.248398000" }, { "tcp_stream": 34, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1722307133.315265000" }, { "tcp_stream": 34, "frame_number": 665, "display_filter": "frame.number == 665", "timestamp_epoch": "1722307133.316091000" }, { "tcp_stream": 34, "frame_number": 667, "display_filter": "frame.number == 667", "timestamp_epoch": "1722307133.316800000" }, { "tcp_stream": 34, "frame_number": 669, "display_filter": "frame.number == 669", "timestamp_epoch": "1722307133.317183000" }, { "tcp_stream": 11, "frame_number": 968, "display_filter": "frame.number == 968", "timestamp_epoch": "1722307152.762152000" }, { "tcp_stream": 11, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1722307152.762628000" }, { "tcp_stream": 11, "frame_number": 972, "display_filter": "frame.number == 972", "timestamp_epoch": "1722307152.763020000" }, { "tcp_stream": 11, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1722307152.763351000" }, { "tcp_stream": 93, "frame_number": 9375, "display_filter": "frame.number == 9375", "timestamp_epoch": "1722307213.927329000" }, { "tcp_stream": 93, "frame_number": 9377, "display_filter": "frame.number == 9377", "timestamp_epoch": "1722307213.928043000" }, { "tcp_stream": 93, "frame_number": 9379, "display_filter": "frame.number == 9379", "timestamp_epoch": "1722307213.928462000" }, { "tcp_stream": 93, "frame_number": 9383, "display_filter": "frame.number == 9383", "timestamp_epoch": "1722307213.930249000" }, { "tcp_stream": 93, "frame_number": 9385, "display_filter": "frame.number == 9385", "timestamp_epoch": "1722307213.930812000" }, { "tcp_stream": 93, "frame_number": 9387, "display_filter": "frame.number == 9387", "timestamp_epoch": "1722307213.931179000" }, { "tcp_stream": 97, "frame_number": 9447, "display_filter": "frame.number == 9447", "timestamp_epoch": "1722307214.124973000" }, { "tcp_stream": 97, "frame_number": 9449, "display_filter": "frame.number == 9449", "timestamp_epoch": "1722307214.125474000" }, { "tcp_stream": 97, "frame_number": 9451, "display_filter": "frame.number == 9451", "timestamp_epoch": "1722307214.125867000" }, { "tcp_stream": 97, "frame_number": 9455, "display_filter": "frame.number == 9455", "timestamp_epoch": "1722307214.127721000" }, { "tcp_stream": 97, "frame_number": 9457, "display_filter": "frame.number == 9457", "timestamp_epoch": "1722307214.128183000" }, { "tcp_stream": 97, "frame_number": 9459, "display_filter": "frame.number == 9459", "timestamp_epoch": "1722307214.128499000" }, { "tcp_stream": 105, "frame_number": 9647, "display_filter": "frame.number == 9647", "timestamp_epoch": "1722307239.014724000" }, { "tcp_stream": 105, "frame_number": 9649, "display_filter": "frame.number == 9649", "timestamp_epoch": "1722307239.015229000" }, { "tcp_stream": 105, "frame_number": 9651, "display_filter": "frame.number == 9651", "timestamp_epoch": "1722307239.015542000" }, { "tcp_stream": 105, "frame_number": 9655, "display_filter": "frame.number == 9655", "timestamp_epoch": "1722307239.017430000" }, { "tcp_stream": 105, "frame_number": 9657, "display_filter": "frame.number == 9657", "timestamp_epoch": "1722307239.017947000" }, { "tcp_stream": 105, "frame_number": 9659, "display_filter": "frame.number == 9659", "timestamp_epoch": "1722307239.018251000" }, { "tcp_stream": 137, "frame_number": 10755, "display_filter": "frame.number == 10755", "timestamp_epoch": "1722307453.819169000" }, { "tcp_stream": 137, "frame_number": 10757, "display_filter": "frame.number == 10757", "timestamp_epoch": "1722307453.819752000" }, { "tcp_stream": 137, "frame_number": 10759, "display_filter": "frame.number == 10759", "timestamp_epoch": "1722307453.820156000" } ] }, { "id": "finding-ed5d49f794128836c17da20d", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "172.16.1.4", "protocol": "ldap", "destination": "172.16.1.66", "event_count": 87, "operation_numbers": [ "", "1", "4", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 44, "display_filter": "frame.number == 44", "timestamp_epoch": "1722307129.102776000" }, { "tcp_stream": 0, "frame_number": 45, "display_filter": "frame.number == 45", "timestamp_epoch": "1722307129.102778000" }, { "tcp_stream": 1, "frame_number": 49, "display_filter": "frame.number == 49", "timestamp_epoch": "1722307129.103313000" }, { "tcp_stream": 1, "frame_number": 50, "display_filter": "frame.number == 50", "timestamp_epoch": "1722307129.103315000" }, { "tcp_stream": 1, "frame_number": 136, "display_filter": "frame.number == 136", "timestamp_epoch": "1722307129.136066000" }, { "tcp_stream": 5, "frame_number": 137, "display_filter": "frame.number == 137", "timestamp_epoch": "1722307129.136109000" }, { "tcp_stream": 0, "frame_number": 138, "display_filter": "frame.number == 138", "timestamp_epoch": "1722307129.136462000" }, { "tcp_stream": 15, "frame_number": 208, "display_filter": "frame.number == 208", "timestamp_epoch": "1722307129.260308000" }, { "tcp_stream": 15, "frame_number": 209, "display_filter": "frame.number == 209", "timestamp_epoch": "1722307129.260309000" }, { "tcp_stream": 15, "frame_number": 214, "display_filter": "frame.number == 214", "timestamp_epoch": "1722307129.262350000" }, { "tcp_stream": 15, "frame_number": 229, "display_filter": "frame.number == 229", "timestamp_epoch": "1722307129.278847000" }, { "tcp_stream": 18, "frame_number": 247, "display_filter": "frame.number == 247", "timestamp_epoch": "1722307129.398343000" }, { "tcp_stream": 18, "frame_number": 249, "display_filter": "frame.number == 249", "timestamp_epoch": "1722307129.399202000" }, { "tcp_stream": 18, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1722307129.399980000" }, { "tcp_stream": 15, "frame_number": 253, "display_filter": "frame.number == 253", "timestamp_epoch": "1722307129.401501000" }, { "tcp_stream": 25, "frame_number": 509, "display_filter": "frame.number == 509", "timestamp_epoch": "1722307129.953541000" }, { "tcp_stream": 25, "frame_number": 510, "display_filter": "frame.number == 510", "timestamp_epoch": "1722307129.953542000" }, { "tcp_stream": 25, "frame_number": 515, "display_filter": "frame.number == 515", "timestamp_epoch": "1722307129.957387000" }, { "tcp_stream": 25, "frame_number": 517, "display_filter": "frame.number == 517", "timestamp_epoch": "1722307129.965149000" }, { "tcp_stream": 25, "frame_number": 519, "display_filter": "frame.number == 519", "timestamp_epoch": "1722307129.965639000" }, { "tcp_stream": 25, "frame_number": 521, "display_filter": "frame.number == 521", "timestamp_epoch": "1722307129.966075000" }, { "tcp_stream": 25, "frame_number": 523, "display_filter": "frame.number == 523", "timestamp_epoch": "1722307129.966623000" }, { "tcp_stream": 25, "frame_number": 525, "display_filter": "frame.number == 525", "timestamp_epoch": "1722307129.968644000" }, { "tcp_stream": 25, "frame_number": 527, "display_filter": "frame.number == 527", "timestamp_epoch": "1722307129.971041000" }, { "tcp_stream": 25, "frame_number": 529, "display_filter": "frame.number == 529", "timestamp_epoch": "1722307129.971641000" }, { "tcp_stream": 25, "frame_number": 531, "display_filter": "frame.number == 531", "timestamp_epoch": "1722307129.973462000" }, { "tcp_stream": 26, "frame_number": 540, "display_filter": "frame.number == 540", "timestamp_epoch": "1722307129.997336000" }, { "tcp_stream": 26, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1722307129.997914000" }, { "tcp_stream": 27, "frame_number": 553, "display_filter": "frame.number == 553", "timestamp_epoch": "1722307130.000976000" }, { "tcp_stream": 27, "frame_number": 555, "display_filter": "frame.number == 555", "timestamp_epoch": "1722307130.001896000" }, { "tcp_stream": 28, "frame_number": 