{ "id": "0d46927d-003d-4d7f-bc0d-3e85ca1411b9", "name": "PCAP verified workflow 2024-08-15 20260919", "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.", "status": "active", "domain": "enterprise-attack", "actor_ids": [], "technique_ids": [ "T1071.001" ], "report_ids": [], "evidence_nodes": [ { "id": "log-pcap:b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "type": "log-pcap-analysis", "label": "2024-08-15-traffic-analysis-exercise.pcap", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2024-08-15-traffic-analysis-exercise.pcap\nCapture SHA-256: `e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c`\nSemantic result SHA-256: `f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 18189 packets across 75 IP endpoints and 698 transport flows. Observed 430 DNS events, 404 HTTP requests, 174 TLS ClientHello events, and 18 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 0 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 18189\n- Duration: 1962.204948 seconds\n- Captured bytes: 11674125\n- Endpoints: 75\n- Flows: 698\n\n## Deterministic findings\n\n### HIGH — Periodic HTTP callback pattern\n\nRepeated requests have a stable cadence consistent with automated callback or beacon behavior.\n\nRule: `periodic-http-callbacks@pcap-rules-v3`; confidence: 0.88; evidence: frame 11028 / TCP stream 142, frame 11505 / TCP stream 145, frame 11619 / TCP stream 151, frame 11688 / TCP stream 155, frame 11962 / TCP stream 164.\n\nMetrics: `{\"destination\":\"72.5.43.29\",\"host\":\"72.5.43.29\",\"median_absolute_deviation\":1.037,\"median_interval_seconds\":5.685,\"method\":\"GET\",\"port\":80,\"request_count\":303,\"source\":\"10.8.15.133\",\"uri\":\"/\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 56, frame 60, frame 962, frame 964, frame 2106.\n\nMetrics: `{\"domain\":\"wpad.lafontainebleu.org\",\"response_count\":20,\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 281 / TCP stream 11, frame 285 / TCP stream 11, frame 292 / TCP stream 11, frame 297 / TCP stream 11, frame 312 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.8.15.4\",\"event_count\":69,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 37 / TCP stream 0, frame 288 / TCP stream 19, frame 295 / TCP stream 19, frame 300 / TCP stream 19, frame 304 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.8.15.4\",\"event_count\":143,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1096 / TCP stream 1, frame 1098 / TCP stream 1, frame 1100 / TCP stream 1, frame 1102 / TCP stream 1, frame 1104 / TCP stream 1.\n\nMetrics: `{\"destination\":\"10.8.15.4\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 282 / TCP stream 11, frame 287 / TCP stream 11, frame 293 / TCP stream 11, frame 298 / TCP stream 11, frame 313 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.8.15.133\",\"event_count\":69,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.8.15.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 39 / TCP stream 0, frame 290 / TCP stream 19, frame 299 / TCP stream 19, frame 302 / TCP stream 19, frame 305 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.8.15.133\",\"event_count\":113,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.8.15.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1097 / TCP stream 1, frame 1099 / TCP stream 1, frame 1101 / TCP stream 1, frame 1103 / TCP stream 1, frame 1105 / TCP stream 1.\n\nMetrics: `{\"destination\":\"10.8.15.133\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.8.15.4\"}`\n\n## ATT&CK candidates\n\n- T1071.001 Application Layer Protocol: Web Protocols (command-and-control), confidence=0.85, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `desktop-h8alzbv$`; client IPs: 10.8.15.133; frames: 151, 166, 169, 173, 187\n- account: `plucero`; client IPs: 10.8.15.133; frames: 975, 983, 985, 997, 1011\n- full-name: `Pierce Lucero`; client IPs: 10.8.15.133; frames: 1111\n- hostname: `DESKTOP-H8ALZBV`; client IPs: 10.8.15.133; frames: 1, 3, 5, 30, 58\n- netbios-group: `LAFONTAINEBLEU`; client IPs: unbound subject; frames: 31, 57, 103, 447\n\n## IOC and artifact candidates\n\n- domain: `a1834.dscg2.akamai.net`; roles: dns-cname\n- domain: `acroipm2.adobe.com`; roles: dns-query, http-host\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `app-edge.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `armmf.adobe.com`; roles: dns-query, tls-sni\n- domain: `assets.msn.com`; roles: dns-query, tls-sni\n- domain: `blob.mwh03prdstf02a.store.core.windows.net`; roles: dns-cname\n- domain: `browser.events.data.msn.com`; roles: dns-query, tls-sni\n- domain: `business.bing.com`; roles: dns-query, tls-sni\n- domain: `business.checkfedexexp.com`; roles: dns-query, tls-sni\n- domain: `bzib.nelreports.net`; roles: dns-query, tls-sni\n- domain: `c-msn-com-nsatc.trafficmanager.net`; roles: dns-cname\n- domain: `c-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `c.bing.com`; roles: dns-query, tls-sni\n- domain: `c.msn.com`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `cxcs.microsoft.net`; roles: dns-query, tls-sni\n- domain: `default.exp-tas.com`; roles: dns-query, tls-sni\n- domain: `displaycatalog.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `dl-edge.smartscreen.microsoft.com`; roles: dns-query\n- domain: `dual-s-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `ecn-us.dev.virtualearth.net`; roles: dns-query, tls-sni\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `edge-consumer-static.azureedge.net`; roles: dns-query, tls-sni\n- domain: `edge-microsoft-com.dual-a-0036.a-msedge.net`; roles: dns-cname\n- domain: `edge.microsoft.com`; roles: dns-query, tls-sni\n- domain: `edgeservices.bing.com`; roles: dns-query, tls-sni\n- domain: `fd.api.iris.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.msft.com.trafficmanager.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fp.msedge.net`; roles: dns-query, tls-sni\n- domain: `g.live.com`; roles: dns-query, tls-sni\n- domain: `go.microsoft.com`; roles: dns-query, tls-sni\n- domain: `img-s-msn-com.akamaized.net`; roles: dns-query, tls-sni\n- domain: `img.s-msn.com`; roles: dns-query, tls-sni\n- domain: `licensing.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `mobile.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `mrodevicemgr.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `msedge.b.tlu.dl.delivery.mp.microsoft.com`; roles: dns-query, http-host\n- domain: `nav-edge.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `nav.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ntp.msn.com`; roles: dns-query, tls-sni\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `officeclient.microsoft.com`; roles: dns-query, tls-sni\n- domain: `oneclient.sfx.ms`; roles: dns-query, tls-sni\n- domain: `oneocsp.microsoft.com`; roles: dns-query, http-host\n- domain: `ow1.res.office365.com`; roles: dns-query, tls-sni\n- domain: `prod.mrodevicemgr.live.com.akadns.net`; roles: dns-cname\n- domain: `pti.store.microsoft.com`; roles: dns-query\n- domain: `quote.checkfedexexp.com`; roles: dns-query, http-host\n- domain: `r-msftstatic-com.a-0016.a-msedge.net`; roles: dns-cname\n- domain: `r.bing.com`; roles: dns-query, tls-sni\n- domain: `r.msftstatic.com`; roles: dns-query, tls-sni\n- domain: `sb.scorecardresearch.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `srtb.msn.com`; roles: dns-query, tls-sni\n- domain: `storecatalogrevocation.storequality.microsoft.com`; roles: dns-query, tls-sni\n- domain: `th.bing.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `weathermapdata.blob.core.windows.net`; roles: dns-query, tls-sni\n- domain: `win-jegjix7q9rs.lafontainebleu.org`; roles: dns-query\n- domain: `windows.msn.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.lafontainebleu.org`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.msftconnecttest.com`; roles: dns-query, http-host\n- domain: `www.msn.com`; roles: dns-query, tls-sni\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `10.8.15.133`; roles: network-endpoint\n- ipv4: `10.8.15.255`; roles: network-endpoint\n- ipv4: `10.8.15.4`; roles: dns-answer, network-endpoint\n- ipv4: `104.21.55.70`; roles: dns-answer, network-endpoint\n- ipv4: `104.40.82.182`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.237`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.239`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.57`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.4.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.93`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.6.158`; roles: dns-answer, network-endpoint\n- ipv4: `13.70.79.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.85.23.206`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.13`; roles: dns-answer, network-endpoint\n- ipv4: `172.67.170.159`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.115`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.14`; roles: dns-answer\n- ipv4: `18.160.156.41`; roles: dns-answer\n- ipv4: `18.160.156.89`; roles: dns-answer\n- ipv4: `199.232.210.172`; roles: dns-answer, network-endpoint\n- ipv4: `199.232.214.172`; roles: dns-answer\n- ipv4: `20.10.31.115`; roles: dns-answer, network-endpoint\n- ipv4: `20.125.209.212`; roles: dns-answer, network-endpoint\n- ipv4: `20.163.45.186`; roles: dns-answer\n- ipv4: `20.189.173.9`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.157.9`; roles: dns-answer\n- ipv4: `20.241.44.114`; roles: dns-answer, network-endpoint\n- ipv4: `20.25.227.174`; roles: dns-answer, network-endpoint\n- ipv4: `20.3.0.251`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.65.88`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.65.94`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.72.131`; roles: dns-answer, network-endpoint\n- ipv4: `20.44.10.122`; roles: dns-answer, network-endpoint\n- ipv4: `20.60.228.1`; roles: dns-answer, network-endpoint\n- ipv4: `20.96.153.111`; roles: dns-answer, network-endpoint\n- ipv4: `20.99.184.37`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.219`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.222`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.237`; roles: dns-answer\n- ipv4: `204.79.197.239`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.194.68.140`; roles: dns-answer, network-endpoint\n- ipv4: `23.195.200.230`; roles: dns-answer, network-endpoint\n- ipv4: `23.205.110.12`; roles: dns-answer, network-endpoint\n- ipv4: `23.205.110.48`; roles: dns-answer, network-endpoint\n- ipv4: `23.205.110.59`; roles: dns-answer\n- ipv4: `23.205.110.62`; roles: dns-answer\n- ipv4: `23.215.55.139`; roles: dns-answer, network-endpoint\n- ipv4: `23.215.55.144`; roles: dns-answer\n- ipv4: `23.220.103.18`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.103.72`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.103.78`; roles: dns-answer\n- ipv4: `23.220.103.8`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.251.196`; roles: dns-answer\n- ipv4: `23.220.251.208`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.36.164`; roles: dns-answer, network-endpoint\n- ipv4: `23.223.31.29`; roles: dns-answer\n- ipv4: `23.223.31.31`; roles: dns-answer\n- ipv4: `23.223.31.32`; roles: dns-answer\n- ipv4: `23.223.31.33`; roles: dns-answer\n- ipv4: `23.223.31.34`; roles: dns-answer, network-endpoint\n- ipv4: `23.223.31.36`; roles: dns-answer\n- ipv4: `23.223.31.37`; roles: dns-answer\n- ipv4: `23.223.31.39`; roles: dns-answer\n- ipv4: `23.223.31.40`; roles: dns-answer\n- ipv4: `23.33.138.184`; roles: dns-answer, network-endpoint\n- ipv4: `23.43.244.167`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.196`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.197`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.198`; roles: dns-answer\n- ipv4: `23.53.13.199`; roles: dns-answer\n- ipv4: `23.53.13.200`; roles: dns-answer\n- ipv4: `23.53.13.202`; roles: dns-answer\n- ipv4: `23.53.13.203`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.204`; roles: dns-answer\n- ipv4: `23.53.13.205`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.206`; roles: dns-answer\n- ipv4: `23.53.13.207`; roles: dns-answer\n- ipv4: `23.53.13.208`; roles: dns-answer\n- ipv4: `23.56.233.15`; roles: dns-answer, network-endpoint\n- ipv4: `23.60.57.94`; roles: dns-answer, network-endpoint\n- ipv4: `23.63.205.134`; roles: dns-answer, network-endpoint\n- ipv4: `23.96.180.189`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.126.29.10`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.11`; roles: dns-answer\n- ipv4: `40.126.29.12`; roles: dns-answer\n- ipv4: `40.126.29.13`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.15`; roles: dns-answer\n- ipv4: `40.126.29.5`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.6`; roles: dns-answer\n- ipv4: `40.126.29.7`; roles: dns-answer\n- ipv4: `40.126.29.8`; roles: dns-answer\n- ipv4: `40.126.29.9`; roles: dns-answer\n- ipv4: `51.116.253.170`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.0.136`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.0.142`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.38`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.123.128.254`; roles: dns-answer, network-endpoint\n- ipv4: `52.123.129.254`; roles: dns-answer\n- ipv4: `52.137.106.217`; roles: dns-answer, network-endpoint\n- ipv4: `52.152.180.153`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.117.170`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.215`; roles: dns-answer, network-endpoint\n- ipv4: `72.5.43.29`; roles: http-host, network-endpoint\n- ja3: `08c552d3bb717cfa625b1c2e6293fbc3`; roles: tls-client-fingerprint\n- ja3: `091f51a7a1c3a4504a224cc081ce9cee`; roles: tls-client-fingerprint\n- ja3: `09218b185cadc5bc9ac32dd4af1d80ba`; roles: tls-client-fingerprint\n- ja3: `0940eef199c4e4a2d7fff1702ca8e267`; roles: tls-client-fingerprint\n- ja3: `09d2a38ae19e8be7fa018ad87e43b2ff`; roles: tls-client-fingerprint\n- ja3: `11156bf1dc969c54ae91bbfe52874a88`; roles: tls-client-fingerprint\n- ja3: `11702f6f4b7b9c9b2999ebcf2c354984`; roles: tls-client-fingerprint\n- ja3: `173448d57b47fba3f0be89e6bd4599af`; roles: tls-client-fingerprint\n- ja3: `218b9f26907447fdbf2c8a52418444b7`; roles: tls-client-fingerprint\n- ja3: `22833c8ba3c4d8d22ef4b3ff2fdd992e`; roles: tls-client-fingerprint\n- ja3: `258a5a1e95b8a911872bae9081526644`; roles: tls-client-fingerprint\n- ja3: `25e0b3677a2832677e0c136c73a02311`; roles: tls-client-fingerprint\n- ja3: `26abc27bb714c3e30049154ed7f03422`; roles: tls-client-fingerprint\n- ja3: `2f7a1c53b0a1abfffcdeff101f69baf4`; roles: tls-client-fingerprint\n- ja3: `33717d60eef91a9c824c343c9b904387`; roles: tls-client-fingerprint\n- ja3: `34f7d1c3fe8b7bb4b8cee1ceefa986a5`; roles: tls-client-fingerprint\n- ja3: `38ff17125ac547fdaf43cbc78d13056e`; roles: tls-client-fingerprint\n- ja3: `3c293bdf2a25c07559b560ba86debc77`; roles: tls-client-fingerprint\n- ja3: `3c4eb72b882d4d1442c67ce73f1292a9`; roles: tls-client-fingerprint\n- ja3: `3ec074ef84f1118c439e56727227cea3`; roles: tls-client-fingerprint\n- ja3: `46a78af27de56cd4c85b04f57deb3f79`; roles: tls-client-fingerprint\n- ja3: `46f5131e766d248db0248a86c494b71c`; roles: tls-client-fingerprint\n- ja3: `48ae6b908317f4f14e23cfd06798d78a`; roles: tls-client-fingerprint\n- ja3: `49122e3f86717743d247b0e57255881e`; roles: tls-client-fingerprint\n- ja3: `49a844a20d27ed5590377789c1ff9a1c`; roles: tls-client-fingerprint\n- ja3: `4d09d5e0a7539f71bfd5ab61fc77938e`; roles: tls-client-fingerprint\n- ja3: `4e00cf4e4608830803d4914864014e8c`; roles: tls-client-fingerprint\n- ja3: `4e96df7dcbca32c279f0af5a0930aa87`; roles: tls-client-fingerprint\n- ja3: `589c33f5c966de68b38bf824fc667e6b`; roles: tls-client-fingerprint\n- ja3: `5919f6108f098e14c2f37619021ebd4d`; roles: tls-client-fingerprint\n- ja3: `5c263245de4d50106d8e0d6087b0fcc5`; roles: tls-client-fingerprint\n- ja3: `5c576ee905a82c07ad7987fce4f39cfe`; roles: tls-client-fingerprint\n- ja3: `65005c9d9ae0f0ebeaf22c210571d482`; roles: tls-client-fingerprint\n- ja3: `68b1b54a6edfe7729708738380263a3a`; roles: tls-client-fingerprint\n- ja3: `6925f81e11a98d706da3f0cd0f7bc648`; roles: tls-client-fingerprint\n- ja3: `6a5d235ee78c6aede6a61448b4e9ff1e`; roles: tls-client-fingerprint\n- ja3: `736a3b58b94abd6c394392ae94f501c3`; roles: tls-client-fingerprint\n- ja3: `775ceba0b13f74a42447a14045d31fcc`; roles: tls-client-fingerprint\n- ja3: `973e5ee0c53bfc4aaff964c70002dcc3`; roles: tls-client-fingerprint\n- ja3: `a2fa4f21077551ea651d383707835d7b`; roles: tls-client-fingerprint\n- ja3: `ab9d07f6268ed23da4f708263cc7ed49`; roles: tls-client-fingerprint\n- ja3: `af8bdb53babadf751a582d1ed25c0eda`; roles: tls-client-fingerprint\n- ja3: `b1e1912cc21fd3c163c8ddf91f56123a`; roles: tls-client-fingerprint\n- ja3: `b4162be74fb260b4576b62481ee819de`; roles: tls-client-fingerprint\n- ja3: `b74979b1b06e1413e302d2c817ca33db`; roles: tls-client-fingerprint\n- ja3: `b7e6d0a42505ebdcb4ca793e16825d04`; roles: tls-client-fingerprint\n- ja3: `c44656a187a470fa1e85dfc1707da993`; roles: tls-client-fingerprint\n- ja3: `c6e2484ca73f97e2cbb72bacc9c9916b`; roles: tls-client-fingerprint\n- ja3: `cd51c3a587eeacaf4f714e3920764550`; roles: tls-client-fingerprint\n- ja3: `d108c2f321a2af5781ed4b63b5b28472`; roles: tls-client-fingerprint\n- ja3: `e978fa4306e6fe19e2d404321d215b00`; roles: tls-client-fingerprint\n- ja3: `eb6eb038162eb12fda714a4a5860dc83`; roles: tls-client-fingerprint\n- ja3: `ec93fbad48fbc839a6e52e85c3f5af8d`; roles: tls-client-fingerprint\n- ja3: `f0a0d117d2207afbb65df9114a8c6321`; roles: tls-client-fingerprint\n- ja3: `f957ed04f16c95c78f474482505d5e89`; roles: tls-client-fingerprint\n- ja3: `fc2ac8b293f08f588c5b93dd8b87eef6`; roles: tls-client-fingerprint\n- ja3: `fe624dd6795521519b6fbbd082375f4f`; roles: tls-client-fingerprint\n- sha256: `0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2`; roles: exported-object\n- sha256: `261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594`; roles: exported-object\n- sha256: `2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6`; roles: exported-object\n- sha256: `41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b`; roles: exported-object\n- sha256: `5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4`; roles: exported-object\n- sha256: `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; roles: exported-object\n- sha256: `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; roles: exported-object\n- sha256: `6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c`; roles: exported-object\n- sha256: `798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5`; roles: exported-object\n- sha256: `8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47`; roles: exported-object\n- sha256: `9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499`; roles: exported-object\n- sha256: `b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6`; roles: exported-object\n- sha256: `be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252`; roles: exported-object\n- sha256: `c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110`; roles: exported-object\n- sha256: `dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123`; roles: exported-object\n- sha256: `f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64`; roles: exported-object\n- sha256: `f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e`; roles: exported-object\n- sha256: `f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://72.5.43.29/`; roles: http-request\n- url: `http://72.5.43.29/data/0f60a3e7baecf2748b1c8183ed37d1e4`; roles: http-request\n- url: `http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt`; roles: http-request\n- url: `http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d`; roles: http-request\n- url: `http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d`; roles: http-request\n- url: `http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D`; roles: http-request\n- url: `http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215`; roles: http-request\n- url: `http://www.msftconnecttest.com/connecttest.txt`; roles: http-request\n- user_agent: `Microsoft BITS/7.8`; roles: http-client\n- user_agent: `Microsoft Edge/127.0.2651.98 Windows`; roles: http-client\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0`; roles: http-client\n- exported object `managements%3f16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215`; SHA-256 `798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5`; size 2767804 bytes\n Static content: `{\"content_kind\":\"zip\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `0f60a3e7baecf2748b1c8183ed37d1e4`; SHA-256 `b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6`; size 159232 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":159232,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `%2f(3)`; SHA-256 `261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594`; size 305148 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(3)`; SHA-256 `8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47`; size 108543 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(2)`; SHA-256 `6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c`; size 29990 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d`; SHA-256 `f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332`; size 18882 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(1)`; SHA-256 `be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252`; size 13809 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(3)`; SHA-256 `9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499`; size 7930 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(2)`; SHA-256 `41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b`; size 4630 bytes\n- exported object `MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D`; SHA-256 `2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6`; size 1782 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(1)`; SHA-256 `0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2`; size 1340 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d`; SHA-256 `c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110`; size 1120 bytes\n- exported object `%2f(5)`; SHA-256 `f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64`; size 732 bytes\n- exported object `%2f(1)`; SHA-256 `5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4`; size 124 bytes\n- exported object `%2f(10)`; SHA-256 `f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e`; size 94 bytes\n- exported object `%2f`; SHA-256 `dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123`; size 32 bytes\n- exported object `connecttest.txt`; SHA-256 `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; size 22 bytes\n- exported object `ProcessMAU.txt`; SHA-256 `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; size 4 bytes\n\n## Actor similarity leads\n\n- Orangeworm (G0071): 50% TTP overlap. This is an investigation lead, not attribution.\n- SilverTerrier (G0083): 25% TTP overlap. This is an investigation lead, not attribution.\n- RedEcho (G1042): 20% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- APT18 (G0026): 8% TTP overlap. This is an investigation lead, not attribution.\n- FIN4 (G0085): 8% TTP overlap. This is an investigation lead, not attribution.\n- Dark Caracal (G0070): 8% TTP overlap. This is an investigation lead, not attribution.\n- TA551 (G0127): 7% TTP overlap. This is an investigation lead, not attribution.\n- BITTER (G1002): 6% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `d16753b47de8ecdb023abba50189bbcdbc68cf5a1d4b318a005b594ca7c48206`; recorded 2026-09-19T12:08:57.190731+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":272,\"observable_limit\":5000,\"observables_checked\":272,\"observables_total\":272,\"prior_case_limit_reached\":false,\"prior_cases_checked\":8,\"truncated\":false}`\n\n- Catalog T1071.001: https://attack.mitre.org/techniques/T1071/001; detection strategies: [{\"attack_id\":\"DET0027\",\"name\":\"Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets\",\"stix_id\":\"x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc\"}]\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 42 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 46 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 33 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 53 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 36 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 69 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":18,\"exported_objects\":322,\"hashed_bytes\":3449794,\"hashed_objects\":322,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":18,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":18}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 5/5, observables 272/272, artifacts 18/18. Full returned inventory is in the JSON result.\n", "summary": "Decoded 18189 packets across 75 IP endpoints and 698 transport flows. Observed 430 DNS events, 404 HTTP requests, 174 TLS ClientHello events, and 18 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 0 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net", "confidence": 1, "description": "dns-cname; frame 3816 / UDP stream 47, frame 3828 / UDP stream 48, frame 3829 / UDP stream 48, frame 12746 / UDP stream 117, frame 12747 / UDP stream 116" }, { "type": "domain", "value": "acroipm2.adobe.com", "confidence": 1, "description": "dns-query, http-host; frame 15338 / UDP stream 135, frame 15339 / UDP stream 135, frame 15340 / UDP stream 135, frame 15341 / UDP stream 135, frame 15345 / TCP stream 300" }, { "type": "domain", "value": "api.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3841 / UDP stream 63, frame 3842 / UDP stream 64, frame 3864 / UDP stream 63, frame 3884 / UDP stream 64, frame 12585 / UDP stream 110 +7 more" }, { "type": "domain", "value": "app-edge.smartscreen.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 8661 / UDP stream 88, frame 8662 / UDP stream 89, frame 8682 / UDP stream 90, frame 8683 / UDP stream 91, frame 8701 / UDP stream 22 +9 more" }, { "type": "domain", "value": "armmf.adobe.com", "confidence": 1, "description": "dns-query, tls-sni; frame 15349 / UDP stream 136, frame 15350 / UDP stream 136, frame 15354 / TCP stream 301" }, { "type": "domain", "value": "assets.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1286 / UDP stream 14, frame 1293 / UDP stream 14, frame 3833 / UDP stream 61, frame 3834 / UDP stream 62, frame 3845 / UDP stream 62 +15 more" }, { "type": "domain", "value": "blob.mwh03prdstf02a.store.core.windows.net", "confidence": 1, "description": "dns-cname; frame 12103 / UDP stream 99" }, { "type": "domain", "value": "browser.events.data.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3803 / UDP stream 53, frame 3804 / UDP stream 54, frame 3823 / UDP stream 53, frame 3835 / UDP stream 54, frame 3855 / TCP stream 90 +5 more" }, { "type": "domain", "value": "business.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3662 / UDP stream 45, frame 3663 / UDP stream 46, frame 3664 / UDP stream 45, frame 5368 / UDP stream 46, frame 3672 / TCP stream 89 +3 more" }, { "type": "domain", "value": "business.checkfedexexp.com", "confidence": 1, "description": "dns-query, tls-sni; frame 9026 / UDP stream 38, frame 9027 / UDP stream 38, frame 9031 / TCP stream 124" }, { "type": "domain", "value": "bzib.nelreports.net", "confidence": 1, "description": "dns-query, tls-sni; frame 8906 / UDP stream 93, frame 8907 / UDP stream 94, frame 8908 / UDP stream 94, frame 8910 / UDP stream 93, frame 8922 / TCP stream 122" }, { "type": "domain", "value": "c-msn-com-nsatc.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 3838 / UDP stream 57, frame 3839 / UDP stream 58" }, { "type": "domain", "value": "c-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 11763 / UDP stream 99, frame 11764 / UDP stream 99, frame 11770 / TCP stream 158, frame 11774 / TCP stream 158" }, { "type": "domain", "value": "c.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3826 / UDP stream 59, frame 3827 / UDP stream 60, frame 3836 / UDP stream 59, frame 3850 / UDP stream 60, frame 3868 / TCP stream 92 +1 more" }, { "type": "domain", "value": "c.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3824 / UDP stream 57, frame 3825 / UDP stream 58, frame 3838 / UDP stream 57, frame 3839 / UDP stream 58, frame 3905 / TCP stream 93" }, { "type": "domain", "value": "client.wns.windows.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1238 / UDP stream 14, frame 1241 / UDP stream 14, frame 1252 / TCP stream 58, frame 8850 / TCP stream 119" }, { "type": "domain", "value": "cxcs.microsoft.net", "confidence": 1, "description": "dns-query, tls-sni; frame 11900 / UDP stream 99, frame 11902 / UDP stream 99, frame 11908 / TCP stream 162" }, { "type": "domain", "value": "default.exp-tas.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3541 / UDP stream 38, frame 3542 / UDP stream 38, frame 3546 / TCP stream 86, frame 3549 / TCP stream 86" }, { "type": "domain", "value": "displaycatalog.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 13848 / UDP stream 100, frame 13849 / UDP stream 100, frame 13850 / UDP stream 100, frame 13854 / TCP stream 221" }, { "type": "domain", "value": "dl-edge.smartscreen.microsoft.com", "confidence": 1, "description": "dns-query; frame 6474 / UDP stream 86, frame 6475 / UDP stream 87, frame 6476 / UDP stream 86, frame 6477 / UDP stream 87" }, { "type": "domain", "value": "dual-s-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 11691 / UDP stream 99, frame 11696 / UDP stream 99, frame 11700 / TCP stream 156, frame 11704 / TCP stream 156" }, { "type": "domain", "value": "ecn-us.dev.virtualearth.net", "confidence": 1, "description": "dns-query, tls-sni; frame 5420 / UDP stream 75, frame 5421 / UDP stream 76, frame 5423 / UDP stream 76, frame 5450 / UDP stream 75, frame 5509 / TCP stream 105" }, { "type": "domain", "value": "ecs.office.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2997 / UDP stream 14, frame 3001 / UDP stream 14, frame 14634 / UDP stream 131, frame 14636 / UDP stream 131, frame 15758 / UDP stream 136 +15 more" }, { "type": "domain", "value": "edge-consumer-static.azureedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 4395 / UDP stream 68, frame 4396 / UDP stream 69, frame 4404 / UDP stream 68, frame 4413 / UDP stream 69, frame 4414 / UDP stream 69 +2 more" }, { "type": "domain", "value": "edge-microsoft-com.dual-a-0036.a-msedge.net", "confidence": 1, "description": "dns-cname; frame 2109 / UDP stream 25" }, { "type": "domain", "value": "edge.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2107 / UDP stream 24, frame 2108 / UDP stream 25, frame 2109 / UDP stream 25, frame 2115 / UDP stream 24, frame 2280 / UDP stream 28 +15 more" }, { "type": "domain", "value": "edgeservices.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2314 / UDP stream 30, frame 2315 / UDP stream 31, frame 2316 / UDP stream 30, frame 2317 / UDP stream 31, frame 2329 / UDP stream 32 +11 more" }, { "type": "domain", "value": "fd.api.iris.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1239 / UDP stream 22, frame 1242 / UDP stream 22, frame 11684 / UDP stream 38, frame 11690 / UDP stream 38, frame 11776 / UDP stream 38 +8 more" }, { "type": "domain", "value": "fe2cr.update.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 14766 / UDP stream 131, frame 14767 / UDP stream 131, frame 14771 / TCP stream 269" }, { "type": "domain", "value": "fe2cr.update.msft.com.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 14767 / UDP stream 131" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 13888 / UDP stream 126, frame 13889 / UDP stream 126, frame 13892 / UDP stream 126, frame 13898 / TCP stream 224" }, { "type": "domain", "value": "fp.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 11801 / UDP stream 99, frame 11802 / UDP stream 99, frame 11806 / TCP stream 159, frame 11810 / TCP stream 159" }, { "type": "domain", "value": "g.live.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2996 / UDP stream 22, frame 2999 / UDP stream 22, frame 14497 / UDP stream 128, frame 14498 / UDP stream 128, frame 14499 / UDP stream 128 +2 more" }, { "type": "domain", "value": "go.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 72 / UDP stream 9, frame 73 / UDP stream 9, frame 77 / TCP stream 3, frame 107 / TCP stream 4, frame 1198 / TCP stream 55 +8 more" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net", "confidence": 1, "description": "dns-query, tls-sni; frame 3797 / UDP stream 47, frame 3798 / UDP stream 48, frame 3816 / UDP stream 47, frame 3828 / UDP stream 48, frame 3829 / UDP stream 48 +6 more" }, { "type": "domain", "value": "img.s-msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 12769 / UDP stream 119, frame 12770 / UDP stream 120, frame 12808 / UDP stream 119, frame 12878 / UDP stream 120, frame 12880 / UDP stream 120 +1 more" }, { "type": "domain", "value": "licensing.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 15105 / UDP stream 133, frame 15106 / UDP stream 133, frame 15107 / UDP stream 133, frame 15111 / TCP stream 287" }, { "type": "domain", "value": "login.microsoftonline.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2244 / UDP stream 14, frame 2245 / UDP stream 14, frame 10379 / UDP stream 38, frame 10380 / UDP stream 38, frame 13820 / UDP stream 100 +11 more" }, { "type": "domain", "value": "mobile.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 727 / UDP stream 14, frame 728 / UDP stream 14, frame 842 / UDP stream 14, frame 843 / UDP stream 14, frame 17805 / UDP stream 151 +9 more" }, { "type": "domain", "value": "mrodevicemgr.officeapps.live.com", "confidence": 1, "description": "dns-query, tls-sni; frame 12259 / UDP stream 99, frame 12260 / UDP stream 99, frame 12261 / UDP stream 99, frame 12265 / TCP stream 185" }, { "type": "domain", "value": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "confidence": 1, "description": "dns-query, http-host; frame 10193 / UDP stream 38, frame 10194 / UDP stream 38, frame 10281 / UDP stream 38, frame 10283 / UDP stream 38, frame 10198 / TCP stream 127 +9 more" }, { "type": "domain", "value": "nav-edge.smartscreen.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 6371 / UDP stream 84, frame 6372 / UDP stream 85, frame 6373 / UDP stream 84, frame 6374 / UDP stream 85, frame 6379 / TCP stream 111" }, { "type": "domain", "value": "nav.smartscreen.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 15865 / UDP stream 139, frame 15866 / UDP stream 139, frame 15870 / TCP stream 338" }, { "type": "domain", "value": "ntp.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3654 / UDP stream 42, frame 3655 / UDP stream 43, frame 3656 / UDP stream 42, frame 3657 / UDP stream 44, frame 3658 / UDP stream 44 +4 more" }, { "type": "domain", "value": "odc.officeapps.live.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1491 / UDP stream 22, frame 1540 / UDP stream 22, frame 2998 / UDP stream 38, frame 3000 / UDP stream 38, frame 1585 / TCP stream 63 +1 more" }, { "type": "domain", "value": "officeclient.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 513 / UDP stream 14, frame 623 / UDP stream 14, frame 1345 / UDP stream 22, frame 1348 / UDP stream 22, frame 671 / TCP stream 32 +1 more" }, { "type": "domain", "value": "oneclient.sfx.ms", "confidence": 1, "description": "dns-query, tls-sni; frame 3063 / UDP stream 22, frame 3065 / UDP stream 22, frame 14524 / UDP stream 130, frame 14526 / UDP stream 130, frame 14527 / UDP stream 130 +2 more" }, { "type": "domain", "value": "oneocsp.microsoft.com", "confidence": 1, "description": "dns-query, http-host; frame 15879 / UDP stream 139, frame 15880 / UDP stream 139, frame 15884 / TCP stream 339" }, { "type": "domain", "value": "ow1.res.office365.com", "confidence": 1, "description": "dns-query, tls-sni; frame 11731 / UDP stream 99, frame 11732 / UDP stream 99, frame 11736 / TCP stream 157" }, { "type": "domain", "value": "prod.mrodevicemgr.live.com.akadns.net", "confidence": 1, "description": "dns-cname; frame 12261 / UDP stream 99" }, { "type": "domain", "value": "pti.store.microsoft.com", "confidence": 1, "description": "dns-query; frame 13828 / UDP stream 100, frame 13833 / UDP stream 100" }, { "type": "domain", "value": "quote.checkfedexexp.com", "confidence": 1, "description": "dns-query, http-host; frame 6200 / UDP stream 77, frame 6201 / UDP stream 78, frame 6202 / UDP stream 79, frame 6317 / UDP stream 81, frame 6318 / UDP stream 82 +11 more" }, { "type": "domain", "value": "r-msftstatic-com.a-0016.a-msedge.net", "confidence": 1, "description": "dns-cname; frame 4772 / UDP stream 73" }, { "type": "domain", "value": "r.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 4684 / UDP stream 70, frame 4685 / UDP stream 71, frame 4774 / UDP stream 70, frame 4778 / UDP stream 71, frame 4855 / TCP stream 102 +1 more" }, { "type": "domain", "value": "r.msftstatic.com", "confidence": 1, "description": "dns-query, tls-sni; frame 4686 / UDP stream 72, frame 4687 / UDP stream 73, frame 4772 / UDP stream 73, frame 4773 / UDP stream 72, frame 4864 / TCP stream 101 +3 more" }, { "type": "domain", "value": "sb.scorecardresearch.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3799 / UDP stream 49, frame 3800 / UDP stream 50, frame 3815 / UDP stream 50, frame 3822 / UDP stream 49, frame 3909 / TCP stream 96" }, { "type": "domain", "value": "settings-win.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 10406 / UDP stream 38, frame 10409 / UDP stream 38, frame 13884 / UDP stream 125, frame 13885 / UDP stream 125, frame 13886 / UDP stream 125 +2 more" }, { "type": "domain", "value": "srtb.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 4384 / UDP stream 66, frame 4385 / UDP stream 67, frame 4386 / UDP stream 66, frame 4387 / UDP stream 67, frame 12713 / UDP stream 112 +9 more" }, { "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 15160 / UDP stream 134, frame 15161 / UDP stream 134, frame 15164 / UDP stream 134, frame 15176 / UDP stream 134, frame 15177 / UDP stream 134 +1 more" }, { "type": "domain", "value": "th.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1584 / UDP stream 14, frame 1592 / UDP stream 14, frame 3146 / UDP stream 39, frame 3147 / UDP stream 40, frame 3148 / UDP stream 39 +15 more" }, { "type": "domain", "value": "v10.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 10904 / UDP stream 38, frame 10905 / UDP stream 38, frame 14085 / UDP stream 127, frame 14086 / UDP stream 127, frame 14088 / UDP stream 127 +15 more" }, { "type": "domain", "value": "v20.events.data.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1192 / UDP stream 14, frame 1194 / UDP stream 14, frame 10937 / UDP stream 38, frame 10939 / UDP stream 38, frame 1217 / TCP stream 56 +1 more" }, { "type": "domain", "value": "weathermapdata.blob.core.windows.net", "confidence": 1, "description": "dns-query, tls-sni; frame 12102 / UDP stream 99, frame 12103 / UDP stream 99, frame 12107 / TCP stream 175, frame 12111 / TCP stream 175" }, { "type": "domain", "value": "win-jegjix7q9rs.lafontainebleu.org", "confidence": 1, "description": "dns-query; frame 22 / UDP stream 4, frame 23 / UDP stream 4, frame 472 / UDP stream 14, frame 473 / UDP stream 14" }, { "type": "domain", "value": "windows.