566, "display_filter": "frame.number == 566", "timestamp_epoch": "1722307130.010839000" }, { "tcp_stream": 28, "frame_number": 568, "display_filter": "frame.number == 568", "timestamp_epoch": "1722307130.011683000" }, { "tcp_stream": 28, "frame_number": 600, "display_filter": "frame.number == 600", "timestamp_epoch": "1722307130.017270000" }, { "tcp_stream": 52, "frame_number": 1000, "display_filter": "frame.number == 1000", "timestamp_epoch": "1722307152.776321000" }, { "tcp_stream": 52, "frame_number": 1002, "display_filter": "frame.number == 1002", "timestamp_epoch": "1722307152.779859000" }, { "tcp_stream": 54, "frame_number": 1037, "display_filter": "frame.number == 1037", "timestamp_epoch": "1722307152.784768000" }, { "tcp_stream": 54, "frame_number": 1040, "display_filter": "frame.number == 1040", "timestamp_epoch": "1722307152.785397000" }, { "tcp_stream": 54, "frame_number": 1044, "display_filter": "frame.number == 1044", "timestamp_epoch": "1722307152.785971000" }, { "tcp_stream": 52, "frame_number": 1046, "display_filter": "frame.number == 1046", "timestamp_epoch": "1722307152.786597000" }, { "tcp_stream": 94, "frame_number": 9393, "display_filter": "frame.number == 9393", "timestamp_epoch": "1722307213.934127000" }, { "tcp_stream": 94, "frame_number": 9394, "display_filter": "frame.number == 9394", "timestamp_epoch": "1722307213.934128000" }, { "tcp_stream": 94, "frame_number": 9399, "display_filter": "frame.number == 9399", "timestamp_epoch": "1722307213.935850000" }, { "tcp_stream": 94, "frame_number": 9401, "display_filter": "frame.number == 9401", "timestamp_epoch": "1722307213.936492000" }, { "tcp_stream": 94, "frame_number": 9403, "display_filter": "frame.number == 9403", "timestamp_epoch": "1722307213.936976000" }, { "tcp_stream": 94, "frame_number": 9405, "display_filter": "frame.number == 9405", "timestamp_epoch": "1722307213.937466000" }, { "tcp_stream": 95, "frame_number": 9412, "display_filter": "frame.number == 9412", "timestamp_epoch": "1722307213.940763000" }, { "tcp_stream": 95, "frame_number": 9416, "display_filter": "frame.number == 9416", "timestamp_epoch": "1722307213.941390000" }, { "tcp_stream": 95, "frame_number": 9419, "display_filter": "frame.number == 9419", "timestamp_epoch": "1722307213.941975000" }, { "tcp_stream": 98, "frame_number": 9465, "display_filter": "frame.number == 9465", "timestamp_epoch": "1722307214.130941000" }, { "tcp_stream": 98, "frame_number": 9466, "display_filter": "frame.number == 9466", "timestamp_epoch": "1722307214.130941000" }, { "tcp_stream": 98, "frame_number": 9471, "display_filter": "frame.number == 9471", "timestamp_epoch": "1722307214.132379000" }, { "tcp_stream": 98, "frame_number": 9473, "display_filter": "frame.number == 9473", "timestamp_epoch": "1722307214.132918000" }, { "tcp_stream": 98, "frame_number": 9475, "display_filter": "frame.number == 9475", "timestamp_epoch": "1722307214.133348000" }, { "tcp_stream": 98, "frame_number": 9477, "display_filter": "frame.number == 9477", "timestamp_epoch": "1722307214.133709000" }, { "tcp_stream": 99, "frame_number": 9484, "display_filter": "frame.number == 9484", "timestamp_epoch": "1722307214.137623000" }, { "tcp_stream": 99, "frame_number": 9488, "display_filter": "frame.number == 9488", "timestamp_epoch": "1722307214.138416000" }, { "tcp_stream": 99, "frame_number": 9491, "display_filter": "frame.number == 9491", "timestamp_epoch": "1722307214.139245000" }, { "tcp_stream": 106, "frame_number": 9665, "display_filter": "frame.number == 9665", "timestamp_epoch": "1722307239.020762000" }, { "tcp_stream": 106, "frame_number": 9666, "display_filter": "frame.number == 9666", "timestamp_epoch": "1722307239.020763000" }, { "tcp_stream": 106, "frame_number": 9671, "display_filter": "frame.number == 9671", "timestamp_epoch": "1722307239.022400000" }, { "tcp_stream": 106, "frame_number": 9673, "display_filter": "frame.number == 9673", "timestamp_epoch": "1722307239.023036000" }, { "tcp_stream": 106, "frame_number": 9675, "display_filter": "frame.number == 9675", "timestamp_epoch": "1722307239.023524000" }, { "tcp_stream": 106, "frame_number": 9677, "display_filter": "frame.number == 9677", "timestamp_epoch": "1722307239.024066000" }, { "tcp_stream": 107, "frame_number": 9684, "display_filter": "frame.number == 9684", "timestamp_epoch": "1722307239.028585000" }, { "tcp_stream": 107, "frame_number": 9688, "display_filter": "frame.number == 9688", "timestamp_epoch": "1722307239.029285000" }, { "tcp_stream": 107, "frame_number": 9691, "display_filter": "frame.number == 9691", "timestamp_epoch": "1722307239.030195000" }, { "tcp_stream": 109, "frame_number": 9739, "display_filter": "frame.number == 9739", "timestamp_epoch": "1722307241.103863000" }, { "tcp_stream": 109, "frame_number": 9740, "display_filter": "frame.number == 9740", "timestamp_epoch": "1722307241.103864000" }, { "tcp_stream": 109, "frame_number": 9757, "display_filter": "frame.number == 9757", "timestamp_epoch": "1722307241.108272000" }, { "tcp_stream": 109, "frame_number": 9759, "display_filter": "frame.number == 9759", "timestamp_epoch": "1722307241.110601000" }, { "tcp_stream": 111, "frame_number": 9770, "display_filter": "frame.number == 9770", "timestamp_epoch": "1722307241.122854000" }, { "tcp_stream": 111, "frame_number": 9772, "display_filter": "frame.number == 9772", "timestamp_epoch": "1722307241.123466000" }, { "tcp_stream": 117, "frame_number": 10067, "display_filter": "frame.number == 10067", "timestamp_epoch": "1722307332.007614000" }, { "tcp_stream": 117, "frame_number": 10068, "display_filter": "frame.number == 10068", "timestamp_epoch": "1722307332.007615000" }, { "tcp_stream": 117, "frame_number": 10073, "display_filter": "frame.number == 10073", "timestamp_epoch": "1722307332.009714000" }, { "tcp_stream": 117, "frame_number": 10075, "display_filter": "frame.number == 10075", "timestamp_epoch": "1722307332.012910000" }, { "tcp_stream": 117, "frame_number": 10077, "display_filter": "frame.number == 10077", "timestamp_epoch": "1722307332.013602000" }, { "tcp_stream": 126, "frame_number": 10309, "display_filter": "frame.number == 10309", "timestamp_epoch": "1722307333.689878000" }, { "tcp_stream": 126, "frame_number": 10310, "display_filter": "frame.number == 10310", "timestamp_epoch": "1722307333.689879000" }, { "tcp_stream": 126, "frame_number": 10315, "display_filter": "frame.number == 10315", "timestamp_epoch": "1722307333.691652000" }, { "tcp_stream": 126, "frame_number": 10317, "display_filter": "frame.number == 10317", "timestamp_epoch": "1722307333.694115000" }, { "tcp_stream": 141, "frame_number": 10833, "display_filter": "frame.number == 10833", "timestamp_epoch": "1722307456.676737000" }, { "tcp_stream": 141, "frame_number": 10834, "display_filter": "frame.number == 10834", "timestamp_epoch": "1722307456.676738000" }, { "tcp_stream": 141, "frame_number": 10839, "display_filter": "frame.number == 10839", "timestamp_epoch": "1722307456.678815000" }, { "tcp_stream": 141, "frame_number": 10841, "display_filter": "frame.number == 10841", "timestamp_epoch": "1722307456.680544000" }, { "tcp_stream": 142, "frame_number": 10853, "display_filter": "frame.number == 10853", "timestamp_epoch": "1722307456.690461000" }, { "tcp_stream": 142, "frame_number": 10855, "display_filter": "frame.number == 10855", "timestamp_epoch": "1722307456.691141000" } ] }, { "id": "finding-56e85f947dd181e8fe9789e2", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "172.16.1.4", "protocol": "samr", "destination": "172.16.1.66", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 21, "frame_number": 1056, "display_filter": "frame.number == 1056", "timestamp_epoch": "1722307152.790024000" }, { "tcp_stream": 21, "frame_number": 1058, "display_filter": "frame.number == 1058", "timestamp_epoch": "1722307152.790513000" }, { "tcp_stream": 21, "frame_number": 1060, "display_filter": "frame.number == 1060", "timestamp_epoch": "1722307152.791013000" }, { "tcp_stream": 21, "frame_number": 1062, "display_filter": "frame.number == 1062", "timestamp_epoch": "1722307152.791453000" }, { "tcp_stream": 21, "frame_number": 1064, "display_filter": "frame.number == 1064", "timestamp_epoch": "1722307152.791901000" }, { "tcp_stream": 21, "frame_number": 1066, "display_filter": "frame.number == 1066", "timestamp_epoch": "1722307152.792368000" }, { "tcp_stream": 21, "frame_number": 1068, "display_filter": "frame.number == 1068", "timestamp_epoch": "1722307152.792930000" }, { "tcp_stream": 21, "frame_number": 1070, "display_filter": "frame.number == 1070", "timestamp_epoch": "1722307152.793528000" }, { "tcp_stream": 21, "frame_number": 1072, "display_filter": "frame.number == 1072", "timestamp_epoch": "1722307152.794009000" }, { "tcp_stream": 21, "frame_number": 1074, "display_filter": "frame.number == 1074", "timestamp_epoch": "1722307152.794435000" }, { "tcp_stream": 21, "frame_number": 1076, "display_filter": "frame.number == 1076", "timestamp_epoch": "1722307152.794826000" }, { "tcp_stream": 21, "frame_number": 1078, "display_filter": "frame.number == 1078", "timestamp_epoch": "1722307152.795212000" }, { "tcp_stream": 21, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1722307152.795585000" }, { "tcp_stream": 21, "frame_number": 1082, "display_filter": "frame.number == 1082", "timestamp_epoch": "1722307152.795977000" }, { "tcp_stream": 21, "frame_number": 1084, "display_filter": "frame.number == 1084", "timestamp_epoch": "1722307152.796434000" } ] }, { "id": "finding-11d97e1ef303eb536d925670", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "172.16.1.66", "protocol": "drsuapi", "destination": "172.16.1.4", "event_count": 33, "operation_numbers": [ "0", "1", "12", "13" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 11, "frame_number": 193, "display_filter": "frame.number == 193", "timestamp_epoch": "1722307129.246746000" }, { "tcp_stream": 11, "frame_number": 195, "display_filter": "frame.number == 195", "timestamp_epoch": "1722307129.247255000" }, { "tcp_stream": 11, "frame_number": 197, "display_filter": "frame.number == 197", "timestamp_epoch": "1722307129.247786000" }, { "tcp_stream": 11, "frame_number": 199, "display_filter": "frame.number == 199", "timestamp_epoch": "1722307129.248238000" }, { "tcp_stream": 34, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1722307133.314989000" }, { "tcp_stream": 34, "frame_number": 664, "display_filter": "frame.number == 664", "timestamp_epoch": "1722307133.315531000" }, { "tcp_stream": 34, "frame_number": 666, "display_filter": "frame.number == 666", "timestamp_epoch": "1722307133.316297000" }, { "tcp_stream": 34, "frame_number": 668, "display_filter": "frame.number == 668", "timestamp_epoch": "1722307133.316997000" }, { "tcp_stream": 11, "frame_number": 967, "display_filter": "frame.number == 967", "timestamp_epoch": "1722307152.761878000" }, { "tcp_stream": 11, "frame_number": 969, "display_filter": "frame.number == 969", "timestamp_epoch": "1722307152.762353000" }, { "tcp_stream": 11, "frame_number": 971, "display_filter": "frame.number == 971", "timestamp_epoch": "1722307152.762778000" }, { "tcp_stream": 11, "frame_number": 973, "display_filter": "frame.number == 973", "timestamp_epoch": "1722307152.763190000" }, { "tcp_stream": 93, "frame_number": 9374, "display_filter": "frame.number == 9374", "timestamp_epoch": "1722307213.926787000" }, { "tcp_stream": 93, "frame_number": 9376, "display_filter": "frame.number == 9376", "timestamp_epoch": "1722307213.927690000" }, { "tcp_stream": 93, "frame_number": 9378, "display_filter": "frame.number == 9378", "timestamp_epoch": "1722307213.928278000" }, { "tcp_stream": 93, "frame_number": 9382, "display_filter": "frame.number == 9382", "timestamp_epoch": "1722307213.930019000" }, { "tcp_stream": 93, "frame_number": 9384, "display_filter": "frame.number == 9384", "timestamp_epoch": "1722307213.930459000" }, { "tcp_stream": 93, "frame_number": 9386, "display_filter": "frame.number == 9386", "timestamp_epoch": "1722307213.931022000" }, { "tcp_stream": 97, "frame_number": 9446, "display_filter": "frame.number == 9446", "timestamp_epoch": "1722307214.124770000" }, { "tcp_stream": 97, "frame_number": 9448, "display_filter": "frame.number == 9448", "timestamp_epoch": "1722307214.125171000" }, { "tcp_stream": 97, "frame_number": 9450, "display_filter": "frame.number == 9450", "timestamp_epoch": "1722307214.125681000" }, { "tcp_stream": 97, "frame_number": 9454, "display_filter": "frame.number == 9454", "timestamp_epoch": "1722307214.127543000" }, { "tcp_stream": 97, "frame_number": 9456, "display_filter": "frame.number == 9456", "timestamp_epoch": "1722307214.127932000" }, { "tcp_stream": 97, "frame_number": 9458, "display_filter": "frame.number == 9458", "timestamp_epoch": "1722307214.128334000" }, { "tcp_stream": 105, "frame_number": 9646, "display_filter": "frame.number == 9646", "timestamp_epoch": "1722307239.014493000" }, { "tcp_stream": 105, "frame_number": 9648, "display_filter": "frame.number == 9648", "timestamp_epoch": "1722307239.014930000" }, { "tcp_stream": 105, "frame_number": 9650, "display_filter": "frame.number == 9650", "timestamp_epoch": "1722307239.015399000" }, { "tcp_stream": 105, "frame_number": 9654, "display_filter": "frame.number == 9654", "timestamp_epoch": "1722307239.017225000" }, { "tcp_stream": 105, "frame_number": 9656, "display_filter": "frame.number == 9656", "timestamp_epoch": "1722307239.017609000" }, { "tcp_stream": 105, "frame_number": 9658, "display_filter": "frame.number == 9658", "timestamp_epoch": "1722307239.018110000" }, { "tcp_stream": 137, "frame_number": 10754, "display_filter": "frame.number == 10754", "timestamp_epoch": "1722307453.818929000" }, { "tcp_stream": 137, "frame_number": 10756, "display_filter": "frame.number == 10756", "timestamp_epoch": "1722307453.819436000" }, { "tcp_stream": 137, "frame_number": 10758, "display_filter": "frame.number == 10758", "timestamp_epoch": "1722307453.820003000" } ] }, { "id": "finding-1dc05e684d9113bd775c1e86", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "172.16.1.66", "protocol": "ldap", "destination": "172.16.1.4", "event_count": 99, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 42, "display_filter": "frame.number == 42", "timestamp_epoch": "1722307129.102370000" }, { "tcp_stream": 1, "frame_number": 46, "display_filter": "frame.number == 46", "timestamp_epoch": "1722307129.102956000" }, { "tcp_stream": 5, "frame_number": 128, "display_filter": "frame.number == 128", "timestamp_epoch": "1722307129.135287000" }, { "tcp_stream": 1, "frame_number": 130, "display_filter": "frame.number == 130", "timestamp_epoch": "1722307129.135346000" }, { "tcp_stream": 0, "frame_number": 133, "display_filter": "frame.number == 133", "timestamp_epoch": "1722307129.135435000" }, { "tcp_stream": 5, "frame_number": 139, "display_filter": "frame.number == 139", "timestamp_epoch": "1722307129.138026000" }, { "tcp_stream": 0, "frame_number": 140, "display_filter": "frame.number == 140", "timestamp_epoch": "1722307129.138038000" }, { "tcp_stream": 1, "frame_number": 141, "display_filter": "frame.number == 141", "timestamp_epoch": "1722307129.138134000" }, { "tcp_stream": 15, "frame_number": 206, "display_filter": "frame.number == 206", "timestamp_epoch": "1722307129.259995000" }, { "tcp_stream": 15, "frame_number": 