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1484 / UDP stream 14, frame 1485 / UDP stream 14, frame 12411 / UDP stream 100, frame 12416 / UDP stream 104, frame 12417 / UDP stream 105 +12 more" }, { "type": "domain", "value": "wns.notify.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 1241 / UDP stream 14" }, { "type": "domain", "value": "wpad.lafontainebleu.org", "confidence": 1, "description": "dns-query; frame 55 / UDP stream 9, frame 56 / UDP stream 9, frame 59 / UDP stream 10, frame 60 / UDP stream 10, frame 961 / UDP stream 14 +15 more" }, { "type": "domain", "value": "www.bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1158 / UDP stream 14, frame 1160 / UDP stream 14, frame 2110 / UDP stream 26, frame 2111 / UDP stream 27, frame 2112 / UDP stream 26 +15 more" }, { "type": "domain", "value": "www.msftconnecttest.com", "confidence": 1, "description": "dns-query, http-host; frame 61 / UDP stream 10, frame 62 / UDP stream 10, frame 66 / TCP stream 2" }, { "type": "domain", "value": "www.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 1589 / UDP stream 22, frame 1590 / UDP stream 22, frame 12534 / UDP stream 106, frame 12535 / UDP stream 107, frame 12536 / UDP stream 106 +5 more" }, { "type": "ipv4", "value": "0.0.0.0", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "10.8.15.133", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "10.8.15.255", "confidence": 1, "description": "network-endpoint; no frame reference" }, { "type": "ipv4", "value": "10.8.15.4", "confidence": 1, "description": "dns-answer, network-endpoint; frame 21 / UDP stream 4, frame 23 / UDP stream 4, frame 33 / UDP stream 4, frame 111 / UDP stream 9, frame 115 / UDP stream 9 +8 more" }, { "type": "ipv4", "value": "104.21.55.70", "confidence": 1, "description": "dns-answer, network-endpoint; frame 6404 / UDP stream 79, frame 6405 / UDP stream 81, frame 6406 / UDP stream 83, frame 6407 / UDP stream 22, frame 6408 / UDP stream 77 +2 more" }, { "type": "ipv4", "value": "104.40.82.182", "confidence": 1, "description": "dns-answer, network-endpoint; frame 8719 / UDP stream 22" }, { "type": "ipv4", "value": "13.107.21.237", "confidence": 1, "description": "dns-answer, network-endpoint; frame 3836 / UDP stream 59" }, { "type": "ipv4", "value": "13.107.21.239", "confidence": 1, "description": "dns-answer, network-endpoint; frame 2115 / UDP stream 24, frame 2282 / UDP stream 28, frame 10245 / UDP stream 96, frame 12210 / UDP stream 102" }, { "type": "ipv4", "value": "13.107.246.57", "confidence": 1, "description": "dns-answer, network-endpoint; frame 4404 / UDP stream 68" }, { "type": "ipv4", "value": "13.107.4.254", "confidence": 1, "description": "dns-answer, network-endpoint; frame 11764 / UDP stream 99" }, { "type": "ipv4", "value": "13.107.5.93", "confidence": 1, "description": "dns-answer, network-endpoint; frame 3542 / UDP stream 38" }, { "type": "ipv4", "value": "13.107.6.158", "confidence": 1, "description": "dns-answer, network-endpoint; frame 3664 / UDP stream 45" }, { "type": "ipv4", "value": "13.70.79.200", "confidence": 1, "description": "dns-answer, network-endpoint; frame 17806 / UDP stream 151" }, { "type": "ipv4", "value": "13.85.23.206", "confidence": 1, "description": "dns-answer, network-endpoint; frame 13892 / UDP stream 126" }, { "type": "ipv4", "value": "13.89.179.13", "confidence": 1, "description": "dns-answer, network-endpoint; frame 728 / UDP stream 14, frame 843 / UDP stream 14" }, { "type": "ipv4", "value": "172.67.170.159", "confidence": 1, "description": "dns-answer, network-endpoint; frame 6404 / UDP stream 79, frame 6405 / UDP stream 81, frame 6406 / UDP stream 83, frame 6407 / UDP stream 22, frame 6408 / UDP stream 77 +2 more" }, { "type": "ipv4", "value": "18.160.156.115", "confidence": 1, "description": "dns-answer, network-endpoint; frame 3822 / UDP stream 49" }, { "type": "ipv4", "value": "18.160.156.14", "confidence": 1, "description": "dns-answer; frame 3822 / UDP stream 49" }, { "type": "ipv4", "value": "18.160.156.41", "confidence": 1, "description": "dns-answer; frame 3822 / UDP stream 49" }, { "type": "ipv4", "value": "18.160.156.89", "confidence": 1, "description": "dns-answer; frame 3822 / UDP stream 49" }, { "type": "ipv4", "value": "199.232.210.172", "confidence": 1, "description": "dns-answer, network-endpoint; frame 10194 / UDP stream 38, frame 10283 / UDP stream 38" }, { "type": "ipv4", "value": "199.232.214.172", "confidence": 1, "description": "dns-answer; frame 10194 / UDP stream 38, frame 10283 / UDP stream 38" }, { "type": "ipv4", "value": "20.10.31.115", "confidence": 1, "description": "dns-answer, network-endpoint; frame 1241 / UDP stream 14" }, { "type": "ipv4", "value": "20.125.209.212", "confidence": 1, "description": "dns-answer, network-endpoint; frame 3838 / UDP stream 57" }, { "type": "ipv4", "value": "20.163.45.186", "confidence": 1, "description": "dns-answer; frame 14767 / UDP stream 131" }, { "type": "ipv4", "value": "20.189.173.9", "confidence": 1, "description": "dns-answer, network-endpoint; frame 16792 / UDP stream 145" }, { "type": "ipv4", "value": "20.190.157.9", "confidence": 1, "description": "dns-answer; frame 2245 / UDP stream 14, frame 10380 / UDP stream 38, frame 13826 / UDP stream 100" }, { "type": "ipv4", "value": "20.241.44.114", "confidence": 1, "description": "dns-answer, network-endpoint; frame 2999 / UDP stream 22, frame 14499 / UDP stream 128" }, { "type": "ipv4", "value": "20.25.227.174", "confidence": 1, "description": "dns-answer, network-endpoint; frame 6373 / UDP stream 84, frame 6476 / UDP stream 86, frame 15866 / UDP stream 139" }, { "type": "ipv4", "value": "20.3.0.251", "confidence": 1, "description": "dns-answer, network-endpoint; frame 15107 / UDP stream 133" } ], "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap" ], "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c", "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab", "observable_count": 272, "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis", "source_analysis_ref": "/api/pcap/analyses/b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "suspicious_findings": [ { "reason": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior. Rule periodic-http-callbacks@pcap-rules-v3; confidence 88%.", "category": "Periodic HTTP callback pattern", "evidence": "frame 11028 / TCP stream 142, frame 11505 / TCP stream 145, frame 11619 / TCP stream 151, frame 11688 / TCP stream 155, frame 11962 / TCP stream 164 +95 more", "severity": "high" }, { "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.", "category": "Repeated unsuccessful DNS resolution", "evidence": "frame 56 / UDP stream 9, frame 60 / UDP stream 10, frame 962 / UDP stream 14, frame 964 / UDP stream 20, frame 2106 / UDP stream 22 +15 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 281 / TCP stream 11, frame 285 / TCP stream 11, frame 292 / TCP stream 11, frame 297 / TCP stream 11, frame 312 / TCP stream 11 +64 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 37 / TCP stream 0, frame 288 / TCP stream 19, frame 295 / TCP stream 19, frame 300 / TCP stream 19, frame 304 / TCP stream 19 +95 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 1096 / TCP stream 1, frame 1098 / TCP stream 1, frame 1100 / TCP stream 1, frame 1102 / TCP stream 1, frame 1104 / TCP stream 1 +10 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 282 / TCP stream 11, frame 287 / TCP stream 11, frame 293 / TCP stream 11, frame 298 / TCP stream 11, frame 313 / TCP stream 11 +64 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 39 / TCP stream 0, frame 290 / TCP stream 19, frame 299 / TCP stream 19, frame 302 / TCP stream 19, frame 305 / TCP stream 19 +95 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 1097 / TCP stream 1, frame 1099 / TCP stream 1, frame 1101 / TCP stream 1, frame 1103 / TCP stream 1, frame 1105 / TCP stream 1 +10 more", "severity": "low" } ], "observables_truncated": true, "actor_similarity_leads": [ { "status": "ttp-overlap-not-attribution", "group_name": "Orangeworm", "similarity": 0.5, "shared_count": 1, "group_attack_id": "G0071", "shared_techniques": [ "T1071.001" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "SilverTerrier", "similarity": 0.25, "shared_count": 1, "group_attack_id": "G0083", "shared_techniques": [ "T1071.001" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "RedEcho", "similarity": 0.2, "shared_count": 1, "group_attack_id": "G1042", "shared_techniques": [ "T1071.001" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G1013", "shared_techniques": [ "T1071.001" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "group_attack_id": "G0075", "shared_techniques": [ "T1071.001" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "APT18", "similarity": 0.0833, "shared_count": 1, "group_attack_id": "G0026", "shared_techniques": [ "T1071.001" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "FIN4", "similarity": 0.0833, "shared_count": 1, "group_attack_id": "G0085", "shared_techniques": [ "T1071.001" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "Dark Caracal", "similarity": 0.0833, "shared_count": 1, "group_attack_id": "G0070", "shared_techniques": [ "T1071.001" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "TA551", "similarity": 0.0714, "shared_count": 1, "group_attack_id": "G0127", "shared_techniques": [ "T1071.001" ] }, { "status": "ttp-overlap-not-attribution", "group_name": "BITTER", "similarity": 0.0625, "shared_count": 1, "group_attack_id": "G1002", "shared_techniques": [ "T1071.001" ] } ], "expected_suspicious_behaviors": [] }, { "id": "ttp-evidence:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:T1071.001", "type": "ttp-evidence", "label": "T1071.001 Application Layer Protocol: Web Protocols", "source": "log-pcap-analysis", "status": "suggested", "tactic": "command-and-control", "evidence": "T1071.001 Application Layer Protocol: Web Protocols", "attack_id": "T1071.001", "confidence": 0.85, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a1834.dscg2.akamai.net", "type": "ioc", "value": "a1834.dscg2.akamai.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-cname; frame 3816 / UDP stream 47, frame 3828 / UDP stream 48, frame 3829 / UDP stream 48, frame 12746 / UDP stream 117, frame 12747 / UDP stream 116", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:acroipm2.adobe.com", "type": "ioc", "value": "acroipm2.adobe.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, http-host; frame 15338 / UDP stream 135, frame 15339 / UDP stream 135, frame 15340 / UDP stream 135, frame 15341 / UDP stream 135, frame 15345 / TCP stream 300", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:api.msn.com", "type": "ioc", "value": "api.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3841 / UDP stream 63, frame 3842 / UDP stream 64, frame 3864 / UDP stream 63, frame 3884 / UDP stream 64, frame 12585 / UDP stream 110 +7 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:app-edge.smartscreen.microsoft.com", "type": "ioc", "value": "app-edge.smartscreen.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 8661 / UDP stream 88, frame 8662 / UDP stream 89, frame 8682 / UDP stream 90, frame 8683 / UDP stream 91, frame 8701 / UDP stream 22 +9 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:armmf.adobe.com", "type": "ioc", "value": "armmf.adobe.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 15349 / UDP stream 136, frame 15350 / UDP stream 136, frame 15354 / TCP stream 301", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:assets.msn.com", "type": "ioc", "value": "assets.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 1286 / UDP stream 14, frame 1293 / UDP stream 14, frame 3833 / UDP stream 61, frame 3834 / UDP stream 62, frame 3845 / UDP stream 62 +15 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:blob.mwh03prdstf02a.store.core.windows.net", "type": "ioc", "value": "blob.mwh03prdstf02a.store.core.windows.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-cname; frame 12103 / UDP stream 99", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:browser.events.data.msn.com", "type": "ioc", "value": "browser.events.data.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3803 / UDP stream 53, frame 3804 / UDP stream 54, frame 3823 / UDP stream 53, frame 3835 / UDP stream 54, frame 3855 / TCP stream 90 +5 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:business.bing.com", "type": "ioc", "value": "business.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3662 / UDP stream 45, frame 3663 / UDP stream 46, frame 3664 / UDP stream 45, frame 5368 / UDP stream 46, frame 3672 / TCP stream 89 +3 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:business.checkfedexexp.com", "type": "ioc", "value": "business.checkfedexexp.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 9026 / UDP stream 38, frame 9027 / UDP stream 38, frame 9031 / TCP stream 124", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:bzib.nelreports.net", "type": "ioc", "value": "bzib.nelreports.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 8906 / UDP stream 93, frame 8907 / UDP stream 94, frame 8908 / UDP stream 94, frame 8910 / UDP stream 93, frame 8922 / TCP stream 122", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:c-msn-com-nsatc.trafficmanager.net", "type": "ioc", "value": "c-msn-com-nsatc.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-cname; frame 3838 / UDP stream 57, frame 3839 / UDP stream 58", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:c-ring.msedge.net", "type": "ioc", "value": "c-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 11763 / UDP stream 99, frame 11764 / UDP stream 99, frame 11770 / TCP stream 158, frame 11774 / TCP stream 158", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:c.bing.com", "type": "ioc", "value": "c.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3826 / UDP stream 59, frame 3827 / UDP stream 60, frame 3836 / UDP stream 59, frame 3850 / UDP stream 60, frame 3868 / TCP stream 92 +1 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:c.msn.com", "type": "ioc", "value": "c.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3824 / UDP stream 57, frame 3825 / UDP stream 58, frame 3838 / UDP stream 57, frame 3839 / UDP stream 58, frame 3905 / TCP stream 93", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:client.wns.windows.com", "type": "ioc", "value": "client.wns.windows.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 1238 / UDP stream 14, frame 1241 / UDP stream 14, frame 1252 / TCP stream 58, frame 8850 / TCP stream 119", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:cxcs.microsoft.net", "type": "ioc", "value": "cxcs.microsoft.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 11900 / UDP stream 99, frame 11902 / UDP stream 99, frame 11908 / TCP stream 162", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:default.exp-tas.com", "type": "ioc", "value": "default.exp-tas.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3541 / UDP stream 38, frame 3542 / UDP stream 38, frame 3546 / TCP stream 86, frame 3549 / TCP stream 86", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:displaycatalog.mp.microsoft.com", "type": "ioc", "value": "displaycatalog.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 13848 / UDP stream 100, frame 13849 / UDP stream 100, frame 13850 / UDP stream 100, frame 13854 / TCP stream 221", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:dl-edge.smartscreen.microsoft.com", "type": "ioc", "value": "dl-edge.smartscreen.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query; frame 6474 / UDP stream 86, frame 6475 / UDP stream 87, frame 6476 / UDP stream 86, frame 6477 / UDP stream 87", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:dual-s-ring.msedge.net", "type": "ioc", "value": "dual-s-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 11691 / UDP stream 99, frame 11696 / UDP stream 99, frame 11700 / TCP stream 156, frame 11704 / TCP stream 156", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ecn-us.dev.virtualearth.net", "type": "ioc", "value": "ecn-us.dev.virtualearth.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 5420 / UDP stream 75, frame 5421 / UDP stream 76, frame 5423 / UDP stream 76, frame 5450 / UDP stream 75, frame 5509 / TCP stream 105", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ecs.office.com", "type": "ioc", "value": "ecs.office.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 2997 / UDP stream 14, frame 3001 / UDP stream 14, frame 14634 / UDP stream 131, frame 14636 / UDP stream 131, frame 15758 / UDP stream 136 +15 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:edge-consumer-static.azureedge.net", "type": "ioc", "value": "edge-consumer-static.azureedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 4395 / UDP stream 68, frame 4396 / UDP stream 69, frame 4404 / UDP stream 68, frame 4413 / UDP stream 69, frame 4414 / UDP stream 69 +2 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:edge-microsoft-com.dual-a-0036.a-msedge.net", "type": "ioc", "value": "edge-microsoft-com.dual-a-0036.a-msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-cname; frame 2109 / UDP stream 25", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:edge.microsoft.com", "type": "ioc", "value": "edge.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 2107 / UDP stream 24, frame 2108 / UDP stream 25, frame 2109 / UDP stream 25, frame 2115 / UDP stream 24, frame 2280 / UDP stream 28 +15 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:edgeservices.bing.com", "type": "ioc", "value": "edgeservices.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 2314 / UDP stream 30, frame 2315 / UDP stream 31, frame 2316 / UDP stream 30, frame 2317 / UDP stream 31, frame 2329 / UDP stream 32 +11 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fd.api.iris.microsoft.com", "type": "ioc", "value": "fd.api.iris.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 1239 / UDP stream 22, frame 1242 / UDP stream 22, frame 11684 / UDP stream 38, frame 11690 / UDP stream 38, frame 11776 / UDP stream 38 +8 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe2cr.update.microsoft.com", "type": "ioc", "value": "fe2cr.update.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 14766 / UDP stream 131, frame 14767 / UDP stream 131, frame 14771 / TCP stream 269", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe2cr.update.msft.com.trafficmanager.net", "type": "ioc", "value": "fe2cr.update.msft.com.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-cname; frame 14767 / UDP stream 131", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe3cr.delivery.mp.microsoft.com", "type": "ioc", "value": "fe3cr.delivery.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 13888 / UDP stream 126, frame 13889 / UDP stream 126, frame 13892 / UDP stream 126, frame 13898 / TCP stream 224", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fp.msedge.net", "type": "ioc", "value": "fp.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 11801 / UDP stream 99, frame 11802 / UDP stream 99, frame 11806 / TCP stream 159, frame 11810 / TCP stream 159", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:g.live.com", "type": "ioc", "value": "g.live.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 2996 / UDP stream 22, frame 2999 / UDP stream 22, frame 14497 / UDP stream 128, frame 14498 / UDP stream 128, frame 14499 / UDP stream 128 +2 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:go.microsoft.com", "type": "ioc", "value": "go.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 72 / UDP stream 9, frame 73 / UDP stream 9, frame 77 / TCP stream 3, frame 107 / TCP stream 4, frame 1198 / TCP stream 55 +8 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:img-s-msn-com.akamaized.net", "type": "ioc", "value": "img-s-msn-com.akamaized.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3797 / UDP stream 47, frame 3798 / UDP stream 48, frame 3816 / UDP stream 47, frame 3828 / UDP stream 48, frame 3829 / UDP stream 48 +6 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:img.s-msn.com", "type": "ioc", "value": "img.s-msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 12769 / UDP stream 119, frame 12770 / UDP stream 120, frame 12808 / UDP stream 119, frame 12878 / UDP stream 120, frame 12880 / UDP stream 120 +1 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:licensing.mp.microsoft.com", "type": "ioc", "value": "licensing.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 15105 / UDP stream 133, frame 15106 / UDP stream 133, frame 15107 / UDP stream 133, frame 15111 / TCP stream 287", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:login.microsoftonline.com", "type": "ioc", "value": "login.microsoftonline.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 2244 / UDP stream 14, frame 2245 / UDP stream 14, frame 10379 / UDP stream 38, frame 10380 / UDP stream 38, frame 13820 / UDP stream 100 +11 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mobile.events.data.microsoft.com", "type": "ioc", "value": "mobile.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 727 / UDP stream 14, frame 728 / UDP stream 14, frame 842 / UDP stream 14, frame 843 / UDP stream 14, frame 17805 / UDP stream 151 +9 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mrodevicemgr.officeapps.live.com", "type": "ioc", "value": "mrodevicemgr.officeapps.live.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 12259 / UDP stream 99, frame 12260 / UDP stream 99, frame 12261 / UDP stream 99, frame 12265 / TCP stream 185", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:msedge.b.tlu.dl.delivery.mp.microsoft.com", "type": "ioc", "value": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, http-host; frame 10193 / UDP stream 38, frame 10194 / UDP stream 38, frame 10281 / UDP stream 38, frame 10283 / UDP stream 38, frame 10198 / TCP stream 127 +9 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:nav-edge.smartscreen.microsoft.com", "type": "ioc", "value": "nav-edge.smartscreen.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 6371 / UDP stream 84, frame 6372 / UDP stream 85, frame 6373 / UDP stream 84, frame 6374 / UDP stream 85, frame 6379 / TCP stream 111", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:nav.smartscreen.microsoft.com", "type": "ioc", "value": "nav.smartscreen.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 15865 / UDP stream 139, frame 15866 / UDP stream 139, frame 15870 / TCP stream 338", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ntp.msn.com", "type": "ioc", "value": "ntp.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3654 / UDP stream 42, frame 3655 / UDP stream 43, frame 3656 / UDP stream 42, frame 3657 / UDP stream 44, frame 3658 / UDP stream 44 +4 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:odc.officeapps.live.com", "type": "ioc", "value": "odc.officeapps.live.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 1491 / UDP stream 22, frame 1540 / UDP stream 22, frame 2998 / UDP stream 38, frame 3000 / UDP stream 38, frame 1585 / TCP stream 63 +1 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:officeclient.microsoft.com", "type": "ioc", "value": "officeclient.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 513 / UDP stream 14, frame 623 / UDP stream 14, frame 1345 / UDP stream 22, frame 1348 / UDP stream 22, frame 671 / TCP stream 32 +1 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:oneclient.sfx.ms", "type": "ioc", "value": "oneclient.sfx.ms", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3063 / UDP stream 22, frame 3065 / UDP stream 22, frame 14524 / UDP stream 130, frame 14526 / UDP stream 130, frame 14527 / UDP stream 130 +2 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:oneocsp.microsoft.com", "type": "ioc", "value": "oneocsp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, http-host; frame 15879 / UDP stream 139, frame 15880 / UDP stream 139, frame 15884 / TCP stream 339", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ow1.res.office365.com", "type": "ioc", "value": "ow1.res.office365.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 11731 / UDP stream 99, frame 11732 / UDP stream 99, frame 11736 / TCP stream 157", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:prod.mrodevicemgr.live.com.akadns.net", "type": "ioc", "value": "prod.mrodevicemgr.live.com.akadns.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-cname; frame 12261 / UDP stream 99", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:pti.store.microsoft.com", "type": "ioc", "value": "pti.store.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query; frame 13828 / UDP stream 100, frame 13833 / UDP stream 100", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:quote.checkfedexexp.com", "type": "ioc", "value": "quote.checkfedexexp.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, http-host; frame 6200 / UDP stream 77, frame 6201 / UDP stream 78, frame 6202 / UDP stream 79, frame 6317 / UDP stream 81, frame 6318 / UDP stream 82 +11 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:r-msftstatic-com.a-0016.a-msedge.net", "type": "ioc", "value": "r-msftstatic-com.a-0016.a-msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-cname; frame 4772 / UDP stream 73", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:r.bing.com", "type": "ioc", "value": "r.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 4684 / UDP stream 70, frame 4685 / UDP stream 71, frame 4774 / UDP stream 70, frame 4778 / UDP stream 71, frame 4855 / TCP stream 102 +1 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:r.msftstatic.com", "type": "ioc", "value": "r.msftstatic.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 4686 / UDP stream 72, frame 4687 / UDP stream 73, frame 4772 / UDP stream 73, frame 4773 / UDP stream 72, frame 4864 / TCP stream 101 +3 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:sb.scorecardresearch.com", "type": "ioc", "value": "sb.scorecardresearch.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 3799 / UDP stream 49, frame 3800 / UDP stream 50, frame 3815 / UDP stream 50, frame 3822 / UDP stream 49, frame 3909 / TCP stream 96", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:settings-win.data.microsoft.com", "type": "ioc", "value": "settings-win.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 10406 / UDP stream 38, frame 10409 / UDP stream 38, frame 13884 / UDP stream 125, frame 13885 / UDP stream 125, frame 13886 / UDP stream 125 +2 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:srtb.msn.com", "type": "ioc", "value": "srtb.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 4384 / UDP stream 66, frame 4385 / UDP stream 67, frame 4386 / UDP stream 66, frame 4387 / UDP stream 67, frame 12713 / UDP stream 112 +9 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:storecatalogrevocation.storequality.microsoft.com", "type": "ioc", "value": "storecatalogrevocation.storequality.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 15160 / UDP stream 134, frame 15161 / UDP stream 134, frame 15164 / UDP stream 134, frame 15176 / UDP stream 134, frame 15177 / UDP stream 134 +1 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:th.bing.com", "type": "ioc", "value": "th.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 1584 / UDP stream 14, frame 1592 / UDP stream 14, frame 3146 / UDP stream 39, frame 3147 / UDP stream 40, frame 3148 / UDP stream 39 +15 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:v10.events.data.microsoft.com", "type": "ioc", "value": "v10.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 10904 / UDP stream 38, frame 10905 / UDP stream 38, frame 14085 / UDP stream 127, frame 14086 / UDP stream 127, frame 14088 / UDP stream 127 +15 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:v20.events.data.microsoft.com", "type": "ioc", "value": "v20.events.data.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 1192 / UDP stream 14, frame 1194 / UDP stream 14, frame 10937 / UDP stream 38, frame 10939 / UDP stream 38, frame 1217 / TCP stream 56 +1 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:weathermapdata.blob.core.windows.net", "type": "ioc", "value": "weathermapdata.blob.core.windows.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 12102 / UDP stream 99, frame 12103 / UDP stream 99, frame 12107 / TCP stream 175, frame 12111 / TCP stream 175", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:win-jegjix7q9rs.lafontainebleu.org", "type": "ioc", "value": "win-jegjix7q9rs.lafontainebleu.org", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query; frame 22 / UDP stream 4, frame 23 / UDP stream 4, frame 472 / UDP stream 14, frame 473 / UDP stream 14", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:windows.msn.com", "type": "ioc", "value": "windows.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 1484 / UDP stream 14, frame 1485 / UDP stream 14, frame 12411 / UDP stream 100, frame 12416 / UDP stream 104, frame 12417 / UDP stream 105 +12 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wns.notify.trafficmanager.net", "type": "ioc", "value": "wns.notify.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-cname; frame 1241 / UDP stream 14", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:wpad.lafontainebleu.org", "type": "ioc", "value": "wpad.lafontainebleu.org", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query; frame 55 / UDP stream 9, frame 56 / UDP stream 9, frame 59 / UDP stream 10, frame 60 / UDP stream 10, frame 961 / UDP stream 14 +15 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.bing.com", "type": "ioc", "value": "www.bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 1158 / UDP stream 14, frame 1160 / UDP stream 14, frame 2110 / UDP stream 26, frame 2111 / UDP stream 27, frame 2112 / UDP stream 26 +15 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.msftconnecttest.com", "type": "ioc", "value": "www.msftconnecttest.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, http-host; frame 61 / UDP stream 10, frame 62 / UDP stream 10, frame 66 / TCP stream 2", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:www.msn.com", "type": "ioc", "value": "www.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-query, tls-sni; frame 1589 / UDP stream 22, frame 1590 / UDP stream 22, frame 12534 / UDP stream 106, frame 12535 / UDP stream 107, frame 12536 / UDP stream 106 +5 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:0.0.0.0", "type": "ioc", "value": "0.0.0.0", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "network-endpoint; no frame reference", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:10.8.15.133", "type": "ioc", "value": "10.8.15.133", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "network-endpoint; no frame reference", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:10.8.15.255", "type": "ioc", "value": "10.8.15.255", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "network-endpoint; no frame reference", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:10.8.15.4", "type": "ioc", "value": "10.8.15.4", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 21 / UDP stream 4, frame 23 / UDP stream 4, frame 33 / UDP stream 4, frame 111 / UDP stream 9, frame 115 / UDP stream 9 +8 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:104.21.55.70", "type": "ioc", "value": "104.21.55.70", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 6404 / UDP stream 79, frame 6405 / UDP stream 81, frame 6406 / UDP stream 83, frame 6407 / UDP stream 22, frame 6408 / UDP stream 77 +2 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:104.40.82.182", "type": "ioc", "value": "104.40.82.182", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 8719 / UDP stream 22", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.21.237", "type": "ioc", "value": "13.107.21.237", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 3836 / UDP stream 59", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.21.239", "type": "ioc", "value": "13.107.21.239", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 2115 / UDP stream 24, frame 2282 / UDP stream 28, frame 10245 / UDP stream 96, frame 12210 / UDP stream 102", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.246.57", "type": "ioc", "value": "13.107.246.57", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 4404 / UDP stream 68", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.4.254", "type": "ioc", "value": "13.107.4.254", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 11764 / UDP stream 99", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.5.93", "type": "ioc", "value": "13.107.5.93", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 3542 / UDP stream 38", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.107.6.158", "type": "ioc", "value": "13.107.6.158", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 3664 / UDP stream 45", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.70.79.200", "type": "ioc", "value": "13.70.79.200", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 17806 / UDP stream 151", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.85.23.206", "type": "ioc", "value": "13.85.23.206", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 13892 / UDP stream 126", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:13.89.179.13", "type": "ioc", "value": "13.89.179.13", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 728 / UDP stream 14, frame 843 / UDP stream 14", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:172.67.170.159", "type": "ioc", "value": "172.67.170.159", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 6404 / UDP stream 79, frame 6405 / UDP stream 81, frame 6406 / UDP stream 83, frame 6407 / UDP stream 22, frame 6408 / UDP stream 77 +2 more", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:18.160.156.115", "type": "ioc", "value": "18.160.156.115", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 3822 / UDP stream 49", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:18.160.156.14", "type": "ioc", "value": "18.160.156.14", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer; frame 3822 / UDP stream 49", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:18.160.156.41", "type": "ioc", "value": "18.160.156.41", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer; frame 3822 / UDP stream 49", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:18.160.156.89", "type": "ioc", "value": "18.160.156.89", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer; frame 3822 / UDP stream 49", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:199.232.210.172", "type": "ioc", "value": "199.232.210.172", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 10194 / UDP stream 38, frame 10283 / UDP stream 38", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:199.232.214.172", "type": "ioc", "value": "199.232.214.172", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer; frame 10194 / UDP stream 38, frame 10283 / UDP stream 38", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.10.31.115", "type": "ioc", "value": "20.10.31.115", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 1241 / UDP stream 14", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.125.209.212", "type": "ioc", "value": "20.125.209.212", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 3838 / UDP stream 57", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.163.45.186", "type": "ioc", "value": "20.163.45.186", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer; frame 14767 / UDP stream 131", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.189.173.9", "type": "ioc", "value": "20.189.173.9", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 16792 / UDP stream 145", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.190.157.9", "type": "ioc", "value": "20.190.157.9", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer; frame 2245 / UDP stream 14, frame 10380 / UDP stream 38, frame 13826 / UDP stream 100", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.241.44.114", "type": "ioc", "value": "20.241.44.114", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 2999 / UDP stream 22, frame 14499 / UDP stream 128", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.25.227.174", "type": "ioc", "value": "20.25.227.174", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 6373 / UDP stream 84, frame 6476 / UDP stream 86, frame 15866 / UDP stream 139", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "ioc:20.3.0.251", "type": "ioc", "value": "20.3.0.251", "source": "log-pcap-analysis", "ioc_type": "ipv4", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "description": "dns-answer, network-endpoint; frame 15107 / UDP stream 133", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "log-pcap-analysis" ] }, { "id": "finding-11a7e4318835eb1c13fc1c02", "type": "pcap-finding", "label": "Periodic HTTP callback pattern", "source": "deterministic-pcap-analysis", "metrics": { "uri": "/", "host": "72.5.43.29", "port": 80, "method": "GET", "source": "10.8.15.133", "destination": "72.5.43.29", "request_count": 303, "median_interval_seconds": 5.685, "median_absolute_deviation": 1.037 }, "rule_id": "periodic-http-callbacks", "severity": "high", "confidence": 0.88, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 142, "frame_number": 11028, "display_filter": "frame.number == 11028", "timestamp_epoch": "1723680780.664378000" }, { "tcp_stream": 145, "frame_number": 11505, "display_filter": "frame.number == 11505", "timestamp_epoch": "1723680787.999666000" }, { "tcp_stream": 151, "frame_number": 11619, "display_filter": "frame.number == 11619", "timestamp_epoch": "1723680793.850601000" }, { "tcp_stream": 155, "frame_number": 11688, "display_filter": "frame.number == 11688", "timestamp_epoch": "1723680797.315577000" }, { "tcp_stream": 164, "frame_number": 11962, "display_filter": "frame.number == 11962", "timestamp_epoch": "1723680804.254102000" }, { "tcp_stream": 165, "frame_number": 11974, "display_filter": "frame.number == 11974", "timestamp_epoch": "1723680809.944683000" }, { "tcp_stream": 166, "frame_number": 11993, "display_filter": "frame.number == 11993", "timestamp_epoch": "1723680817.194861000" }, { "tcp_stream": 167, "frame_number": 12004, "display_filter": "frame.number == 12004", "timestamp_epoch": "1723680823.591854000" }, { "tcp_stream": 168, "frame_number": 12017, "display_filter": "frame.number == 12017", "timestamp_epoch": "1723680829.193045000" }, { "tcp_stream": 169, "frame_number": 12032, "display_filter": "frame.number == 12032", "timestamp_epoch": "1723680835.214191000" }, { "tcp_stream": 170, "frame_number": 12045, "display_filter": "frame.number == 12045", "timestamp_epoch": "1723680839.081492000" }, { "tcp_stream": 171, "frame_number": 12060, "display_filter": "frame.number == 12060", "timestamp_epoch": "1723680843.782430000" }, { "tcp_stream": 172, "frame_number": 12072, "display_filter": "frame.number == 12072", "timestamp_epoch": "1723680847.998603000" }, { "tcp_stream": 173, "frame_number": 12087, "display_filter": "frame.number == 12087", "timestamp_epoch": "1723680852.361708000" }, { "tcp_stream": 174, "frame_number": 12096, "display_filter": "frame.number == 12096", "timestamp_epoch": "1723680857.007048000" }, { "tcp_stream": 176, "frame_number": 12141, "display_filter": "frame.number == 12141", "timestamp_epoch": "1723680862.196492000" }, { "tcp_stream": 177, "frame_number": 12154, "display_filter": "frame.number == 12154", "timestamp_epoch": "1723680868.478805000" }, { "tcp_stream": 178, "frame_number": 12164, "display_filter": "frame.number == 12164", "timestamp_epoch": "1723680872.853090000" }, { "tcp_stream": 179, "frame_number": 12175, "display_filter": "frame.number == 12175", "timestamp_epoch": "1723680878.604245000" }, { "tcp_stream": 180, "frame_number": 12186, "display_filter": "frame.number == 12186", "timestamp_epoch": "1723680886.067560000" }, { "tcp_stream": 181, "frame_number": 12200, "display_filter": "frame.number == 12200", "timestamp_epoch": "1723680893.807805000" }, { "tcp_stream": 183, "frame_number": 12242, "display_filter": "frame.number == 12242", "timestamp_epoch": "1723680900.014338000" }, { "tcp_stream": 184, "frame_number": 12253, "display_filter": "frame.number == 12253", "timestamp_epoch": "1723680907.248656000" }, { "tcp_stream": 206, "frame_number": 13263, "display_filter": "frame.number == 13263", "timestamp_epoch": "1723680913.542763000" }, { "tcp_stream": 207, "frame_number": 13589, "display_filter": "frame.number == 13589", "timestamp_epoch": "1723680917.980065000" }, { "tcp_stream": 208, "frame_number": 13609, "display_filter": "frame.number == 13609", "timestamp_epoch": "1723680923.254494000" }, { "tcp_stream": 209, "frame_number": 13635, "display_filter": "frame.number == 13635", "timestamp_epoch": "1723680975.818959000" }, { "tcp_stream": 210, "frame_number": 13655, "display_filter": "frame.number == 13655", "timestamp_epoch": "1723680982.660112000" }, { "tcp_stream": 215, "frame_number": 13739, "display_filter": "frame.number == 13739", "timestamp_epoch": "1723680986.523941000" }, { "tcp_stream": 222, "frame_number": 13911, "display_filter": "frame.number == 13911", "timestamp_epoch": "1723680990.391966000" }, { "tcp_stream": 225, "frame_number": 14070, "display_filter": "frame.number == 14070", "timestamp_epoch": "1723680994.843801000" }, { "tcp_stream": 226, "frame_number": 14091, "display_filter": "frame.number == 14091", "timestamp_epoch": "1723681000.674471000" }, { "tcp_stream": 228, "frame_number": 14138, "display_filter": "frame.number == 14138", "timestamp_epoch": "1723681006.223359000" }, { "tcp_stream": 230, "frame_number": 14178, "display_filter": "frame.number == 14178", "timestamp_epoch": "1723681013.189457000" }, { "tcp_stream": 231, "frame_number": 14189, "display_filter": "frame.number == 14189", "timestamp_epoch": "1723681018.917530000" }, { "tcp_stream": 232, "frame_number": 14201, "display_filter": "frame.number == 14201", "timestamp_epoch": "1723681026.263547000" }, { "tcp_stream": 233, "frame_number": 14210, "display_filter": "frame.number == 14210", "timestamp_epoch": "1723681032.790381000" }, { "tcp_stream": 234, "frame_number": 14221, "display_filter": "frame.number == 14221", "timestamp_epoch": "1723681037.630532000" }, { "tcp_stream": 236, "frame_number": 14254, "display_filter": "frame.number == 14254", "timestamp_epoch": "1723681043.230910000" }, { "tcp_stream": 237, "frame_number": 14263, "display_filter": "frame.number == 14263", "timestamp_epoch": "1723681050.323085000" }, { "tcp_stream": 238, "frame_number": 14272, "display_filter": "frame.number == 14272", "timestamp_epoch": "1723681056.322087000" }, { "tcp_stream": 239, "frame_number": 14281, "display_filter": "frame.number == 14281", "timestamp_epoch": "1723681060.099936000" }, { "tcp_stream": 240, "frame_number": 14290, "display_filter": "frame.number == 14290", "timestamp_epoch": "1723681063.593064000" }, { "tcp_stream": 241, "frame_number": 14301, "display_filter": "frame.number == 14301", "timestamp_epoch": "1723681070.563338000" }, { "tcp_stream": 242, "frame_number": 14312, "display_filter": "frame.number == 14312", "timestamp_epoch": "1723681076.331728000" }, { "tcp_stream": 243, "frame_number": 14324, "display_filter": "frame.number == 14324", "timestamp_epoch": "1723681083.743242000" }, { "tcp_stream": 244, "frame_number": 14335, "display_filter": "frame.number == 14335", "timestamp_epoch": "1723681090.400183000" }, { "tcp_stream": 245, "frame_number": 14344, "display_filter": "frame.number == 14344", "timestamp_epoch": "1723681095.477626000" }, { "tcp_stream": 246, "frame_number": 14358, "display_filter": "frame.number == 14358", "timestamp_epoch": "1723681101.539859000" }, { "tcp_stream": 247, "frame_number": 14373, "display_filter": "frame.number == 14373", "timestamp_epoch": "1723681105.503006000" }, { "tcp_stream": 248, "frame_number": 14383, "display_filter": "frame.number == 14383", "timestamp_epoch": "1723681109.332869000" }, { "tcp_stream": 249, "frame_number": 14394, "display_filter": "frame.number == 14394", "timestamp_epoch": "1723681112.883107000" }, { "tcp_stream": 250, "frame_number": 14406, "display_filter": "frame.number == 14406", "timestamp_epoch": "1723681119.999894000" }, { "tcp_stream": 251, "frame_number": 14415, "display_filter": "frame.number == 14415", "timestamp_epoch": "1723681126.022041000" }, { "tcp_stream": 252, "frame_number": 14424, "display_filter": "frame.number == 14424", "timestamp_epoch": "1723681129.862278000" }, { "tcp_stream": 253, "frame_number": 14437, "display_filter": "frame.number == 14437", "timestamp_epoch": "1723681133.454087000" }, { "tcp_stream": 254, "frame_number": 14450, "display_filter": "frame.number == 14450", "timestamp_epoch": "1723681140.654390000" }, { "tcp_stream": 255, "frame_number": 14459, "display_filter": "frame.number == 14459", "timestamp_epoch": "1723681146.895398000" }, { "tcp_stream": 256, "frame_number": 14470, "display_filter": "frame.number == 14470", "timestamp_epoch": "1723681151.153685000" }, { "tcp_stream": 261, "frame_number": 14647, "display_filter": "frame.number == 14647", "timestamp_epoch": "1723681155.562098000" }, { "tcp_stream": 263, "frame_number": 14675, "display_filter": "frame.number == 14675", "timestamp_epoch": "1723681160.282703000" }, { "tcp_stream": 264, "frame_number": 14698, "display_filter": "frame.number == 14698", "timestamp_epoch": "1723681165.914795000" }, { "tcp_stream": 265, "frame_number": 14707, "display_filter": "frame.number == 14707", "timestamp_epoch": "1723681172.798210000" }, { "tcp_stream": 266, "frame_number": 14719, "display_filter": "frame.number == 14719", "timestamp_epoch": "1723681179.882767000" }, { "tcp_stream": 267, "frame_number": 14736, "display_filter": "frame.number == 14736", "timestamp_epoch": "1723681184.875518000" }, { "tcp_stream": 268, "frame_number": 14760, "display_filter": "frame.number == 14760", "timestamp_epoch": "1723681190.222347000" }, { "tcp_stream": 270, "frame_number": 14792, "display_filter": "frame.number == 14792", "timestamp_epoch": "1723681196.830819000" }, { "tcp_stream": 271, "frame_number": 14806, "display_filter": "frame.number == 14806", "timestamp_epoch": "1723681201.842354000" }, { "tcp_stream": 272, "frame_number": 14921, "display_filter": "frame.number == 14921", "timestamp_epoch": "1723681209.572065000" }, { "tcp_stream": 274, "frame_number": 14962, "display_filter": "frame.number == 14962", "timestamp_epoch": "1723681215.076361000" }, { "tcp_stream": 275, "frame_number": 14979, "display_filter": "frame.number == 14979", "timestamp_epoch": "1723681221.962481000" }, { "tcp_stream": 276, "frame_number": 14989, "display_filter": "frame.number == 14989", "timestamp_epoch": "1723681227.561961000" }, { "tcp_stream": 277, "frame_number": 14999, "display_filter": "frame.number == 14999", "timestamp_epoch": "1723681234.695176000" }, { "tcp_stream": 278, "frame_number": 15010, "display_filter": "frame.number == 15010", "timestamp_epoch": "1723681240.762230000" }, { "tcp_stream": 279, "frame_number": 15021, "display_filter": "frame.number == 15021", "timestamp_epoch": "1723681244.681707000" }, { "tcp_stream": 280, "frame_number": 15037, "display_filter": "frame.number == 15037", "timestamp_epoch": "1723681250.455053000" }, { "tcp_stream": 281, "frame_number": 15047, "display_filter": "frame.number == 15047", "timestamp_epoch": "1723681255.848643000" }, { "tcp_stream": 282, "frame_number": 15060, "display_filter": "frame.number == 15060", "timestamp_epoch": "1723681262.791423000" }, { "tcp_stream": 283, "frame_number": 15078, "display_filter": "frame.number == 15078", "timestamp_epoch": "1723681269.649464000" }, { "tcp_stream": 284, "frame_number": 15089, "display_filter": "frame.number == 15089", "timestamp_epoch": "1723681273.870863000" }, { "tcp_stream": 285, "frame_number": 15098, "display_filter": "frame.number == 15098", "timestamp_epoch": "1723681278.112448000" }, { "tcp_stream": 286, "frame_number": 15122, "display_filter": "frame.number == 15122", "timestamp_epoch": "1723681282.733454000" }, { "tcp_stream": 288, "frame_number": 15170, "display_filter": "frame.number == 15170", "timestamp_epoch": "1723681287.618414000" }, { "tcp_stream": 290, "frame_number": 15206, "display_filter": "frame.number == 15206", "timestamp_epoch": "1723681294.874856000" }, { "tcp_stream": 291, "frame_number": 15217, "display_filter": "frame.number == 15217", "timestamp_epoch": "1723681299.634243000" }, { "tcp_stream": 294, "frame_number": 15250, "display_filter": "frame.number == 15250", "timestamp_epoch": "1723681305.055347000" }, { "tcp_stream": 295, "frame_number": 15260, "display_filter": "frame.number == 15260", "timestamp_epoch": "1723681311.776154000" }, { "tcp_stream": 297, "frame_number": 15311, "display_filter": "frame.number == 15311", "timestamp_epoch": "1723681318.536068000" }, { "tcp_stream": 298, "frame_number": 15320, "display_filter": "frame.number == 15320", "timestamp_epoch": "1723681322.887261000" }, { "tcp_stream": 299, "frame_number": 15332, "display_filter": "frame.number == 15332", "timestamp_epoch": "1723681328.595654000" }, { "tcp_stream": 302, "frame_number": 15375, "display_filter": "frame.number == 15375", "timestamp_epoch": "1723681334.274261000" }, { "tcp_stream": 303, "frame_number": 15391, "display_filter": "frame.number == 15391", "timestamp_epoch": "1723681341.576410000" }, { "tcp_stream": 304, "frame_number": 15405, "display_filter": "frame.number == 15405", "timestamp_epoch": "1723681347.954525000" }, { "tcp_stream": 305, "frame_number": 15414, "display_filter": "frame.number == 15414", "timestamp_epoch": "1723681352.496784000" }, { "tcp_stream": 306, "frame_number": 15423, "display_filter": "frame.number == 15423", "timestamp_epoch": "1723681357.516311000" }, { "tcp_stream": 307, "frame_number": 15434, "display_filter": "frame.number == 15434", "timestamp_epoch": "1723681363.438478000" }, { "tcp_stream": 308, "frame_number": 15443, "display_filter": "frame.number == 15443", "timestamp_epoch": "1723681367.610722000" }, { "tcp_stream": 309, "frame_number": 15454, "display_filter": "frame.number == 15454", "timestamp_epoch": "1723681372.837324000" }, { "tcp_stream": 310, "frame_number": 15463, "display_filter": "frame.number == 15463", "timestamp_epoch": "1723681377.723785000" }, { "tcp_stream": 312, "frame_number": 15492, "display_filter": "frame.number == 15492", "timestamp_epoch": "1723681383.397047000" } ] }, { "id": "finding-90a3532518006ab5a519468a", "type": "pcap-finding", "label": "Repeated unsuccessful DNS resolution", "source": "deterministic-pcap-analysis", "metrics": { "domain": "wpad.lafontainebleu.org", "source": "10.8.15.133", "response_count": 20 }, "rule_id": "repeated-nxdomain", "severity": "low", "confidence": 0.5, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "udp_stream": 9, "frame_number": 56, "display_filter": "frame.number == 56", "timestamp_epoch": "1723680584.978533000" }, { "udp_stream": 10, "frame_number": 60, "display_filter": "frame.number == 60", "timestamp_epoch": "1723680584.996370000" }, { "udp_stream": 14, "frame_number": 962, "display_filter": "frame.number == 962", "timestamp_epoch": "1723680599.997451000" }, { "udp_stream": 20, "frame_number": 964, "display_filter": "frame.number == 964", "timestamp_epoch": "1723680600.044261000" }, { "udp_stream": 22, "frame_number": 2106, "display_filter": "frame.number == 2106", "timestamp_epoch": "1723680618.772193000" }, { "udp_stream": 14, "frame_number": 3576, "display_filter": "frame.number == 3576", "timestamp_epoch": "1723680626.785646000" }, { "udp_stream": 38, "frame_number": 6439, "display_filter": "frame.number == 6439", "timestamp_epoch": "1723680660.000329000" }, { "udp_stream": 20, "frame_number": 6441, "display_filter": "frame.number == 6441", "timestamp_epoch": "1723680660.047965000" }, { "udp_stream": 14, "frame_number": 6459, "display_filter": "frame.number == 6459", "timestamp_epoch": "1723680661.692095000" }, { "udp_stream": 100, "frame_number": 12209, "display_filter": "frame.number == 12209", "timestamp_epoch": "1723680895.684574000" }, { "udp_stream": 100, "frame_number": 12410, "display_filter": "frame.number == 12410", "timestamp_epoch": "1723680911.067621000" }, { "udp_stream": 100, "frame_number": 13598, "display_filter": "frame.number == 13598", "timestamp_epoch": "1723680919.077883000" }, { "udp_stream": 133, "frame_number": 15054, "display_filter": "frame.number == 15054", "timestamp_epoch": "1723681260.039606000" }, { "udp_stream": 20, "frame_number": 15056, "display_filter": "frame.number == 15056", "timestamp_epoch": "1723681260.083829000" }, { "udp_stream": 136, "frame_number": 15370, "display_filter": "frame.number == 15370", "timestamp_epoch": "1723681330.394345000" }, { "udp_stream": 136, "frame_number": 15382, "display_filter": "frame.number == 15382", "timestamp_epoch": "1723681338.397619000" }, { "udp_stream": 20, "frame_number": 16701, "display_filter": "frame.number == 16701", "timestamp_epoch": "1723681860.125139000" }, { "udp_stream": 145, "frame_number": 16703, "display_filter": "frame.number == 16703", "timestamp_epoch": "1723681860.169001000" }, { "udp_stream": 151, "frame_number": 18011, "display_filter": "frame.number == 18011", "timestamp_epoch": "1723682460.198419000" }, { "udp_stream": 20, "frame_number": 18013, "display_filter": "frame.number == 18013", "timestamp_epoch": "1723682460.256763000" } ] }, { "id": "finding-130344072143303b93081c2d", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.8.15.133", "protocol": "drsuapi", "destination": "10.8.15.4", "event_count": 69, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 11, "frame_number": 281, "display_filter": "frame.number == 281", "timestamp_epoch": "1723680586.162496000" }, { "tcp_stream": 11, "frame_number": 285, "display_filter": "frame.number == 285", "timestamp_epoch": "1723680586.163355000" }, { "tcp_stream": 11, "frame_number": 292, "display_filter": "frame.number == 292", "timestamp_epoch": "1723680586.164365000" }, { "tcp_stream": 11, "frame_number": 297, "display_filter": "frame.number == 297", "timestamp_epoch": "1723680586.165243000" }, { "tcp_stream": 11, "frame_number": 312, "display_filter": "frame.number == 312", "timestamp_epoch": "1723680586.175079000" }, { "tcp_stream": 11, "frame_number": 314, "display_filter": "frame.number == 314", "timestamp_epoch": "1723680586.183783000" }, { "tcp_stream": 11, "frame_number": 316, "display_filter": "frame.number == 316", "timestamp_epoch": "1723680586.185886000" }, { "tcp_stream": 11, "frame_number": 331, "display_filter": "frame.number == 331", "timestamp_epoch": "1723680586.222611000" }, { "tcp_stream": 11, "frame_number": 335, "display_filter": "frame.number == 335", "timestamp_epoch": "1723680586.223909000" }, { "tcp_stream": 11, "frame_number": 348, "display_filter": "frame.number == 348", "timestamp_epoch": "1723680586.231259000" }, { "tcp_stream": 22, "frame_number": 405, "display_filter": "frame.number == 405", "timestamp_epoch": "1723680586.407343000" }, { "tcp_stream": 22, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1723680586.408227000" }, { "tcp_stream": 22, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1723680586.417183000" }, { "tcp_stream": 22, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1723680586.419421000" }, { "tcp_stream": 11, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1723680586.421509000" }, { "tcp_stream": 11, "frame_number": 425, "display_filter": "frame.number == 425", "timestamp_epoch": "1723680586.422332000" }, { "tcp_stream": 11, "frame_number": 427, "display_filter": "frame.number == 427", "timestamp_epoch": "1723680586.425984000" }, { "tcp_stream": 35, "frame_number": 776, "display_filter": "frame.number == 776", "timestamp_epoch": "1723680589.063397000" }, { "tcp_stream": 35, "frame_number": 778, "display_filter": "frame.number == 778", "timestamp_epoch": "1723680589.064122000" }, { "tcp_stream": 35, "frame_number": 780, "display_filter": "frame.number == 780", "timestamp_epoch": "1723680589.064730000" }, { "tcp_stream": 35, "frame_number": 784, "display_filter": "frame.number == 784", "timestamp_epoch": "1723680589.066298000" }, { "tcp_stream": 35, "frame_number": 786, "display_filter": "frame.number == 786", "timestamp_epoch": "1723680589.066760000" }, { "tcp_stream": 35, "frame_number": 788, "display_filter": "frame.number == 788", "timestamp_epoch": "1723680589.067268000" }, { "tcp_stream": 11, "frame_number": 1022, "display_filter": "frame.number == 1022", "timestamp_epoch": "1723680608.254938000" }, { "tcp_stream": 11, "frame_number": 1024, "display_filter": "frame.number == 1024", "timestamp_epoch": "1723680608.255330000" }, { "tcp_stream": 11, "frame_number": 1026, "display_filter": "frame.number == 1026", "timestamp_epoch": "1723680608.255819000" }, { "tcp_stream": 11, "frame_number": 1028, "display_filter": "frame.number == 1028", "timestamp_epoch": "1723680608.256225000" }, { "tcp_stream": 75, "frame_number": 2170, "display_filter": "frame.number == 2170", "timestamp_epoch": "1723680619.142078000" }, { "tcp_stream": 75, "frame_number": 2173, "display_filter": "frame.number == 2173", "timestamp_epoch": "1723680619.142601000" }, { "tcp_stream": 75, "frame_number": 2176, "display_filter": "frame.number == 2176", "timestamp_epoch": "1723680619.143163000" }, { "tcp_stream": 75, "frame_number": 2184, "display_filter": "frame.number == 2184", "timestamp_epoch": "1723680619.146051000" }, { "tcp_stream": 75, "frame_number": 2186, "display_filter": "frame.number == 2186", "timestamp_epoch": "1723680619.146435000" }, { "tcp_stream": 75, "frame_number": 2188, "display_filter": "frame.number == 2188", "timestamp_epoch": "1723680619.146901000" }, { "tcp_stream": 116, "frame_number": 8771, "display_filter": "frame.number == 8771", "timestamp_epoch": "1723680669.170554000" }, { "tcp_stream": 116, "frame_number": 8773, "display_filter": "frame.number == 8773", "timestamp_epoch": "1723680669.171234000" }, { "tcp_stream": 116, "frame_number": 8775, "display_filter": "frame.number == 8775", "timestamp_epoch": "1723680669.171828000" }, { "tcp_stream": 