212, "display_filter": "frame.number == 212", "timestamp_epoch": "1722307129.261574000" }, { "tcp_stream": 15, "frame_number": 228, "display_filter": "frame.number == 228", "timestamp_epoch": "1722307129.278247000" }, { "tcp_stream": 18, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1722307129.397204000" }, { "tcp_stream": 18, "frame_number": 248, "display_filter": "frame.number == 248", "timestamp_epoch": "1722307129.398906000" }, { "tcp_stream": 18, "frame_number": 250, "display_filter": "frame.number == 250", "timestamp_epoch": "1722307129.399594000" }, { "tcp_stream": 15, "frame_number": 252, "display_filter": "frame.number == 252", "timestamp_epoch": "1722307129.400886000" }, { "tcp_stream": 18, "frame_number": 458, "display_filter": "frame.number == 458", "timestamp_epoch": "1722307129.592428000" }, { "tcp_stream": 15, "frame_number": 460, "display_filter": "frame.number == 460", "timestamp_epoch": "1722307129.598686000" }, { "tcp_stream": 25, "frame_number": 507, "display_filter": "frame.number == 507", "timestamp_epoch": "1722307129.952978000" }, { "tcp_stream": 25, "frame_number": 513, "display_filter": "frame.number == 513", "timestamp_epoch": "1722307129.956396000" }, { "tcp_stream": 25, "frame_number": 516, "display_filter": "frame.number == 516", "timestamp_epoch": "1722307129.964882000" }, { "tcp_stream": 25, "frame_number": 518, "display_filter": "frame.number == 518", "timestamp_epoch": "1722307129.965424000" }, { "tcp_stream": 25, "frame_number": 520, "display_filter": "frame.number == 520", "timestamp_epoch": "1722307129.965834000" }, { "tcp_stream": 25, "frame_number": 522, "display_filter": "frame.number == 522", "timestamp_epoch": "1722307129.966338000" }, { "tcp_stream": 25, "frame_number": 524, "display_filter": "frame.number == 524", "timestamp_epoch": "1722307129.968377000" }, { "tcp_stream": 25, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1722307129.969209000" }, { "tcp_stream": 25, "frame_number": 528, "display_filter": "frame.number == 528", "timestamp_epoch": "1722307129.971370000" }, { "tcp_stream": 25, "frame_number": 530, "display_filter": "frame.number == 530", "timestamp_epoch": "1722307129.973223000" }, { "tcp_stream": 26, "frame_number": 538, "display_filter": "frame.number == 538", "timestamp_epoch": "1722307129.996553000" }, { "tcp_stream": 26, "frame_number": 541, "display_filter": "frame.number == 541", "timestamp_epoch": "1722307129.997732000" }, { "tcp_stream": 26, "frame_number": 543, "display_filter": "frame.number == 543", "timestamp_epoch": "1722307129.998321000" }, { "tcp_stream": 27, "frame_number": 551, "display_filter": "frame.number == 551", "timestamp_epoch": "1722307130.000323000" }, { "tcp_stream": 27, "frame_number": 554, "display_filter": "frame.number == 554", "timestamp_epoch": "1722307130.001497000" }, { "tcp_stream": 27, "frame_number": 556, "display_filter": "frame.number == 556", "timestamp_epoch": "1722307130.002168000" }, { "tcp_stream": 28, "frame_number": 564, "display_filter": "frame.number == 564", "timestamp_epoch": "1722307130.009998000" }, { "tcp_stream": 28, "frame_number": 567, "display_filter": "frame.number == 567", "timestamp_epoch": "1722307130.011426000" }, { "tcp_stream": 28, "frame_number": 599, "display_filter": "frame.number == 599", "timestamp_epoch": "1722307130.016918000" }, { "tcp_stream": 28, "frame_number": 601, "display_filter": "frame.number == 601", "timestamp_epoch": "1722307130.017720000" }, { "tcp_stream": 25, "frame_number": 606, "display_filter": "frame.number == 606", "timestamp_epoch": "1722307130.018429000" }, { "tcp_stream": 52, "frame_number": 998, "display_filter": "frame.number == 998", "timestamp_epoch": "1722307152.775526000" }, { "tcp_stream": 52, "frame_number": 1001, "display_filter": "frame.number == 1001", "timestamp_epoch": "1722307152.779506000" }, { "tcp_stream": 54, "frame_number": 1035, "display_filter": "frame.number == 1035", "timestamp_epoch": "1722307152.784007000" }, { "tcp_stream": 54, "frame_number": 1039, "display_filter": "frame.number == 1039", "timestamp_epoch": "1722307152.785220000" }, { "tcp_stream": 54, "frame_number": 1042, "display_filter": "frame.number == 1042", "timestamp_epoch": "1722307152.785699000" }, { "tcp_stream": 52, "frame_number": 1045, "display_filter": "frame.number == 1045", "timestamp_epoch": "1722307152.786258000" }, { "tcp_stream": 54, "frame_number": 1087, "display_filter": "frame.number == 1087", "timestamp_epoch": "1722307152.804068000" }, { "tcp_stream": 52, "frame_number": 1089, "display_filter": "frame.number == 1089", "timestamp_epoch": "1722307152.807558000" }, { "tcp_stream": 94, "frame_number": 9391, "display_filter": "frame.number == 9391", "timestamp_epoch": "1722307213.933779000" }, { "tcp_stream": 94, "frame_number": 9397, "display_filter": "frame.number == 9397", "timestamp_epoch": "1722307213.935134000" }, { "tcp_stream": 94, "frame_number": 9400, "display_filter": "frame.number == 9400", "timestamp_epoch": "1722307213.936211000" }, { "tcp_stream": 94, "frame_number": 9402, "display_filter": "frame.number == 9402", "timestamp_epoch": "1722307213.936772000" }, { "tcp_stream": 94, "frame_number": 9404, "display_filter": "frame.number == 9404", "timestamp_epoch": "1722307213.937219000" }, { "tcp_stream": 95, "frame_number": 9410, "display_filter": "frame.number == 9410", "timestamp_epoch": "1722307213.939967000" }, { "tcp_stream": 95, "frame_number": 9413, "display_filter": "frame.number == 9413", "timestamp_epoch": "1722307213.941093000" }, { "tcp_stream": 95, "frame_number": 9418, "display_filter": "frame.number == 9418", "timestamp_epoch": "1722307213.941687000" }, { "tcp_stream": 95, "frame_number": 9420, "display_filter": "frame.number == 9420", "timestamp_epoch": "1722307213.942194000" }, { "tcp_stream": 94, "frame_number": 9424, "display_filter": "frame.number == 9424", "timestamp_epoch": "1722307213.942672000" }, { "tcp_stream": 98, "frame_number": 9463, "display_filter": "frame.number == 9463", "timestamp_epoch": "1722307214.130677000" }, { "tcp_stream": 98, "frame_number": 9469, "display_filter": "frame.number == 9469", "timestamp_epoch": "1722307214.131773000" }, { "tcp_stream": 98, "frame_number": 9472, "display_filter": "frame.number == 9472", "timestamp_epoch": "1722307214.132703000" }, { "tcp_stream": 98, "frame_number": 9474, "display_filter": "frame.number == 9474", "timestamp_epoch": "1722307214.133112000" }, { "tcp_stream": 98, "frame_number": 9476, "display_filter": "frame.number == 9476", "timestamp_epoch": "1722307214.133526000" }, { "tcp_stream": 99, "frame_number": 9482, "display_filter": "frame.number == 9482", "timestamp_epoch": "1722307214.136868000" }, { "tcp_stream": 99, "frame_number": 9485, "display_filter": "frame.number == 9485", "timestamp_epoch": "1722307214.138108000" }, { "tcp_stream": 99, "frame_number": 9490, "display_filter": "frame.number == 9490", "timestamp_epoch": "1722307214.138869000" }, { "tcp_stream": 99, "frame_number": 9492, "display_filter": "frame.number == 9492", "timestamp_epoch": "1722307214.139492000" }, { "tcp_stream": 98, "frame_number": 9494, "display_filter": "frame.number == 9494", "timestamp_epoch": "1722307214.139922000" }, { "tcp_stream": 106, "frame_number": 9663, "display_filter": "frame.number == 9663", "timestamp_epoch": "1722307239.020504000" }, { "tcp_stream": 106, "frame_number": 9669, "display_filter": "frame.number == 9669", "timestamp_epoch": "1722307239.021669000" }, { "tcp_stream": 106, "frame_number": 9672, "display_filter": "frame.number == 9672", "timestamp_epoch": "1722307239.022794000" }, { "tcp_stream": 106, "frame_number": 9674, "display_filter": "frame.number == 