116, "frame_number": 8779, "display_filter": "frame.number == 8779", "timestamp_epoch": "1723680669.173716000" }, { "tcp_stream": 116, "frame_number": 8781, "display_filter": "frame.number == 8781", "timestamp_epoch": "1723680669.174116000" }, { "tcp_stream": 116, "frame_number": 8783, "display_filter": "frame.number == 8783", "timestamp_epoch": "1723680669.174611000" }, { "tcp_stream": 129, "frame_number": 10324, "display_filter": "frame.number == 10324", "timestamp_epoch": "1723680707.872008000" }, { "tcp_stream": 129, "frame_number": 10326, "display_filter": "frame.number == 10326", "timestamp_epoch": "1723680707.872467000" }, { "tcp_stream": 129, "frame_number": 10328, "display_filter": "frame.number == 10328", "timestamp_epoch": "1723680707.873023000" }, { "tcp_stream": 129, "frame_number": 10332, "display_filter": "frame.number == 10332", "timestamp_epoch": "1723680707.874681000" }, { "tcp_stream": 129, "frame_number": 10334, "display_filter": "frame.number == 10334", "timestamp_epoch": "1723680707.875077000" }, { "tcp_stream": 129, "frame_number": 10336, "display_filter": "frame.number == 10336", "timestamp_epoch": "1723680707.875542000" }, { "tcp_stream": 136, "frame_number": 10792, "display_filter": "frame.number == 10792", "timestamp_epoch": "1723680726.271910000" }, { "tcp_stream": 136, "frame_number": 10794, "display_filter": "frame.number == 10794", "timestamp_epoch": "1723680726.272437000" }, { "tcp_stream": 136, "frame_number": 10796, "display_filter": "frame.number == 10796", "timestamp_epoch": "1723680726.272994000" }, { "tcp_stream": 136, "frame_number": 10800, "display_filter": "frame.number == 10800", "timestamp_epoch": "1723680726.274795000" }, { "tcp_stream": 136, "frame_number": 10802, "display_filter": "frame.number == 10802", "timestamp_epoch": "1723680726.275171000" }, { "tcp_stream": 136, "frame_number": 10804, "display_filter": "frame.number == 10804", "timestamp_epoch": "1723680726.275611000" }, { "tcp_stream": 147, "frame_number": 11542, "display_filter": "frame.number == 11542", "timestamp_epoch": "1723680793.575615000" }, { "tcp_stream": 147, "frame_number": 11544, "display_filter": "frame.number == 11544", "timestamp_epoch": "1723680793.576154000" }, { "tcp_stream": 147, "frame_number": 11546, "display_filter": "frame.number == 11546", "timestamp_epoch": "1723680793.576710000" }, { "tcp_stream": 147, "frame_number": 11550, "display_filter": "frame.number == 11550", "timestamp_epoch": "1723680793.578633000" }, { "tcp_stream": 147, "frame_number": 11552, "display_filter": "frame.number == 11552", "timestamp_epoch": "1723680793.579033000" }, { "tcp_stream": 147, "frame_number": 11554, "display_filter": "frame.number == 11554", "timestamp_epoch": "1723680793.579501000" }, { "tcp_stream": 212, "frame_number": 13681, "display_filter": "frame.number == 13681", "timestamp_epoch": "1723680984.938022000" }, { "tcp_stream": 212, "frame_number": 13683, "display_filter": "frame.number == 13683", "timestamp_epoch": "1723680984.938687000" }, { "tcp_stream": 212, "frame_number": 13685, "display_filter": "frame.number == 13685", "timestamp_epoch": "1723680984.939327000" }, { "tcp_stream": 212, "frame_number": 13689, "display_filter": "frame.number == 13689", "timestamp_epoch": "1723680984.940868000" }, { "tcp_stream": 212, "frame_number": 13691, "display_filter": "frame.number == 13691", "timestamp_epoch": "1723680984.941263000" }, { "tcp_stream": 212, "frame_number": 13693, "display_filter": "frame.number == 13693", "timestamp_epoch": "1723680984.941752000" }, { "tcp_stream": 217, "frame_number": 13766, "display_filter": "frame.number == 13766", "timestamp_epoch": "1723680987.861060000" }, { "tcp_stream": 217, "frame_number": 13768, "display_filter": "frame.number == 13768", "timestamp_epoch": "1723680987.861627000" }, { "tcp_stream": 217, "frame_number": 13770, "display_filter": "frame.number == 13770", "timestamp_epoch": "1723680987.862317000" }, { "tcp_stream": 217, "frame_number": 13774, "display_filter": "frame.number == 13774", "timestamp_epoch": "1723680987.864133000" }, { "tcp_stream": 217, "frame_number": 13776, "display_filter": "frame.number == 13776", "timestamp_epoch": "1723680987.864658000" }, { "tcp_stream": 217, "frame_number": 13778, "display_filter": "frame.number == 13778", "timestamp_epoch": "1723680987.865145000" } ] }, { "id": "finding-72bc17359c2c979bc54cf1d2", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.8.15.133", "protocol": "ldap", "destination": "10.8.15.4", "event_count": 143, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 37, "display_filter": "frame.number == 37", "timestamp_epoch": "1723680584.316304000" }, { "tcp_stream": 19, "frame_number": 288, "display_filter": "frame.number == 288", "timestamp_epoch": "1723680586.163682000" }, { "tcp_stream": 19, "frame_number": 295, "display_filter": "frame.number == 295", "timestamp_epoch": "1723680586.165042000" }, { "tcp_stream": 19, "frame_number": 300, "display_filter": "frame.number == 300", "timestamp_epoch": "1723680586.167935000" }, { "tcp_stream": 19, "frame_number": 304, "display_filter": "frame.number == 304", "timestamp_epoch": "1723680586.169382000" }, { "tcp_stream": 0, "frame_number": 342, "display_filter": "frame.number == 342", "timestamp_epoch": "1723680586.228979000" }, { "tcp_stream": 0, "frame_number": 350, "display_filter": "frame.number == 350", "timestamp_epoch": "1723680586.232492000" }, { "tcp_stream": 19, "frame_number": 367, "display_filter": "frame.number == 367", "timestamp_epoch": "1723680586.333842000" }, { "tcp_stream": 19, "frame_number": 434, "display_filter": "frame.number == 434", "timestamp_epoch": "1723680586.460022000" }, { "tcp_stream": 19, "frame_number": 454, "display_filter": "frame.number == 454", "timestamp_epoch": "1723680586.566735000" }, { "tcp_stream": 19, "frame_number": 461, "display_filter": "frame.number == 461", "timestamp_epoch": "1723680586.570595000" }, { "tcp_stream": 19, "frame_number": 465, "display_filter": "frame.number == 465", "timestamp_epoch": "1723680586.571718000" }, { "tcp_stream": 19, "frame_number": 467, "display_filter": "frame.number == 467", "timestamp_epoch": "1723680586.572226000" }, { "tcp_stream": 27, "frame_number": 477, "display_filter": "frame.number == 477", "timestamp_epoch": "1723680586.858009000" }, { "tcp_stream": 27, "frame_number": 482, "display_filter": "frame.number == 482", "timestamp_epoch": "1723680586.861444000" }, { "tcp_stream": 27, "frame_number": 498, "display_filter": "frame.number == 498", "timestamp_epoch": "1723680586.918933000" }, { "tcp_stream": 29, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1723680586.923457000" }, { "tcp_stream": 29, "frame_number": 507, "display_filter": "frame.number == 507", "timestamp_epoch": "1723680586.925209000" }, { "tcp_stream": 29, "frame_number": 509, "display_filter": "frame.number == 509", "timestamp_epoch": "1723680586.927027000" }, { "tcp_stream": 27, "frame_number": 511, "display_filter": "frame.number == 511", "timestamp_epoch": "1723680586.927993000" }, { "tcp_stream": 29, "frame_number": 669, "display_filter": "frame.number == 669", "timestamp_epoch": "1723680587.233004000" }, { "tcp_stream": 27, "frame_number": 673, "display_filter": "frame.number == 673", "timestamp_epoch": "1723680587.260152000" }, { "tcp_stream": 36, "frame_number": 805, "display_filter": "frame.number == 805", "timestamp_epoch": "1723680589.322280000" }, { "tcp_stream": 36, "frame_number": 810, "display_filter": "frame.number == 810", "timestamp_epoch": "1723680589.324404000" }, { "tcp_stream": 36, "frame_number": 813, "display_filter": "frame.number == 813", "timestamp_epoch": "1723680589.327099000" }, { "tcp_stream": 36, "frame_number": 815, "display_filter": "frame.number == 815", "timestamp_epoch": "1723680589.327801000" }, { "tcp_stream": 36, "frame_number": 817, "display_filter": "frame.number == 817", "timestamp_epoch": "1723680589.328308000" }, { "tcp_stream": 37, "frame_number": 823, "display_filter": "frame.number == 823", "timestamp_epoch": "1723680589.330954000" }, { "tcp_stream": 37, "frame_number": 826, "display_filter": "frame.number == 826", "timestamp_epoch": "1723680589.331945000" }, { "tcp_stream": 37, "frame_number": 831, "display_filter": "frame.number == 831", "timestamp_epoch": "1723680589.332615000" }, { "tcp_stream": 37, "frame_number": 833, "display_filter": "frame.number == 833", "timestamp_epoch": "1723680589.333097000" }, { "tcp_stream": 36, "frame_number": 835, "display_filter": "frame.number == 835", "timestamp_epoch": "1723680589.333557000" }, { "tcp_stream": 39, "frame_number": 892, "display_filter": "frame.number == 892", "timestamp_epoch": "1723680594.911094000" }, { "tcp_stream": 39, "frame_number": 897, "display_filter": "frame.number == 897", "timestamp_epoch": "1723680594.913590000" }, { "tcp_stream": 39, "frame_number": 900, "display_filter": "frame.number == 900", "timestamp_epoch": "1723680594.916130000" }, { "tcp_stream": 39, "frame_number": 902, "display_filter": "frame.number == 902", "timestamp_epoch": "1723680594.916675000" }, { "tcp_stream": 39, "frame_number": 904, "display_filter": "frame.number == 904", "timestamp_epoch": "1723680594.917132000" }, { "tcp_stream": 39, "frame_number": 906, "display_filter": "frame.number == 906", "timestamp_epoch": "1723680594.917721000" }, { "tcp_stream": 39, "frame_number": 908, "display_filter": "frame.number == 908", "timestamp_epoch": "1723680594.918472000" }, { "tcp_stream": 40, "frame_number": 914, "display_filter": "frame.number == 914", "timestamp_epoch": "1723680594.931067000" }, { "tcp_stream": 40, "frame_number": 917, "display_filter": "frame.number == 917", "timestamp_epoch": "1723680594.932325000" }, { "tcp_stream": 40, "frame_number": 949, "display_filter": "frame.number == 949", "timestamp_epoch": "1723680594.937953000" }, { "tcp_stream": 40, "frame_number": 951, "display_filter": "frame.number == 951", "timestamp_epoch": "1723680594.938627000" }, { "tcp_stream": 39, "frame_number": 955, "display_filter": "frame.number == 955", "timestamp_epoch": "1723680594.939118000" }, { "tcp_stream": 48, "frame_number": 1034, "display_filter": "frame.number == 1034", "timestamp_epoch": "1723680608.262175000" }, { "tcp_stream": 48, "frame_number": 1037, "display_filter": "frame.number == 1037", "timestamp_epoch": "1723680608.266520000" }, { "tcp_stream": 49, "frame_number": 1043, "display_filter": "frame.number == 1043", "timestamp_epoch": "1723680608.269420000" }, { "tcp_stream": 49, "frame_number": 1046, "display_filter": "frame.number == 1046", "timestamp_epoch": "1723680608.270460000" }, { "tcp_stream": 49, "frame_number": 1048, "display_filter": "frame.number == 1048", "timestamp_epoch": "1723680608.270835000" }, { "tcp_stream": 48, "frame_number": 1050, "display_filter": "frame.number == 1050", "timestamp_epoch": "1723680608.271287000" }, { "tcp_stream": 49, "frame_number": 1083, "display_filter": "frame.number == 1083", "timestamp_epoch": "1723680608.286720000" }, { "tcp_stream": 48, "frame_number": 1085, "display_filter": "frame.number == 1085", "timestamp_epoch": "1723680608.289999000" }, { "tcp_stream": 76, "frame_number": 2193, "display_filter": "frame.number == 2193", "timestamp_epoch": "1723680619.150261000" }, { "tcp_stream": 76, "frame_number": 2198, "display_filter": "frame.number == 2198", "timestamp_epoch": "1723680619.151800000" }, { "tcp_stream": 76, "frame_number": 2201, "display_filter": "frame.number == 2201", "timestamp_epoch": "1723680619.152947000" }, { "tcp_stream": 76, "frame_number": 2203, "display_filter": "frame.number == 2203", "timestamp_epoch": "1723680619.153458000" }, { "tcp_stream": 76, "frame_number": 2205, "display_filter": "frame.number == 2205", "timestamp_epoch": "1723680619.153878000" }, { "tcp_stream": 77, "frame_number": 2211, "display_filter": "frame.number == 2211", "timestamp_epoch": "1723680619.157530000" }, { "tcp_stream": 77, "frame_number": 2214, "display_filter": "frame.number == 2214", "timestamp_epoch": "1723680619.158686000" }, { "tcp_stream": 77, "frame_number": 2219, "display_filter": "frame.number == 2219", "timestamp_epoch": "1723680619.159464000" }, { "tcp_stream": 77, "frame_number": 2221, "display_filter": "frame.number == 2221", "timestamp_epoch": "1723680619.160052000" }, { "tcp_stream": 76, "frame_number": 2224, "display_filter": "frame.number == 2224", "timestamp_epoch": "1723680619.160335000" }, { "tcp_stream": 117, "frame_number": 8788, "display_filter": "frame.number == 8788", "timestamp_epoch": "1723680669.177116000" }, { "tcp_stream": 117, "frame_number": 8793, "display_filter": "frame.number == 8793", "timestamp_epoch": "1723680669.178289000" }, { "tcp_stream": 117, "frame_number": 8796, "display_filter": "frame.number == 8796", "timestamp_epoch": "1723680669.179482000" }, { "tcp_stream": 117, "frame_number": 8798, "display_filter": "frame.number == 8798", "timestamp_epoch": "1723680669.179947000" }, { "tcp_stream": 117, "frame_number": 8800, "display_filter": "frame.number == 8800", "timestamp_epoch": "1723680669.180357000" }, { "tcp_stream": 118, "frame_number": 8806, "display_filter": "frame.number == 8806", "timestamp_epoch": "1723680669.183217000" }, { "tcp_stream": 118, "frame_number": 8809, "display_filter": "frame.number == 8809", "timestamp_epoch": "1723680669.184395000" }, { "tcp_stream": 118, "frame_number": 8814, "display_filter": "frame.number == 8814", "timestamp_epoch": "1723680669.185005000" }, { "tcp_stream": 118, "frame_number": 8816, "display_filter": "frame.number == 8816", "timestamp_epoch": "1723680669.185491000" }, { "tcp_stream": 117, "frame_number": 8820, "display_filter": "frame.number == 8820", "timestamp_epoch": "1723680669.186001000" }, { "tcp_stream": 130, "frame_number": 10341, "display_filter": "frame.number == 10341", "timestamp_epoch": "1723680707.878189000" }, { "tcp_stream": 130, "frame_number": 10346, "display_filter": "frame.number == 10346", "timestamp_epoch": "1723680707.879339000" }, { "tcp_stream": 130, "frame_number": 10349, "display_filter": "frame.number == 10349", "timestamp_epoch": "1723680707.880452000" }, { "tcp_stream": 130, "frame_number": 10351, "display_filter": "frame.number == 10351", "timestamp_epoch": "1723680707.880893000" }, { "tcp_stream": 130, "frame_number": 10353, "display_filter": "frame.number == 10353", "timestamp_epoch": "1723680707.881264000" }, { "tcp_stream": 131, "frame_number": 10359, "display_filter": "frame.number == 10359", "timestamp_epoch": "1723680707.884542000" }, { "tcp_stream": 131, "frame_number": 10362, "display_filter": "frame.number == 10362", "timestamp_epoch": "1723680707.885559000" }, { "tcp_stream": 131, "frame_number": 10367, "display_filter": "frame.number == 10367", "timestamp_epoch": "1723680707.886071000" }, { "tcp_stream": 131, "frame_number": 10369, "display_filter": "frame.number == 10369", "timestamp_epoch": "1723680707.886516000" }, { "tcp_stream": 130, "frame_number": 10373, "display_filter": "frame.number == 10373", "timestamp_epoch": "1723680707.886942000" }, { "tcp_stream": 137, "frame_number": 10809, "display_filter": "frame.number == 10809", "timestamp_epoch": "1723680726.278208000" }, { "tcp_stream": 137, "frame_number": 10814, "display_filter": "frame.number == 10814", "timestamp_epoch": "1723680726.279327000" }, { "tcp_stream": 137, "frame_number": 10817, "display_filter": "frame.number == 10817", "timestamp_epoch": "1723680726.280306000" }, { "tcp_stream": 137, "frame_number": 10819, "display_filter": "frame.number == 10819", "timestamp_epoch": "1723680726.280781000" }, { "tcp_stream": 137, "frame_number": 10821, "display_filter": "frame.number == 10821", "timestamp_epoch": "1723680726.281165000" }, { "tcp_stream": 138, "frame_number": 10827, "display_filter": "frame.number == 10827", "timestamp_epoch": "1723680726.284604000" }, { "tcp_stream": 138, "frame_number": 10830, "display_filter": "frame.number == 10830", "timestamp_epoch": "1723680726.285727000" }, { "tcp_stream": 138, "frame_number": 10835, "display_filter": "frame.number == 10835", "timestamp_epoch": "1723680726.286321000" }, { "tcp_stream": 138, "frame_number": 10837, "display_filter": "frame.number == 10837", "timestamp_epoch": "1723680726.286818000" }, { "tcp_stream": 137, "frame_number": 10841, "display_filter": "frame.number == 10841", "timestamp_epoch": "1723680726.287221000" }, { "tcp_stream": 148, "frame_number": 11559, "display_filter": "frame.number == 11559", "timestamp_epoch": "1723680793.582099000" }, { "tcp_stream": 148, "frame_number": 11564, "display_filter": "frame.number == 11564", "timestamp_epoch": "1723680793.583308000" }, { "tcp_stream": 148, "frame_number": 11567, "display_filter": "frame.number == 11567", "timestamp_epoch": "1723680793.584848000" }, { "tcp_stream": 148, "frame_number": 11569, "display_filter": "frame.number == 11569", "timestamp_epoch": "1723680793.585396000" }, { "tcp_stream": 148, "frame_number": 11571, "display_filter": "frame.number == 11571", "timestamp_epoch": "1723680793.585855000" }, { "tcp_stream": 149, "frame_number": 11577, "display_filter": "frame.number == 11577", "timestamp_epoch": "1723680793.589691000" }, { "tcp_stream": 149, "frame_number": 11580, "display_filter": "frame.number == 11580", "timestamp_epoch": "1723680793.590821000" }, { "tcp_stream": 149, "frame_number": 11585, "display_filter": "frame.number == 11585", "timestamp_epoch": "1723680793.591360000" } ] }, { "id": "finding-d35456ec17991fe1b149580c", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.8.15.133", "protocol": "samr", "destination": "10.8.15.4", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1, "frame_number": 1096, "display_filter": "frame.number == 1096", "timestamp_epoch": "1723680608.292494000" }, { "tcp_stream": 1, "frame_number": 1098, "display_filter": "frame.number == 1098", "timestamp_epoch": "1723680608.293037000" }, { "tcp_stream": 1, "frame_number": 1100, "display_filter": "frame.number == 1100", "timestamp_epoch": "1723680608.293468000" }, { "tcp_stream": 1, "frame_number": 1102, "display_filter": "frame.number == 1102", "timestamp_epoch": "1723680608.294014000" }, { "tcp_stream": 1, "frame_number": 1104, "display_filter": "frame.number == 1104", "timestamp_epoch": "1723680608.294498000" }, { "tcp_stream": 1, "frame_number": 1106, "display_filter": "frame.number == 1106", "timestamp_epoch": "1723680608.295053000" }, { "tcp_stream": 1, "frame_number": 1108, "display_filter": "frame.number == 1108", "timestamp_epoch": "1723680608.295580000" }, { "tcp_stream": 1, "frame_number": 1110, "display_filter": "frame.number == 1110", "timestamp_epoch": "1723680608.296214000" }, { "tcp_stream": 1, "frame_number": 1112, "display_filter": "frame.number == 1112", "timestamp_epoch": "1723680608.296855000" }, { "tcp_stream": 1, "frame_number": 1114, "display_filter": "frame.number == 1114", "timestamp_epoch": "1723680608.297426000" }, { "tcp_stream": 1, "frame_number": 1116, "display_filter": "frame.number == 1116", "timestamp_epoch": "1723680608.297908000" }, { "tcp_stream": 1, "frame_number": 1118, "display_filter": "frame.number == 1118", "timestamp_epoch": "1723680608.298462000" }, { "tcp_stream": 1, "frame_number": 1120, "display_filter": "frame.number == 1120", "timestamp_epoch": "1723680608.298892000" }, { "tcp_stream": 1, "frame_number": 1122, "display_filter": "frame.number == 1122", "timestamp_epoch": "1723680608.299311000" }, { "tcp_stream": 1, "frame_number": 1124, "display_filter": "frame.number == 1124", "timestamp_epoch": "1723680608.299700000" } ] }, { "id": "finding-dadf48afcfbbcf2b5157e015", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.8.15.4", "protocol": "drsuapi", "destination": "10.8.15.133", "event_count": 69, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 11, "frame_number": 282, "display_filter": "frame.number == 282", "timestamp_epoch": "1723680586.162688000" }, { "tcp_stream": 11, "frame_number": 287, "display_filter": "frame.number == 287", "timestamp_epoch": "1723680586.163662000" }, { "tcp_stream": 11, "frame_number": 293, "display_filter": "frame.number == 293", "timestamp_epoch": "1723680586.164600000" }, { "tcp_stream": 11, "frame_number": 298, "display_filter": "frame.number == 298", "timestamp_epoch": "1723680586.165377000" }, { "tcp_stream": 11, "frame_number": 313, "display_filter": "frame.number == 313", "timestamp_epoch": "1723680586.175336000" }, { "tcp_stream": 11, "frame_number": 315, "display_filter": "frame.number == 315", "timestamp_epoch": "1723680586.184129000" }, { "tcp_stream": 11, "frame_number": 317, "display_filter": "frame.number == 317", "timestamp_epoch": "1723680586.186040000" }, { "tcp_stream": 11, "frame_number": 333, "display_filter": "frame.number == 333", "timestamp_epoch": "1723680586.223085000" }, { "tcp_stream": 11, "frame_number": 336, "display_filter": "frame.number == 336", "timestamp_epoch": "1723680586.224242000" }, { "tcp_stream": 11, "frame_number": 349, "display_filter": "frame.number == 349", "timestamp_epoch": "1723680586.231483000" }, { "tcp_stream": 22, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1723680586.407559000" }, { "tcp_stream": 22, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1723680586.408786000" }, { "tcp_stream": 22, "frame_number": 415, "display_filter": "frame.number == 415", "timestamp_epoch": "1723680586.417890000" }, { "tcp_stream": 22, "frame_number": 420, "display_filter": "frame.number == 420", "timestamp_epoch": "1723680586.419690000" }, { "tcp_stream": 11, "frame_number": 424, "display_filter": "frame.number == 424", "timestamp_epoch": "1723680586.421823000" }, { "tcp_stream": 11, "frame_number": 426, "display_filter": "frame.number == 426", "timestamp_epoch": "1723680586.422890000" }, { "tcp_stream": 11, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1723680586.426156000" }, { "tcp_stream": 35, "frame_number": 777, "display_filter": "frame.number == 777", "timestamp_epoch": "1723680589.063735000" }, { "tcp_stream": 35, "frame_number": 779, "display_filter": "frame.number == 779", "timestamp_epoch": "1723680589.064448000" }, { "tcp_stream": 35, "frame_number": 781, "display_filter": "frame.number == 781", "timestamp_epoch": "1723680589.064904000" }, { "tcp_stream": 35, "frame_number": 785, "display_filter": "frame.number == 785", "timestamp_epoch": "1723680589.066447000" }, { "tcp_stream": 35, "frame_number": 787, "display_filter": "frame.number == 787", "timestamp_epoch": "1723680589.066986000" }, { "tcp_stream": 35, "frame_number": 789, "display_filter": "frame.number == 789", "timestamp_epoch": "1723680589.067414000" }, { "tcp_stream": 11, "frame_number": 1023, "display_filter": "frame.number == 1023", "timestamp_epoch": "1723680608.255139000" }, { "tcp_stream": 11, "frame_number": 1025, "display_filter": "frame.number == 1025", "timestamp_epoch": "1723680608.255622000" }, { "tcp_stream": 11, "frame_number": 1027, "display_filter": "frame.number == 1027", "timestamp_epoch": "1723680608.256076000" }, { "tcp_stream": 11, "frame_number": 1029, "display_filter": "frame.number == 1029", "timestamp_epoch": "1723680608.256355000" }, { "tcp_stream": 75, "frame_number": 2171, "display_filter": "frame.number == 2171", "timestamp_epoch": "1723680619.142315000" }, { "tcp_stream": 75, "frame_number": 2175, "display_filter": "frame.number == 2175", "timestamp_epoch": "1723680619.142979000" }, { "tcp_stream": 75, "frame_number": 2179, "display_filter": "frame.number == 2179", "timestamp_epoch": "1723680619.143304000" }, { "tcp_stream": 75, "frame_number": 2185, "display_filter": "frame.number == 2185", "timestamp_epoch": "1723680619.146253000" }, { "tcp_stream": 75, "frame_number": 2187, "display_filter": "frame.number == 2187", "timestamp_epoch": "1723680619.146719000" }, { "tcp_stream": 75, "frame_number": 2189, "display_filter": "frame.number == 2189", "timestamp_epoch": "1723680619.147091000" }, { "tcp_stream": 116, "frame_number": 8772, "display_filter": "frame.number == 8772", "timestamp_epoch": "1723680669.170822000" }, { "tcp_stream": 116, "frame_number": 8774, "display_filter": "frame.number == 8774", "timestamp_epoch": "1723680669.171583000" }, { "tcp_stream": 116, "frame_number": 8776, "display_filter": "frame.number == 8776", "timestamp_epoch": "1723680669.172016000" }, { "tcp_stream": 116, "frame_number": 8780, "display_filter": "frame.number == 8780", "timestamp_epoch": "1723680669.173916000" }, { "tcp_stream": 116, "frame_number": 8782, "display_filter": "frame.number == 8782", "timestamp_epoch": "1723680669.174421000" }, { "tcp_stream": 116, "frame_number": 8784, "display_filter": "frame.number == 8784", "timestamp_epoch": "1723680669.174776000" }, { "tcp_stream": 129, "frame_number": 10325, "display_filter": "frame.number == 10325", "timestamp_epoch": "1723680707.872244000" }, { "tcp_stream": 129, "frame_number": 10327, "display_filter": "frame.number == 10327", "timestamp_epoch": "1723680707.872807000" }, { "tcp_stream": 129, "frame_number": 10329, "display_filter": "frame.number == 10329", "timestamp_epoch": "1723680707.873195000" }, { "tcp_stream": 129, "frame_number": 10333, "display_filter": "frame.number == 10333", "timestamp_epoch": "1723680707.874883000" }, { "tcp_stream": 129, "frame_number": 10335, "display_filter": "frame.number == 10335", "timestamp_epoch": "1723680707.875361000" }, { "tcp_stream": 129, "frame_number": 10337, "display_filter": "frame.number == 10337", "timestamp_epoch": "1723680707.875719000" }, { "tcp_stream": 136, "frame_number": 10793, "display_filter": "frame.number == 10793", "timestamp_epoch": "1723680726.272191000" }, { "tcp_stream": 136, "frame_number": 10795, "display_filter": "frame.number == 10795", "timestamp_epoch": "1723680726.272794000" }, { "tcp_stream": 136, "frame_number": 10797, "display_filter": "frame.number == 10797", "timestamp_epoch": "1723680726.273174000" }, { "tcp_stream": 136, "frame_number": 10801, "display_filter": "frame.number == 10801", "timestamp_epoch": "1723680726.274984000" }, { "tcp_stream": 136, "frame_number": 10803, "display_filter": "frame.number == 10803", "timestamp_epoch": "1723680726.275430000" }, { "tcp_stream": 136, "frame_number": 10805, "display_filter": "frame.number == 10805", "timestamp_epoch": "1723680726.275772000" }, { "tcp_stream": 147, "frame_number": 11543, "display_filter": "frame.number == 11543", "timestamp_epoch": "1723680793.575868000" }, { "tcp_stream": 147, "frame_number": 11545, "display_filter": "frame.number == 11545", "timestamp_epoch": "1723680793.576475000" }, { "tcp_stream": 147, "frame_number": 11547, "display_filter": "frame.number == 11547", "timestamp_epoch": "1723680793.576876000" }, { "tcp_stream": 147, "frame_number": 11551, "display_filter": "frame.number == 11551", "timestamp_epoch": "1723680793.578827000" }, { "tcp_stream": 147, "frame_number": 11553, "display_filter": "frame.number == 11553", "timestamp_epoch": "1723680793.579321000" }, { "tcp_stream": 147, "frame_number": 11555, "display_filter": "frame.number == 11555", "timestamp_epoch": "1723680793.579650000" }, { "tcp_stream": 212, "frame_number": 13682, "display_filter": "frame.number == 13682", "timestamp_epoch": "1723680984.938304000" }, { "tcp_stream": 212, "frame_number": 13684, "display_filter": "frame.number == 13684", "timestamp_epoch": "1723680984.939080000" }, { "tcp_stream": 212, "frame_number": 13686, "display_filter": "frame.number == 13686", "timestamp_epoch": "1723680984.939542000" }, { "tcp_stream": 212, "frame_number": 13690, "display_filter": "frame.number == 13690", "timestamp_epoch": "1723680984.941065000" }, { "tcp_stream": 212, "frame_number": 13692, "display_filter": "frame.number == 13692", "timestamp_epoch": "1723680984.941557000" }, { "tcp_stream": 212, "frame_number": 13694, "display_filter": "frame.number == 13694", "timestamp_epoch": "1723680984.941918000" }, { "tcp_stream": 217, "frame_number": 13767, "display_filter": "frame.number == 13767", "timestamp_epoch": "1723680987.861338000" }, { "tcp_stream": 217, "frame_number": 13769, "display_filter": "frame.number == 13769", "timestamp_epoch": "1723680987.862048000" }, { "tcp_stream": 217, "frame_number": 13771, "display_filter": "frame.number == 13771", "timestamp_epoch": "1723680987.862579000" }, { "tcp_stream": 217, "frame_number": 13775, "display_filter": "frame.number == 13775", "timestamp_epoch": "1723680987.864410000" }, { "tcp_stream": 217, "frame_number": 13777, "display_filter": "frame.number == 13777", "timestamp_epoch": "1723680987.864959000" }, { "tcp_stream": 217, "frame_number": 13779, "display_filter": "frame.number == 13779", "timestamp_epoch": "1723680987.865321000" } ] }, { "id": "finding-9da2803215a49174d050ddf4", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.8.15.4", "protocol": "ldap", "destination": "10.8.15.133", "event_count": 113, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 39, "display_filter": "frame.number == 39", "timestamp_epoch": "1723680584.316590000" }, { "tcp_stream": 19, "frame_number": 290, "display_filter": "frame.number == 290", "timestamp_epoch": "1723680586.163947000" }, { "tcp_stream": 19, "frame_number": 299, "display_filter": "frame.number == 299", "timestamp_epoch": "1723680586.165682000" }, { "tcp_stream": 19, "frame_number": 302, "display_filter": "frame.number == 302", "timestamp_epoch": "1723680586.168128000" }, { "tcp_stream": 19, "frame_number": 305, "display_filter": "frame.number == 305", "timestamp_epoch": "1723680586.169656000" }, { "tcp_stream": 0, "frame_number": 345, "display_filter": "frame.number == 345", "timestamp_epoch": "1723680586.229864000" }, { "tcp_stream": 19, "frame_number": 370, "display_filter": "frame.number == 370", "timestamp_epoch": "1723680586.334337000" }, { "tcp_stream": 19, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1723680586.460412000" }, { "tcp_stream": 19, "frame_number": 456, "display_filter": "frame.number == 456", "timestamp_epoch": "1723680586.567224000" }, { "tcp_stream": 19, "frame_number": 464, "display_filter": "frame.number == 464", "timestamp_epoch": "1723680586.571159000" }, { "tcp_stream": 19, "frame_number": 466, "display_filter": "frame.number == 466", "timestamp_epoch": "1723680586.572032000" }, { "tcp_stream": 27, "frame_number": 479, "display_filter": "frame.number == 479", "timestamp_epoch": "1723680586.858347000" }, { "tcp_stream": 27, "frame_number": 484, "display_filter": "frame.number == 484", "timestamp_epoch": "1723680586.862253000" }, { "tcp_stream": 27, "frame_number": 499, "display_filter": "frame.number == 499", "timestamp_epoch": "1723680586.919299000" }, { "tcp_stream": 29, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1723680586.924302000" }, { "tcp_stream": 29, "frame_number": 508, "display_filter": "frame.number == 508", "timestamp_epoch": "1723680586.925448000" }, { "tcp_stream": 29, "frame_number": 510, "display_filter": "frame.number == 510", "timestamp_epoch": "1723680586.927291000" }, { "tcp_stream": 27, "frame_number": 512, "display_filter": "frame.number == 512", "timestamp_epoch": "1723680586.928362000" }, { "tcp_stream": 36, "frame_number": 807, "display_filter": "frame.number == 807", "timestamp_epoch": "1723680589.322588000" }, { "tcp_stream": 36, "frame_number": 812, "display_filter": "frame.number == 812", "timestamp_epoch": "1723680589.325251000" }, { "tcp_stream": 36, "frame_number": 814, "display_filter": "frame.number == 814", "timestamp_epoch": "1723680589.327512000" }, { "tcp_stream": 36, "frame_number": 816, "display_filter": "frame.number == 816", "timestamp_epoch": "1723680589.328051000" }, { "tcp_stream": 36, "frame_number": 818, "display_filter": "frame.number == 818", "timestamp_epoch": "1723680589.328531000" }, { "tcp_stream": 37, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1723680589.331594000" }, { "tcp_stream": 37, "frame_number": 829, "display_filter": "frame.number == 829", "timestamp_epoch": "1723680589.332163000" }, { "tcp_stream": 37, "frame_number": 832, "display_filter": "frame.number == 832", "timestamp_epoch": "1723680589.332847000" }, { "tcp_stream": 39, "frame_number": 894, "display_filter": "frame.number == 894", "timestamp_epoch": "1723680594.911658000" }, { "tcp_stream": 39, "frame_number": 899, "display_filter": "frame.number == 899", "timestamp_epoch": "1723680594.914633000" }, { "tcp_stream": 39, "frame_number": 901, "display_filter": "frame.number == 901", "timestamp_epoch": "1723680594.916365000" }, { "tcp_stream": 39, "frame_number": 903, "display_filter": "frame.number == 903", "timestamp_epoch": "1723680594.916837000" }, { "tcp_stream": 39, "frame_number": 905, "display_filter": "frame.number == 905", "timestamp_epoch": "1723680594.917418000" }, { "tcp_stream": 39, "frame_number": 907, "display_filter": "frame.number == 907", "timestamp_epoch": "1723680594.918030000" }, { "tcp_stream": 39, "frame_number": 909, "display_filter": "frame.number == 909", "timestamp_epoch": "1723680594.918864000" }, { "tcp_stream": 40, "frame_number": 916, "display_filter": "frame.number == 916", "timestamp_epoch": "1723680594.931841000" }, { "tcp_stream": 40, "frame_number": 918, "display_filter": "frame.number == 918", "timestamp_epoch": "1723680594.932466000" }, { "tcp_stream": 40, "frame_number": 950, "display_filter": "frame.number == 950", "timestamp_epoch": "1723680594.938268000" }, { "tcp_stream": 48, "frame_number": 1036, "display_filter": "frame.number == 1036", "timestamp_epoch": "1723680608.263016000" }, { "tcp_stream": 48, "frame_number": 1038, "display_filter": "frame.number == 1038", "timestamp_epoch": "1723680608.266867000" }, { "tcp_stream": 49, "frame_number": 1045, "display_filter": "frame.number == 1045", "timestamp_epoch": "1723680608.270141000" }, { "tcp_stream": 49, "frame_number": 1047, "display_filter": "frame.number == 1047", "timestamp_epoch": "1723680608.270637000" }, { "tcp_stream": 49, "frame_number": 1049, "display_filter": "frame.number == 1049", "timestamp_epoch": "1723680608.271050000" }, { "tcp_stream": 48, "frame_number": 1051, "display_filter": "frame.number == 1051", "timestamp_epoch": "1723680608.271601000" }, { "tcp_stream": 76, "frame_number": 2195, "display_filter": "frame.number == 2195", "timestamp_epoch": "1723680619.150540000" }, { "tcp_stream": 76, "frame_number": 2200, "display_filter": "frame.number == 2200", "timestamp_epoch": "1723680619.152525000" }, { "tcp_stream": 76, "frame_number": 2202, "display_filter": "frame.number == 2202", "timestamp_epoch": "1723680619.153176000" }, { "tcp_stream": 76, "frame_number": 2204, "display_filter": "frame.number == 2204", "timestamp_epoch": "1723680619.153636000" }, { "tcp_stream": 76, "frame_number": 2206, "display_filter": "frame.number == 2206", "timestamp_epoch": "1723680619.154056000" }, { "tcp_stream": 77, "frame_number": 2213, "display_filter": "frame.number == 2213", "timestamp_epoch": "1723680619.158222000" }, { "tcp_stream": 77, "frame_number": 2217, "display_filter": "frame.number == 2217", "timestamp_epoch": "1723680619.158932000" }, { "tcp_stream": 77, "frame_number": 2220, "display_filter": "frame.number == 2220", "timestamp_epoch": "1723680619.159752000" }, { "tcp_stream": 117, "frame_number": 8790, "display_filter": "frame.number == 8790", "timestamp_epoch": "1723680669.177405000" }, { "tcp_stream": 117, "frame_number": 8795, "display_filter": "frame.number == 8795", "timestamp_epoch": "1723680669.179140000" }, { "tcp_stream": 117, "frame_number": 8797, "display_filter": "frame.number == 8797", "timestamp_epoch": "1723680669.179708000" }, { "tcp_stream": 117, "frame_number": 8799, "display_filter": "frame.number == 8799", "timestamp_epoch": "1723680669.180172000" }, { "tcp_stream": 117, "frame_number": 8801, "display_filter": "frame.number == 8801", "timestamp_epoch": "1723680669.180565000" }, { "tcp_stream": 118, "frame_number": 8808, "display_filter": "frame.number == 8808", "timestamp_epoch": "1723680669.183920000" }, { "tcp_stream": 118, "frame_number": 8812, "display_filter": "frame.number == 8812", "timestamp_epoch": "1723680669.184677000" }, { "tcp_stream": 118, "frame_number": 8815, "display_filter": "frame.number == 8815", "timestamp_epoch": "1723680669.185287000" }, { "tcp_stream": 130, "frame_number": 10343, "display_filter": "frame.number == 10343", "timestamp_epoch": "1723680707.878499000" }, { "tcp_stream": 130, "frame_number": 10348, "display_filter": "frame.number == 10348", "timestamp_epoch": "1723680707.880056000" }, { "tcp_stream": 130, "frame_number": 10350, "display_filter": "frame.number == 10350", "timestamp_epoch": "1723680707.880675000" }, { "tcp_stream": 130, "frame_number": 10352, "display_filter": "frame.number == 10352", "timestamp_epoch": "1723680707.881085000" }, { "tcp_stream": 130, "frame_number": 10354, "display_filter": "frame.number == 10354", "timestamp_epoch": "1723680707.881451000" }, { "tcp_stream": 131, "frame_number": 10361, "display_filter": "frame.number == 10361", "timestamp_epoch": "1723680707.885178000" }, { "tcp_stream": 131, "frame_number": 10365, "display_filter": "frame.number == 10365", "timestamp_epoch": "1723680707.885810000" }, { "tcp_stream": 131, "frame_number": 10368, "display_filter": "frame.number == 10368", "timestamp_epoch": "1723680707.886329000" }, { "tcp_stream": 137, "frame_number": 10811, "display_filter": "frame.number == 10811", "timestamp_epoch": "1723680726.278478000" }, { "tcp_stream": 137, "frame_number": 10816, "display_filter": "frame.number == 10816", "timestamp_epoch": "1723680726.279932000" }, { "tcp_stream": 137, "frame_number": 10818, "display_filter": "frame.number == 10818", "timestamp_epoch": "1723680726.280560000" }, { "tcp_stream": 137, "frame_number": 10820, "display_filter": "frame.number == 10820", "timestamp_epoch": "1723680726.280982000" }, { "tcp_stream": 137, "frame_number": 10822, "display_filter": "frame.number == 10822", "timestamp_epoch": "1723680726.281360000" }, { "tcp_stream": 138, "frame_number": 10829, "display_filter": "frame.number == 10829", "timestamp_epoch": "1723680726.285345000" }, { "tcp_stream": 138, "frame_number": 10833, "display_filter": "frame.number == 10833", "timestamp_epoch": "1723680726.285995000" }, { "tcp_stream": 138, "frame_number": 10836, "display_filter": "frame.number == 10836", "timestamp_epoch": "1723680726.286605000" }, { "tcp_stream": 148, "frame_number": 11561, "display_filter": "frame.number == 11561", "timestamp_epoch": "1723680793.582360000" }, { "tcp_stream": 148, "frame_number": 11566, "display_filter": "frame.number == 11566", "timestamp_epoch": "1723680793.584069000" }, { "tcp_stream": 148, "frame_number": 11568, "display_filter": "frame.number == 11568", "timestamp_epoch": "1723680793.585134000" }, { "tcp_stream": 148, "frame_number": 11570, "display_filter": "frame.number == 11570", "timestamp_epoch": "1723680793.585635000" }, { "tcp_stream": 148, "frame_number": 11572, "display_filter": "frame.number == 11572", "timestamp_epoch": "1723680793.586076000" }, { "tcp_stream": 149, "frame_number": 11579, "display_filter": "frame.number == 