9674", "timestamp_epoch": "1722307239.023265000" }, { "tcp_stream": 106, "frame_number": 9676, "display_filter": "frame.number == 9676", "timestamp_epoch": "1722307239.023729000" }, { "tcp_stream": 107, "frame_number": 9682, "display_filter": "frame.number == 9682", "timestamp_epoch": "1722307239.027774000" }, { "tcp_stream": 107, "frame_number": 9685, "display_filter": "frame.number == 9685", "timestamp_epoch": "1722307239.028962000" }, { "tcp_stream": 107, "frame_number": 9690, "display_filter": "frame.number == 9690", "timestamp_epoch": "1722307239.029914000" }, { "tcp_stream": 107, "frame_number": 9692, "display_filter": "frame.number == 9692", "timestamp_epoch": "1722307239.030373000" }, { "tcp_stream": 106, "frame_number": 9696, "display_filter": "frame.number == 9696", "timestamp_epoch": "1722307239.030796000" }, { "tcp_stream": 109, "frame_number": 9737, "display_filter": "frame.number == 9737", "timestamp_epoch": "1722307241.103539000" }, { "tcp_stream": 109, "frame_number": 9755, "display_filter": "frame.number == 9755", "timestamp_epoch": "1722307241.107544000" }, { "tcp_stream": 109, "frame_number": 9758, "display_filter": "frame.number == 9758", "timestamp_epoch": "1722307241.110307000" }, { "tcp_stream": 109, "frame_number": 9760, "display_filter": "frame.number == 9760", "timestamp_epoch": "1722307241.111024000" }, { "tcp_stream": 111, "frame_number": 9768, "display_filter": "frame.number == 9768", "timestamp_epoch": "1722307241.122109000" }, { "tcp_stream": 111, "frame_number": 9771, "display_filter": "frame.number == 9771", "timestamp_epoch": "1722307241.123191000" }, { "tcp_stream": 111, "frame_number": 9773, "display_filter": "frame.number == 9773", "timestamp_epoch": "1722307241.123737000" }, { "tcp_stream": 117, "frame_number": 10065, "display_filter": "frame.number == 10065", "timestamp_epoch": "1722307332.007314000" }, { "tcp_stream": 117, "frame_number": 10071, "display_filter": "frame.number == 10071", "timestamp_epoch": "1722307332.008959000" }, { "tcp_stream": 117, "frame_number": 10074, "display_filter": "frame.number == 10074", "timestamp_epoch": "1722307332.012660000" }, { "tcp_stream": 117, "frame_number": 10076, "display_filter": "frame.number == 10076", "timestamp_epoch": "1722307332.013159000" }, { "tcp_stream": 117, "frame_number": 10078, "display_filter": "frame.number == 10078", "timestamp_epoch": "1722307332.014246000" }, { "tcp_stream": 126, "frame_number": 10307, "display_filter": "frame.number == 10307", "timestamp_epoch": "1722307333.689571000" }, { "tcp_stream": 126, "frame_number": 10313, "display_filter": "frame.number == 10313", "timestamp_epoch": "1722307333.690910000" }, { "tcp_stream": 126, "frame_number": 10316, "display_filter": "frame.number == 10316", "timestamp_epoch": "1722307333.692019000" }, { "tcp_stream": 126, "frame_number": 10318, "display_filter": "frame.number == 10318", "timestamp_epoch": "1722307333.695675000" }, { "tcp_stream": 141, "frame_number": 10831, "display_filter": "frame.number == 10831", "timestamp_epoch": "1722307456.676444000" }, { "tcp_stream": 141, "frame_number": 10837, "display_filter": "frame.number == 10837", "timestamp_epoch": "1722307456.678037000" }, { "tcp_stream": 141, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1722307456.680260000" }, { "tcp_stream": 141, "frame_number": 10842, "display_filter": "frame.number == 10842", "timestamp_epoch": "1722307456.680828000" }, { "tcp_stream": 142, "frame_number": 10851, "display_filter": "frame.number == 10851", "timestamp_epoch": "1722307456.689676000" }, { "tcp_stream": 142, "frame_number": 10854, "display_filter": "frame.number == 10854", "timestamp_epoch": "1722307456.690871000" }, { "tcp_stream": 142, "frame_number": 10856, "display_filter": "frame.number == 10856", "timestamp_epoch": "1722307456.691458000" } ] }, { "id": "finding-81b169139b646fc4aa7b50f9", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "172.16.1.66", "protocol": "samr", "destination": "172.16.1.4", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 21, "frame_number": 1055, "display_filter": "frame.number == 1055", "timestamp_epoch": "1722307152.789680000" }, { "tcp_stream": 21, "frame_number": 1057, "display_filter": "frame.number == 1057", "timestamp_epoch": "1722307152.790201000" }, { "tcp_stream": 21, "frame_number": 1059, "display_filter": "frame.number == 1059", "timestamp_epoch": "1722307152.790742000" }, { "tcp_stream": 21, "frame_number": 1061, "display_filter": "frame.number == 1061", "timestamp_epoch": "1722307152.791162000" }, { "tcp_stream": 21, "frame_number": 1063, "display_filter": "frame.number == 1063", "timestamp_epoch": "1722307152.791602000" }, { "tcp_stream": 21, "frame_number": 1065, "display_filter": "frame.number == 1065", "timestamp_epoch": "1722307152.792045000" }, { "tcp_stream": 21, "frame_number": 1067, "display_filter": "frame.number == 1067", "timestamp_epoch": "1722307152.792524000" }, { "tcp_stream": 21, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1722307152.793077000" }, { "tcp_stream": 21, "frame_number": 1071, "display_filter": "frame.number == 1071", "timestamp_epoch": "1722307152.793687000" }, { "tcp_stream": 21, "frame_number": 1073, "display_filter": "frame.number == 1073", "timestamp_epoch": "1722307152.794176000" }, { "tcp_stream": 21, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1722307152.794582000" }, { "tcp_stream": 21, "frame_number": 1077, "display_filter": "frame.number == 1077", "timestamp_epoch": "1722307152.794979000" }, { "tcp_stream": 21, "frame_number": 1079, "display_filter": "frame.number == 1079", "timestamp_epoch": "1722307152.795358000" }, { "tcp_stream": 21, "frame_number": 1081, "display_filter": "frame.number == 1081", "timestamp_epoch": "1722307152.795749000" }, { "tcp_stream": 21, "frame_number": 1083, "display_filter": "frame.number == 1083", "timestamp_epoch": "1722307152.796148000" } ] }, { "id": "finding-bc47e86541b34769f7b80758", "type": "pcap-finding", "label": "Client announces a software label and host identity", "source": "deterministic-pcap-analysis", "metrics": { "source": "172.16.1.66", "client_id": "1BE8292C", "destination": "141.98.10.79", "message_count": 102, "software_label": "STRRAT", "claimed_account": "ccollier", "claimed_hostname": "DESKTOP-SKBR25F", "destination_port": 12132 }, "rule_id": "cleartext-tool-self-identification", "severity": "high", "confidence": 0.98, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "explanation": "An otherwise unclassified TCP payload contains a structured ping, software label, client identifier, hostname and account. These are literal self-reported values, not authenticated identity or independent malware-family attribution.", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 83, "frame_number": 9119, "display_filter": "frame.number == 9119", "timestamp_epoch": "1722307207.027145000" }, { "tcp_stream": 83, "frame_number": 9352, "display_filter": "frame.number == 9352", "timestamp_epoch": "1722307213.639146000" }, { "tcp_stream": 83, "frame_number": 9530, "display_filter": "frame.number == 9530", "timestamp_epoch": "1722307218.639963000" }, { "tcp_stream": 83, "frame_number": 9537, "display_filter": "frame.number == 9537", "timestamp_epoch": "1722307223.655701000" }, { "tcp_stream": 83, "frame_number": 9563, "display_filter": "frame.number == 9563", "timestamp_epoch": "1722307228.655923000" }, { "tcp_stream": 83, "frame_number": 9600, "display_filter": "frame.number == 9600", "timestamp_epoch": "1722307233.670802000" }, { "tcp_stream": 83, "frame_number": 9628, "display_filter": "frame.number == 9628", "timestamp_epoch": "1722307238.689465000" }, { "tcp_stream": 83, "frame_number": 9848, "display_filter": "frame.number == 9848", "timestamp_epoch": "1722307243.686663000" }, { "tcp_stream": 83, "frame_number": 9854, "display_filter": "frame.number == 9854", "timestamp_epoch": "1722307248.687387000" }, { "tcp_stream": 83, "frame_number": 9868, "display_filter": "frame.number == 9868", "timestamp_epoch": "1722307253.703161000" }, { "tcp_stream": 83, "frame_number": 9872, "display_filter": "frame.number == 9872", "timestamp_epoch": "1722307258.718573000" }, { "tcp_stream": 83, "frame_number": 9878, "display_filter": "frame.number == 9878", "timestamp_epoch": "1722307263.734502000" }, { "tcp_stream": 83, "frame_number": 9898, "display_filter": "frame.number == 9898", "timestamp_epoch": "1722307268.752428000" }, { "tcp_stream": 83, "frame_number": 9936, "display_filter": "frame.number == 9936", "timestamp_epoch": "1722307273.750641000" }, { "tcp_stream": 83, "frame_number": 9940, "display_filter": "frame.number == 9940", "timestamp_epoch": "1722307278.750755000" }, { "tcp_stream": 83, "frame_number": 9946, "display_filter": "frame.number == 9946", "timestamp_epoch": "1722307283.751067000" }, { "tcp_stream": 83, "frame_number": 9966, "display_filter": "frame.number == 9966", "timestamp_epoch": "1722307288.766569000" }, { "tcp_stream": 83, "frame_number": 9976, "display_filter": "frame.number == 9976", "timestamp_epoch": "1722307293.781736000" }, { "tcp_stream": 83, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1722307298.798229000" }, { "tcp_stream": 83, "frame_number": 10005, "display_filter": "frame.number == 10005", "timestamp_epoch": "1722307303.797738000" }, { "tcp_stream": 83, "frame_number": 10009, "display_filter": "frame.number == 10009", "timestamp_epoch": "1722307308.814125000" }, { "tcp_stream": 83, "frame_number": 10022, "display_filter": "frame.number == 10022", "timestamp_epoch": "1722307313.829783000" }, { "tcp_stream": 83, "frame_number": 10026, "display_filter": "frame.number == 10026", "timestamp_epoch": "1722307318.845553000" }, { "tcp_stream": 83, "frame_number": 10034, "display_filter": "frame.number == 10034", "timestamp_epoch": "1722307323.859221000" }, { "tcp_stream": 83, "frame_number": 10038, "display_filter": "frame.number == 10038", "timestamp_epoch": "1722307328.860897000" }, { "tcp_stream": 83, "frame_number": 10324, "display_filter": "frame.number == 10324", "timestamp_epoch": "1722307333.874718000" }, { "tcp_stream": 83, "frame_number": 10341, "display_filter": "frame.number == 10341", "timestamp_epoch": "1722307338.861786000" }, { "tcp_stream": 83, "frame_number": 10410, "display_filter": "frame.number == 10410", "timestamp_epoch": "1722307343.863235000" }, { "tcp_stream": 83, "frame_number": 10440, "display_filter": "frame.number == 10440", "timestamp_epoch": "1722307348.863221000" }, { "tcp_stream": 83, "frame_number": 10446, "display_filter": "frame.number == 10446", "timestamp_epoch": "1722307353.881984000" }, { "tcp_stream": 83, "frame_number": 10573, "display_filter": "frame.number == 10573", "timestamp_epoch": "1722307358.896658000" }, { "tcp_stream": 83, "frame_number": 10598, "display_filter": "frame.number == 10598", "timestamp_epoch": "1722307363.919570000" }, { "tcp_stream": 83, "frame_number": 10611, "display_filter": "frame.number == 10611", "timestamp_epoch": "1722307368.926738000" }, { "tcp_stream": 83, "frame_number": 10628, "display_filter": "frame.number == 10628", "timestamp_epoch": "1722307373.941649000" }, { "tcp_stream": 83, "frame_number": 10635, "display_filter": "frame.number == 10635", "timestamp_epoch": "1722307378.957744000" }, { "tcp_stream": 83, "frame_number": 10641, "display_filter": "frame.number == 10641", "timestamp_epoch": "1722307383.957867000" }, { "tcp_stream": 83, "frame_number": 10645, "display_filter": "frame.number == 10645", "timestamp_epoch": "1722307388.973605000" }, { "tcp_stream": 83, "frame_number": 10670, "display_filter": "frame.number == 10670", "timestamp_epoch": "1722307393.995675000" }, { "tcp_stream": 83, "frame_number": 10674, "display_filter": "frame.number == 10674", "timestamp_epoch": "1722307399.004521000" }, { "tcp_stream": 83, "frame_number": 10685, "display_filter": "frame.number == 10685", "timestamp_epoch": "1722307404.020389000" }, { "tcp_stream": 83, "frame_number": 10691, "display_filter": "frame.number == 10691", "timestamp_epoch": "1722307409.031263000" }, { "tcp_stream": 83, "frame_number": 10698, "display_filter": "frame.number == 10698", "timestamp_epoch": "1722307414.036292000" }, { "tcp_stream": 83, "frame_number": 10704, "display_filter": "frame.number == 10704", "timestamp_epoch": "1722307419.052502000" }, { "tcp_stream": 83, "frame_number": 10708, "display_filter": "frame.number == 10708", "timestamp_epoch": "1722307424.054124000" }, { "tcp_stream": 83, "frame_number": 10714, "display_filter": "frame.number == 10714", "timestamp_epoch": "1722307429.070650000" }, { "tcp_stream": 83, "frame_number": 10718, "display_filter": "frame.number == 10718", "timestamp_epoch": "1722307434.085404000" }, { "tcp_stream": 83, "frame_number": 10724, "display_filter": "frame.number == 10724", "timestamp_epoch": "1722307439.086546000" }, { "tcp_stream": 83, "frame_number": 10732, "display_filter": "frame.number == 10732", "timestamp_epoch": "1722307444.087181000" }, { "tcp_stream": 83, "frame_number": 10736, "display_filter": "frame.number == 10736", "timestamp_epoch": "1722307449.102690000" }, { "tcp_stream": 83, "frame_number": 10764, "display_filter": "frame.number == 10764", "timestamp_epoch": "1722307454.102881000" }, { "tcp_stream": 83, "frame_number": 11180, "display_filter": "frame.number == 11180", "timestamp_epoch": "1722307459.118143000" }, { "tcp_stream": 83, "frame_number": 11219, "display_filter": "frame.number == 11219", "timestamp_epoch": "1722307464.134675000" }, { "tcp_stream": 83, "frame_number": 11229, "display_filter": "frame.number == 11229", "timestamp_epoch": "1722307469.150403000" }, { "tcp_stream": 83, "frame_number": 11289, "display_filter": "frame.number == 11289", "timestamp_epoch": "1722307474.166073000" }, { "tcp_stream": 83, "frame_number": 11293, "display_filter": "frame.number == 11293", "timestamp_epoch": "1722307479.181285000" }, { "tcp_stream": 83, "frame_number": 11297, "display_filter": "frame.number == 11297", "timestamp_epoch": "1722307484.187370000" }, { "tcp_stream": 83, "frame_number": 11305, "display_filter": "frame.number == 11305", "timestamp_epoch": "1722307489.196917000" }, { "tcp_stream": 83, "frame_number": 11309, "display_filter": "frame.number == 11309", "timestamp_epoch": "1722307494.211813000" }, { "tcp_stream": 83, "frame_number": 11317, "display_filter": "frame.number == 11317", "timestamp_epoch": "1722307499.212360000" }, { "tcp_stream": 83, "frame_number": 11323, "display_filter": "frame.number == 11323", "timestamp_epoch": "1722307504.228199000" }, { "tcp_stream": 83, "frame_number": 11327, "display_filter": "frame.number == 11327", "timestamp_epoch": "1722307509.244303000" }, { "tcp_stream": 83, "frame_number": 11333, "display_filter": "frame.number == 11333", "timestamp_epoch": "1722307514.259231000" }, { "tcp_stream": 83, "frame_number": 11337, "display_filter": "frame.number == 11337", "timestamp_epoch": "1722307519.275350000" }, { "tcp_stream": 83, "frame_number": 11341, "display_filter": "frame.number == 11341", "timestamp_epoch": "1722307524.275832000" }, { "tcp_stream": 83, "frame_number": 11347, "display_filter": "frame.number == 11347", "timestamp_epoch": "1722307529.291501000" }, { "tcp_stream": 83, "frame_number": 11355, "display_filter": "frame.number == 11355", "timestamp_epoch": "1722307534.307413000" }, { "tcp_stream": 