11579", "timestamp_epoch": "1723680793.590422000" }, { "tcp_stream": 149, "frame_number": 11583, "display_filter": "frame.number == 11583", "timestamp_epoch": "1723680793.591070000" }, { "tcp_stream": 149, "frame_number": 11586, "display_filter": "frame.number == 11586", "timestamp_epoch": "1723680793.591623000" }, { "tcp_stream": 152, "frame_number": 11639, "display_filter": "frame.number == 11639", "timestamp_epoch": "1723680795.693019000" }, { "tcp_stream": 152, "frame_number": 11656, "display_filter": "frame.number == 11656", "timestamp_epoch": "1723680795.703747000" }, { "tcp_stream": 152, "frame_number": 11658, "display_filter": "frame.number == 11658", "timestamp_epoch": "1723680795.705808000" }, { "tcp_stream": 154, "frame_number": 11673, "display_filter": "frame.number == 11673", "timestamp_epoch": "1723680795.729326000" }, { "tcp_stream": 154, "frame_number": 11675, "display_filter": "frame.number == 11675", "timestamp_epoch": "1723680795.729993000" }, { "tcp_stream": 196, "frame_number": 12513, "display_filter": "frame.number == 12513", "timestamp_epoch": "1723680911.761516000" }, { "tcp_stream": 196, "frame_number": 12518, "display_filter": "frame.number == 12518", "timestamp_epoch": "1723680911.763442000" }, { "tcp_stream": 196, "frame_number": 12520, "display_filter": "frame.number == 12520", "timestamp_epoch": "1723680911.765039000" }, { "tcp_stream": 197, "frame_number": 12529, "display_filter": "frame.number == 12529", "timestamp_epoch": "1723680911.774536000" }, { "tcp_stream": 197, "frame_number": 12531, "display_filter": "frame.number == 12531", "timestamp_epoch": "1723680911.784208000" }, { "tcp_stream": 213, "frame_number": 13700, "display_filter": "frame.number == 13700", "timestamp_epoch": "1723680984.944342000" }, { "tcp_stream": 213, "frame_number": 13705, "display_filter": "frame.number == 13705", "timestamp_epoch": "1723680984.945807000" }, { "tcp_stream": 213, "frame_number": 13707, "display_filter": "frame.number == 13707", "timestamp_epoch": "1723680984.946341000" }, { "tcp_stream": 213, "frame_number": 13709, "display_filter": "frame.number == 13709", "timestamp_epoch": "1723680984.946751000" }, { "tcp_stream": 213, "frame_number": 13711, "display_filter": "frame.number == 13711", "timestamp_epoch": "1723680984.947134000" }, { "tcp_stream": 214, "frame_number": 13718, "display_filter": "frame.number == 13718", "timestamp_epoch": "1723680984.950226000" }, { "tcp_stream": 214, "frame_number": 13722, "display_filter": "frame.number == 13722", "timestamp_epoch": "1723680984.950762000" }, { "tcp_stream": 214, "frame_number": 13725, "display_filter": "frame.number == 13725", "timestamp_epoch": "1723680984.951327000" } ] }, { "id": "finding-8367718ddef3981991b6f583", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.8.15.4", "protocol": "samr", "destination": "10.8.15.133", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1, "frame_number": 1097, "display_filter": "frame.number == 1097", "timestamp_epoch": "1723680608.292835000" }, { "tcp_stream": 1, "frame_number": 1099, "display_filter": "frame.number == 1099", "timestamp_epoch": "1723680608.293290000" }, { "tcp_stream": 1, "frame_number": 1101, "display_filter": "frame.number == 1101", "timestamp_epoch": "1723680608.293826000" }, { "tcp_stream": 1, "frame_number": 1103, "display_filter": "frame.number == 1103", "timestamp_epoch": "1723680608.294335000" }, { "tcp_stream": 1, "frame_number": 1105, "display_filter": "frame.number == 1105", "timestamp_epoch": "1723680608.294889000" }, { "tcp_stream": 1, "frame_number": 1107, "display_filter": "frame.number == 1107", "timestamp_epoch": "1723680608.295392000" }, { "tcp_stream": 1, "frame_number": 1109, "display_filter": "frame.number == 1109", "timestamp_epoch": "1723680608.296055000" }, { "tcp_stream": 1, "frame_number": 1111, "display_filter": "frame.number == 1111", "timestamp_epoch": "1723680608.296635000" }, { "tcp_stream": 1, "frame_number": 1113, "display_filter": "frame.number == 1113", "timestamp_epoch": "1723680608.297258000" }, { "tcp_stream": 1, "frame_number": 1115, "display_filter": "frame.number == 1115", "timestamp_epoch": "1723680608.297744000" }, { "tcp_stream": 1, "frame_number": 1117, "display_filter": "frame.number == 1117", "timestamp_epoch": "1723680608.298252000" }, { "tcp_stream": 1, "frame_number": 1119, "display_filter": "frame.number == 1119", "timestamp_epoch": "1723680608.298712000" }, { "tcp_stream": 1, "frame_number": 1121, "display_filter": "frame.number == 1121", "timestamp_epoch": "1723680608.299161000" }, { "tcp_stream": 1, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1723680608.299551000" }, { "tcp_stream": 1, "frame_number": 1125, "display_filter": "frame.number == 1125", "timestamp_epoch": "1723680608.299949000" } ] }, { "id": "identity-a1d9e1472ff63f841125e94b", "type": "identity", "label": "account: desktop-h8alzbv$", "value": "desktop-h8alzbv$", "source": "deterministic-pcap-analysis", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.8.15.133" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 5, "frame_number": 151, "display_filter": "frame.number == 151", "timestamp_epoch": "1723680586.099681000" }, { "tcp_stream": 8, "frame_number": 166, "display_filter": "frame.number == 166", "timestamp_epoch": "1723680586.110090000" }, { "tcp_stream": 9, "frame_number": 169, "display_filter": "frame.number == 169", "timestamp_epoch": "1723680586.110373000" }, { "tcp_stream": 9, "frame_number": 173, "display_filter": "frame.number == 173", "timestamp_epoch": "1723680586.111602000" }, { "tcp_stream": 10, "frame_number": 187, "display_filter": "frame.number == 187", "timestamp_epoch": "1723680586.120910000" }, { "tcp_stream": 10, "frame_number": 195, "display_filter": "frame.number == 195", "timestamp_epoch": "1723680586.122161000" }, { "tcp_stream": 13, "frame_number": 200, "display_filter": "frame.number == 200", "timestamp_epoch": "1723680586.122720000" }, { "tcp_stream": 16, "frame_number": 224, "display_filter": "frame.number == 224", "timestamp_epoch": "1723680586.133379000" }, { "tcp_stream": 15, "frame_number": 226, "display_filter": "frame.number == 226", "timestamp_epoch": "1723680586.134061000" }, { "tcp_stream": 14, "frame_number": 228, "display_filter": "frame.number == 228", "timestamp_epoch": "1723680586.134077000" }, { "tcp_stream": 16, "frame_number": 231, "display_filter": "frame.number == 231", "timestamp_epoch": "1723680586.134839000" }, { "tcp_stream": 17, "frame_number": 261, "display_filter": "frame.number == 261", "timestamp_epoch": "1723680586.153796000" }, { "tcp_stream": 18, "frame_number": 264, "display_filter": "frame.number == 264", "timestamp_epoch": "1723680586.154217000" }, { "tcp_stream": 23, "frame_number": 390, "display_filter": "frame.number == 390", "timestamp_epoch": "1723680586.347727000" }, { "tcp_stream": 28, "frame_number": 493, "display_filter": "frame.number == 493", "timestamp_epoch": "1723680586.914545000" }, { "tcp_stream": 30, "frame_number": 521, "display_filter": "frame.number == 521", "timestamp_epoch": "1723680586.976933000" }, { "tcp_stream": 31, "frame_number": 533, "display_filter": "frame.number == 533", "timestamp_epoch": "1723680586.979822000" }, { "tcp_stream": 41, "frame_number": 922, "display_filter": "frame.number == 922", "timestamp_epoch": "1723680594.933396000" }, { "tcp_stream": 42, "frame_number": 930, "display_filter": "frame.number == 930", "timestamp_epoch": "1723680594.934916000" }, { "tcp_stream": 42, "frame_number": 932, "display_filter": "frame.number == 932", "timestamp_epoch": "1723680594.935625000" } ] }, { "id": "identity-49f63ac83d3ec8fa3cb4336e", "type": "identity", "label": "account: plucero", "value": "plucero", "source": "deterministic-pcap-analysis", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.8.15.133" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 44, "frame_number": 975, "display_filter": "frame.number == 975", "timestamp_epoch": "1723680608.106952000" }, { "tcp_stream": 45, "frame_number": 983, "display_filter": "frame.number == 983", "timestamp_epoch": "1723680608.115612000" }, { "tcp_stream": 45, "frame_number": 985, "display_filter": "frame.number == 985", "timestamp_epoch": "1723680608.116435000" }, { "tcp_stream": 46, "frame_number": 997, "display_filter": "frame.number == 997", "timestamp_epoch": "1723680608.118716000" }, { "tcp_stream": 47, "frame_number": 1011, "display_filter": "frame.number == 1011", "timestamp_epoch": "1723680608.253051000" }, { "tcp_stream": 50, "frame_number": 1059, "display_filter": "frame.number == 1059", "timestamp_epoch": "1723680608.280003000" }, { "tcp_stream": 51, "frame_number": 1071, "display_filter": "frame.number == 1071", "timestamp_epoch": "1723680608.281162000" }, { "tcp_stream": 1, "frame_number": 1111, "display_filter": "frame.number == 1111", "timestamp_epoch": "1723680608.296635000" }, { "tcp_stream": 53, "frame_number": 1142, "display_filter": "frame.number == 1142", "timestamp_epoch": "1723680608.418138000" }, { "tcp_stream": 153, "frame_number": 11648, "display_filter": "frame.number == 11648", "timestamp_epoch": "1723680795.695877000" } ] }, { "id": "identity-b8cfb454bcd56e2760ca82cb", "type": "identity", "label": "full-name: Pierce Lucero", "value": "Pierce Lucero", "source": "deterministic-pcap-analysis", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.8.15.133" ], "identity_type": "full-name", "frame_evidence": [ { "tcp_stream": 1, "frame_number": 1111, "display_filter": "frame.number == 1111", "timestamp_epoch": "1723680608.296635000" } ] }, { "id": "identity-a54cc6d236e20e959a716415", "type": "identity", "label": "hostname: DESKTOP-H8ALZBV", "value": "DESKTOP-H8ALZBV", "source": "deterministic-pcap-analysis", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.8.15.133" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1723680583.804291000" }, { "udp_stream": 0, "frame_number": 3, "display_filter": "frame.number == 3", "timestamp_epoch": "1723680583.815024000" }, { "udp_stream": 0, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1723680583.827903000" }, { "udp_stream": 6, "frame_number": 30, "display_filter": "frame.number == 30", "timestamp_epoch": "1723680584.241556000" }, { "udp_stream": 6, "frame_number": 58, "display_filter": "frame.number == 58", "timestamp_epoch": "1723680584.988227000" }, { "udp_stream": 6, "frame_number": 104, "display_filter": "frame.number == 104", "timestamp_epoch": "1723680585.739856000" }, { "udp_stream": 6, "frame_number": 446, "display_filter": "frame.number == 446", "timestamp_epoch": "1723680586.500412000" }, { "udp_stream": 6, "frame_number": 471, "display_filter": "frame.number == 471", "timestamp_epoch": "1723680586.644505000" }, { "udp_stream": 6, "frame_number": 693, "display_filter": "frame.number == 693", "timestamp_epoch": "1723680587.408847000" }, { "udp_stream": 6, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1723680588.173575000" }, { "udp_stream": 6, "frame_number": 759, "display_filter": "frame.number == 759", "timestamp_epoch": "1723680588.933467000" }, { "udp_stream": 18, "frame_number": 841, "display_filter": "frame.number == 841", "timestamp_epoch": "1723680589.743833000" }, { "udp_stream": 18, "frame_number": 12013, "display_filter": "frame.number == 12013", "timestamp_epoch": "1723680827.249355000" }, { "udp_stream": 18, "frame_number": 15256, "display_filter": "frame.number == 15256", "timestamp_epoch": "1723681305.542611000" }, { "udp_stream": 18, "frame_number": 17047, "display_filter": "frame.number == 17047", "timestamp_epoch": "1723682026.693492000" } ] }, { "id": "identity-84f2ba2861245fda99f1c11f", "type": "identity", "label": "netbios-group: LAFONTAINEBLEU", "value": "LAFONTAINEBLEU", "source": "deterministic-pcap-analysis", "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [], "identity_type": "netbios-group", "frame_evidence": [ { "udp_stream": 6, "frame_number": 31, "display_filter": "frame.number == 31", "timestamp_epoch": "1723680584.242030000" }, { "udp_stream": 6, "frame_number": 57, "display_filter": "frame.number == 57", "timestamp_epoch": "1723680584.988087000" }, { "udp_stream": 6, "frame_number": 103, "display_filter": "frame.number == 103", "timestamp_epoch": "1723680585.739794000" }, { "udp_stream": 6, "frame_number": 447, "display_filter": "frame.number == 447", "timestamp_epoch": "1723680586.500505000" } ] }, { "id": "artifact-82693d03230b29d1a84e3e66", "type": "file-artifact", "label": "managements%3f16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215", "value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5", "sha256": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5", "source": "deterministic-pcap-analysis", "size_bytes": 2767804, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-6a7013f40e98c8ac566dd3af", "type": "file-artifact", "label": "0f60a3e7baecf2748b1c8183ed37d1e4", "value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6", "sha256": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6", "source": "deterministic-pcap-analysis", "size_bytes": 159232, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-7dda5d6d20ead492a77e1269", "type": "file-artifact", "label": "%2f(3)", "value": "261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594", "sha256": "261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594", "source": "deterministic-pcap-analysis", "size_bytes": 305148, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-4dfb6619d91e00def004f454", "type": "file-artifact", "label": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(3)", "value": "8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47", "sha256": "8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47", "source": "deterministic-pcap-analysis", "size_bytes": 108543, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-bcfbe9fa1545669101eac2ec", "type": "file-artifact", "label": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(2)", "value": "6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c", "sha256": "6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c", "source": "deterministic-pcap-analysis", "size_bytes": 29990, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-8991c11376e0ba833b381a71", "type": "file-artifact", "label": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "value": "f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332", "sha256": "f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332", "source": "deterministic-pcap-analysis", "size_bytes": 18882, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-92eb79afacf5e470bf9e792d", "type": "file-artifact", "label": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(1)", "value": "be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252", "sha256": "be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252", "source": "deterministic-pcap-analysis", "size_bytes": 13809, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-bd2ce25940d789b12c4f79b2", "type": "file-artifact", "label": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(3)", "value": "9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499", "sha256": "9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499", "source": "deterministic-pcap-analysis", "size_bytes": 7930, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-a14e0ced8cfa4b619e58e9c0", "type": "file-artifact", "label": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(2)", "value": "41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b", "sha256": "41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b", "source": "deterministic-pcap-analysis", "size_bytes": 4630, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-81d38c4bdd1064aa87f238e6", "type": "file-artifact", "label": "MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D", "value": "2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6", "sha256": "2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6", "source": "deterministic-pcap-analysis", "size_bytes": 1782, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-f418088b932533b9c4c671a5", "type": "file-artifact", "label": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(1)", "value": "0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2", "sha256": "0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2", "source": "deterministic-pcap-analysis", "size_bytes": 1340, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-3f7eb057f5f252ca76a8f5c6", "type": "file-artifact", "label": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "value": "c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110", "sha256": "c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110", "source": "deterministic-pcap-analysis", "size_bytes": 1120, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-415191c3d61d03eda7d9cf81", "type": "file-artifact", "label": "%2f(5)", "value": "f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64", "sha256": "f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64", "source": "deterministic-pcap-analysis", "size_bytes": 732, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-1bd046466e9506632d63e0e7", "type": "file-artifact", "label": "%2f(1)", "value": "5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4", "sha256": "5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4", "source": "deterministic-pcap-analysis", "size_bytes": 124, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-7893654ab9f44cdf7b6acf5a", "type": "file-artifact", "label": "%2f(10)", "value": "f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e", "sha256": "f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e", "source": "deterministic-pcap-analysis", "size_bytes": 94, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-ea74cc4689a1cabb5f8fc9a3", "type": "file-artifact", "label": "%2f", "value": "dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123", "sha256": "dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123", "source": "deterministic-pcap-analysis", "size_bytes": 32, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-4cb50240de9ae0db273327a9", "type": "file-artifact", "label": "connecttest.txt", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "sha256": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "source": "deterministic-pcap-analysis", "size_bytes": 22, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "text/plain" }, { "id": "artifact-f191a5f8018208969dce50f8", "type": "file-artifact", "label": "ProcessMAU.txt", "value": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820", "sha256": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820", "source": "deterministic-pcap-analysis", "size_bytes": 4, "source_ref": "2024-08-15-traffic-analysis-exercise.pcap", "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "source_refs": [ "2024-08-15-traffic-analysis-exercise.pcap", "deterministic-pcap-analysis" ], "content_type": "text/plain" } ], "evidence_edges": [], "timeline": [ { "at": "2026-09-19T12:50:26.861Z", "event": "Added Log/PCAP analysis 2024-08-15-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2024-08-15-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 1 }, { "at": "2026-09-19T12:58:15.325Z", "event": "Added Log/PCAP analysis 2024-08-15-traffic-analysis-exercise.pcap", "source": "Log/PCAP analysis 2024-08-15-traffic-analysis-exercise.pcap", "actor_count": 0, "report_count": 0, "technique_count": 1 } ], "created_at": "2026-09-19T12:50:22.500968+00:00", "updated_at": "2026-09-19T12:58:15.352937+00:00" }