83, "frame_number": 11359, "display_filter": "frame.number == 11359", "timestamp_epoch": "1722307539.323069000" }, { "tcp_stream": 83, "frame_number": 11363, "display_filter": "frame.number == 11363", "timestamp_epoch": "1722307544.338888000" }, { "tcp_stream": 83, "frame_number": 11367, "display_filter": "frame.number == 11367", "timestamp_epoch": "1722307549.354667000" }, { "tcp_stream": 83, "frame_number": 11371, "display_filter": "frame.number == 11371", "timestamp_epoch": "1722307554.354605000" }, { "tcp_stream": 83, "frame_number": 11379, "display_filter": "frame.number == 11379", "timestamp_epoch": "1722307559.354706000" }, { "tcp_stream": 83, "frame_number": 11387, "display_filter": "frame.number == 11387", "timestamp_epoch": "1722307564.370482000" }, { "tcp_stream": 83, "frame_number": 11391, "display_filter": "frame.number == 11391", "timestamp_epoch": "1722307569.370380000" }, { "tcp_stream": 83, "frame_number": 11395, "display_filter": "frame.number == 11395", "timestamp_epoch": "1722307574.370651000" }, { "tcp_stream": 83, "frame_number": 11401, "display_filter": "frame.number == 11401", "timestamp_epoch": "1722307579.370379000" }, { "tcp_stream": 83, "frame_number": 11407, "display_filter": "frame.number == 11407", "timestamp_epoch": "1722307584.386421000" }, { "tcp_stream": 83, "frame_number": 11413, "display_filter": "frame.number == 11413", "timestamp_epoch": "1722307589.401900000" }, { "tcp_stream": 83, "frame_number": 11421, "display_filter": "frame.number == 11421", "timestamp_epoch": "1722307594.402322000" }, { "tcp_stream": 83, "frame_number": 11425, "display_filter": "frame.number == 11425", "timestamp_epoch": "1722307599.402520000" }, { "tcp_stream": 83, "frame_number": 11429, "display_filter": "frame.number == 11429", "timestamp_epoch": "1722307604.417425000" }, { "tcp_stream": 83, "frame_number": 11433, "display_filter": "frame.number == 11433", "timestamp_epoch": "1722307609.433632000" }, { "tcp_stream": 83, "frame_number": 11438, "display_filter": "frame.number == 11438", "timestamp_epoch": "1722307614.449540000" }, { "tcp_stream": 83, "frame_number": 11446, "display_filter": "frame.number == 11446", "timestamp_epoch": "1722307619.465394000" }, { "tcp_stream": 83, "frame_number": 11454, "display_filter": "frame.number == 11454", "timestamp_epoch": "1722307624.465005000" }, { "tcp_stream": 83, "frame_number": 11458, "display_filter": "frame.number == 11458", "timestamp_epoch": "1722307629.465451000" }, { "tcp_stream": 83, "frame_number": 11462, "display_filter": "frame.number == 11462", "timestamp_epoch": "1722307634.465668000" }, { "tcp_stream": 83, "frame_number": 11466, "display_filter": "frame.number == 11466", "timestamp_epoch": "1722307639.465698000" }, { "tcp_stream": 83, "frame_number": 11479, "display_filter": "frame.number == 11479", "timestamp_epoch": "1722307644.481768000" }, { "tcp_stream": 83, "frame_number": 11487, "display_filter": "frame.number == 11487", "timestamp_epoch": "1722307649.481781000" }, { "tcp_stream": 83, "frame_number": 11493, "display_filter": "frame.number == 11493", "timestamp_epoch": "1722307654.497140000" }, { "tcp_stream": 83, "frame_number": 11497, "display_filter": "frame.number == 11497", "timestamp_epoch": "1722307659.513012000" }, { "tcp_stream": 83, "frame_number": 11501, "display_filter": "frame.number == 11501", "timestamp_epoch": "1722307664.528534000" }, { "tcp_stream": 83, "frame_number": 11505, "display_filter": "frame.number == 11505", "timestamp_epoch": "1722307669.528988000" }, { "tcp_stream": 83, "frame_number": 11509, "display_filter": "frame.number == 11509", "timestamp_epoch": "1722307674.544693000" }, { "tcp_stream": 83, "frame_number": 11515, "display_filter": "frame.number == 11515", "timestamp_epoch": "1722307679.560410000" }, { "tcp_stream": 83, "frame_number": 11525, "display_filter": "frame.number == 11525", "timestamp_epoch": "1722307684.575346000" }, { "tcp_stream": 83, "frame_number": 11529, "display_filter": "frame.number == 11529", "timestamp_epoch": "1722307689.591650000" }, { "tcp_stream": 83, "frame_number": 11533, "display_filter": "frame.number == 11533", "timestamp_epoch": "1722307694.591832000" }, { "tcp_stream": 83, "frame_number": 11537, "display_filter": "frame.number == 11537", "timestamp_epoch": "1722307699.592098000" }, { "tcp_stream": 83, "frame_number": 11541, "display_filter": "frame.number == 11541", "timestamp_epoch": "1722307704.607645000" } ] }, { "id": "finding-dff75f3c13106191119b2a9f", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "172.16.1.66", "packets": 411, "wire_bytes": 39064, "destination": "141.98.10.79", "destination_port": 12132, "duration_seconds": 508.67 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 83, "frame_number": 9066, "display_filter": "tcp.stream == 83", "timestamp_epoch": "1722307205.953226" } ] }, { "id": "identity-3e6e1a2370b05a6181d516ba", "type": "identity", "label": "account: ccollier", "value": "ccollier", "source": "deterministic-pcap-analysis", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "172.16.1.66" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 46, "frame_number": 913, "display_filter": "frame.number == 913", "timestamp_epoch": "1722307152.512235000" }, { "tcp_stream": 47, "frame_number": 921, "display_filter": "frame.number == 921", "timestamp_epoch": "1722307152.518681000" }, { "tcp_stream": 47, "frame_number": 923, "display_filter": "frame.number == 923", "timestamp_epoch": "1722307152.520075000" }, { "tcp_stream": 48, "frame_number": 935, "display_filter": "frame.number == 935", "timestamp_epoch": "1722307152.522364000" }, { "tcp_stream": 50, "frame_number": 956, "display_filter": "frame.number == 956", "timestamp_epoch": "1722307152.758183000" }, { "tcp_stream": 53, "frame_number": 1013, "display_filter": "frame.number == 1013", "timestamp_epoch": "1722307152.782154000" }, { "tcp_stream": 55, "frame_number": 1025, "display_filter": "frame.number == 1025", "timestamp_epoch": "1722307152.783333000" }, { "tcp_stream": 21, "frame_number": 1070, "display_filter": "frame.number == 1070", "timestamp_epoch": "1722307152.793528000" }, { "tcp_stream": 57, "frame_number": 1109, "display_filter": "frame.number == 1109", "timestamp_epoch": "1722307153.031311000" }, { "tcp_stream": 110, "frame_number": 9749, "display_filter": "frame.number == 9749", "timestamp_epoch": "1722307241.106569000" } ] }, { "id": "identity-173cc151abbb6de85f4229f9", "type": "identity", "label": "account: desktop-skbr25f$", "value": "desktop-skbr25f$", "source": "deterministic-pcap-analysis", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "172.16.1.66" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 2, "frame_number": 58, "display_filter": "frame.number == 58", "timestamp_epoch": "1722307129.109387000" }, { "tcp_stream": 3, "frame_number": 59, "display_filter": "frame.number == 59", "timestamp_epoch": "1722307129.109482000" }, { "tcp_stream": 4, "frame_number": 71, "display_filter": "frame.number == 71", "timestamp_epoch": "1722307129.120736000" }, { "tcp_stream": 4, "frame_number": 73, "display_filter": "frame.number == 73", "timestamp_epoch": "1722307129.121401000" }, { "tcp_stream": 6, "frame_number": 84, "display_filter": "frame.number == 84", "timestamp_epoch": "1722307129.129461000" }, { "tcp_stream": 6, "frame_number": 86, "display_filter": "frame.number == 86", "timestamp_epoch": "1722307129.130126000" }, { "tcp_stream": 8, "frame_number": 109, "display_filter": "frame.number == 109", "timestamp_epoch": "1722307129.133775000" }, { "tcp_stream": 7, "frame_number": 113, "display_filter": "frame.number == 113", "timestamp_epoch": "1722307129.133950000" }, { "tcp_stream": 9, "frame_number": 122, "display_filter": "frame.number == 122", "timestamp_epoch": "1722307129.134778000" }, { "tcp_stream": 12, "frame_number": 158, "display_filter": "frame.number == 158", "timestamp_epoch": "1722307129.228943000" }, { "tcp_stream": 13, "frame_number": 166, "display_filter": "frame.number == 166", "timestamp_epoch": "1722307129.240013000" }, { "tcp_stream": 13, "frame_number": 168, "display_filter": "frame.number == 168", "timestamp_epoch": "1722307129.240882000" }, { "tcp_stream": 14, "frame_number": 182, "display_filter": "frame.number == 182", "timestamp_epoch": "1722307129.244452000" }, { "tcp_stream": 16, "frame_number": 223, "display_filter": "frame.number == 223", "timestamp_epoch": "1722307129.275385000" }, { "tcp_stream": 19, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1722307129.433463000" }, { "tcp_stream": 22, "frame_number": 309, "display_filter": "frame.number == 309", "timestamp_epoch": "1722307129.557404000" }, { "tcp_stream": 23, "frame_number": 321, "display_filter": "frame.number == 321", "timestamp_epoch": "1722307129.558803000" }, { "tcp_stream": 29, "frame_number": 572, "display_filter": "frame.number == 572", "timestamp_epoch": "1722307130.012604000" }, { "tcp_stream": 30, "frame_number": 580, "display_filter": "frame.number == 580", "timestamp_epoch": "1722307130.013677000" }, { "tcp_stream": 30, "frame_number": 582, "display_filter": "frame.number == 582", "timestamp_epoch": "1722307130.014230000" } ] }, { "id": "identity-d0264f3d9bc8ad06f5c3cfc9", "type": "identity", "label": "domain: WIRESHARKWORKSH", "value": "WIRESHARKWORKSH", "source": "deterministic-pcap-analysis", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "172.16.1.66" ], "identity_type": "domain", "frame_evidence": [ { "tcp_stream": 19, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1722307129.433463000" } ] }, { "id": "identity-3246a1fd6f810296d1b5db88", "type": "identity", "label": "full-name: Clark Collier", "value": "Clark Collier", "source": "deterministic-pcap-analysis", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "172.16.1.66" ], "identity_type": "full-name", "frame_evidence": [ { "tcp_stream": 21, "frame_number": 1070, "display_filter": "frame.number == 1070", "timestamp_epoch": "1722307152.793528000" } ] }, { "id": "identity-f897e3a088d28332cde22f24", "type": "identity", "label": "hostname: DESKTOP-SKBR25F", "value": "DESKTOP-SKBR25F", "source": "deterministic-pcap-analysis", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "172.16.1.66" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 0, "frame_number": 29, "display_filter": "frame.number == 29", "timestamp_epoch": "1722307129.035395000" }, { "udp_stream": 0, "frame_number": 30, "display_filter": "frame.number == 30", "timestamp_epoch": "1722307129.035693000" }, { "tcp_stream": 19, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1722307129.433463000" }, { "udp_stream": 0, "frame_number": 499, "display_filter": "frame.number == 499", "timestamp_epoch": "1722307129.784130000" }, { "udp_stream": 0, "frame_number": 500, "display_filter": "frame.number == 500", "timestamp_epoch": "1722307129.784176000" }, { "udp_stream": 0, "frame_number": 613, "display_filter": "frame.number == 613", "timestamp_epoch": "1722307130.534452000" }, { "udp_stream": 0, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1722307130.534562000" }, { "udp_stream": 0, "frame_number": 617, "display_filter": "frame.number == 617", "timestamp_epoch": "1722307131.299702000" }, { "udp_stream": 0, "frame_number": 618, "display_filter": "frame.number == 618", "timestamp_epoch": "1722307131.299750000" }, { "udp_stream": 15, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1722307135.129046000" }, { "udp_stream": 15, "frame_number": 682, "display_filter": "frame.number == 682", "timestamp_epoch": "1722307135.136488000" }, { "udp_stream": 15, "frame_number": 9900, "display_filter": "frame.number == 9900", "timestamp_epoch": "1722307270.485251000" }, { "tcp_stream": 114, "frame_number": 9913, "display_filter": "frame.number == 9913", "timestamp_epoch": "1722307270.497131000" }, { "udp_stream": 15, "frame_number": 9919, "display_filter": "frame.number == 9919", "timestamp_epoch": "1722307270.499929000" }, { "udp_stream": 15, "frame_number": 9922, "display_filter": "frame.number == 9922", "timestamp_epoch": "1722307270.506708000" }, { "tcp_stream": 115, "frame_number": 9992, "display_filter": "frame.number == 9992", "timestamp_epoch": "1722307300.509737000" }, { "udp_stream": 15, "frame_number": 9998, "display_filter": "frame.number == 9998", "timestamp_epoch": "1722307300.512178000" }, { "udp_stream": 15, "frame_number": 10001, "display_filter": "frame.number == 10001", "timestamp_epoch": "1722307300.520305000" }, { "tcp_stream": 116, "frame_number": 10050, "display_filter": "frame.number == 10050", "timestamp_epoch": "1722307330.539799000" }, { "udp_stream": 15, "frame_number": 10056, "display_filter": "frame.number == 10056", "timestamp_epoch": "1722307330.543637000" } ] }, { "id": "identity-1bc83fed43574ff0a22b9b2b", "type": "identity", "label": "netbios-group: WIRESHARKWORKSH", "value": "WIRESHARKWORKSH", "source": "deterministic-pcap-analysis", "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [], "identity_type": "netbios-group", "frame_evidence": [ { "udp_stream": 0, "frame_number": 31, "display_filter": "frame.number == 31", "timestamp_epoch": "1722307129.035966000" }, { "udp_stream": 0, "frame_number": 501, "display_filter": "frame.number == 501", "timestamp_epoch": "1722307129.784191000" }, { "udp_stream": 0, "frame_number": 615, "display_filter": "frame.number == 615", "timestamp_epoch": "1722307130.534744000" }, { "udp_stream": 0, "frame_number": 616, "display_filter": "frame.number == 616", "timestamp_epoch": "1722307131.299650000" }, { "udp_stream": 0, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1722307132.084215000" }, { "udp_stream": 0, "frame_number": 627, "display_filter": "frame.number == 627", "timestamp_epoch": "1722307132.847008000" }, { "udp_stream": 0, "frame_number": 673, "display_filter": "frame.number == 673", "timestamp_epoch": "1722307133.597005000" }, { "udp_stream": 0, "frame_number": 679, "display_filter": "frame.number == 679", "timestamp_epoch": "1722307134.362626000" } ] }, { "id": "artifact-0029b7a19d1171e3349a999d", "type": "file-artifact", "label": "json", "value": "47729774d301b648e888dee3b5e215d63adabb069700e1d81671fcbdfb80e4bb", "sha256": "47729774d301b648e888dee3b5e215d63adabb069700e1d81671fcbdfb80e4bb", "source": "deterministic-pcap-analysis", "size_bytes": 294, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-f9f6d98fa9175099b7940acb", "type": "file-artifact", "label": "connecttest.txt", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "sha256": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "source": "deterministic-pcap-analysis", "size_bytes": 22, "source_ref": "2024-07-30-traffic-analysis-exercise.pcap", "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "source_refs": [ "2024-07-30-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "text/plain" } ], "evidence_edges": [], "timeline": [ { "at": "2026-09-19T12:50:21.580Z", "event": "Added Log/PCAP analysis 2024-07-30-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2024-07-30-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 0 }, { "at": "2026-09-19T12:58:11.036Z", "event": "Added Log/PCAP analysis 2024-07-30-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2024-07-30-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 0 } ], "created_at": "2026-09-19T12:50:18.837655+00:00", "updated_at": "2026-09-19T12:58:11.056274+00:00" }