{
  "id": "19851c85-b03b-4655-bc64-64c6f1520100",
  "name": "PCAP verified workflow 2024-11-26 20260919",
  "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.",
  "status": "active",
  "domain": "enterprise-attack",
  "actor_ids": [],
  "technique_ids": [
    "T1071.001",
    "T1219"
  ],
  "report_ids": [],
  "evidence_nodes": [
    {
      "id": "log-pcap:08324647-35af-4af2-8d82-4387eec03918",
      "type": "log-pcap-analysis",
      "label": "2024-11-26-traffic-analysis-exercise.pcap",
      "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2024-11-26-traffic-analysis-exercise.pcap\nCapture SHA-256: `a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50`\nSemantic result SHA-256: `4fa4f2aabaa7bcc51a396dcd62fc65dbd2ee862d01d0ba16095da5915212d518`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 26922 packets across 61 IP endpoints and 276 transport flows. Observed 343 DNS events, 74 HTTP requests, 109 TLS ClientHello events, and 11 exported HTTP object(s). Deterministic rules produced 12 finding(s): 2 high, 2 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 26922\n- Duration: 3259.651349 seconds\n- Captured bytes: 20851149\n- Endpoints: 61\n- Flows: 276\n\n## Deterministic findings\n\n### MEDIUM — Cleartext HTTP observed on TCP/443\n\nThe decoded application protocol is HTTP despite use of the conventional TLS port.\n\nRule: `http-on-tls-port@pcap-rules-v3`; confidence: 0.98; evidence: frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77.\n\nMetrics: `{\"destination\":\"194.180.191.64\",\"host\":\"194.180.191.64\",\"request_count\":58,\"source\":\"10.11.26.183\",\"uri\":\"http://194.180.191.64/fakeurl.htm\"}`\n\n### HIGH — Periodic HTTP callback pattern\n\nRepeated requests have a stable cadence consistent with automated callback or beacon behavior.\n\nRule: `periodic-http-callbacks@pcap-rules-v3`; confidence: 0.88; evidence: frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77.\n\nMetrics: `{\"destination\":\"194.180.191.64\",\"host\":\"194.180.191.64\",\"median_absolute_deviation\":0.091,\"median_interval_seconds\":60.154,\"method\":\"POST\",\"port\":443,\"request_count\":58,\"source\":\"10.11.26.183\",\"uri\":\"http://194.180.191.64/fakeurl.htm\"}`\n\n### HIGH — Remote-access software network signature\n\nAn HTTP User-Agent explicitly identifies remote-access software. Validate authorization and endpoint ownership.\n\nRule: `remote-access-user-agent@pcap-rules-v3`; confidence: 0.95; evidence: frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77.\n\nMetrics: `{\"destination\":\"194.180.191.64\",\"request_count\":58,\"source\":\"10.11.26.183\",\"user_agent\":\"NetSupport Manager/1.3\"}`\n\n### MEDIUM — Repeated outbound HTTP POST activity\n\nThe same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.\n\nRule: `repeated-http-posts@pcap-rules-v3`; confidence: 0.72; evidence: frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77.\n\nMetrics: `{\"declared_body_bytes\":2624,\"destination\":\"194.180.191.64\",\"host\":\"194.180.191.64\",\"port\":443,\"request_count\":58,\"source\":\"10.11.26.183\",\"uri\":\"http://194.180.191.64/fakeurl.htm\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 23, frame 25, frame 189, frame 190, frame 902.\n\nMetrics: `{\"domain\":\"wpad.mshome.net\",\"response_count\":24,\"source\":\"10.11.26.183\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 19, frame 20, frame 185, frame 186, frame 898.\n\nMetrics: `{\"domain\":\"wpad.nemotoads.health\",\"response_count\":24,\"source\":\"10.11.26.183\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 304 / TCP stream 11, frame 309 / TCP stream 11, frame 312 / TCP stream 11, frame 315 / TCP stream 11, frame 486 / TCP stream 24.\n\nMetrics: `{\"destination\":\"10.11.26.3\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.11.26.183\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 36 / TCP stream 1, frame 43 / TCP stream 1, frame 46 / TCP stream 1, frame 359 / TCP stream 16, frame 371 / TCP stream 16.\n\nMetrics: `{\"destination\":\"10.11.26.3\",\"event_count\":64,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.11.26.183\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 330 / TCP stream 10, frame 334 / TCP stream 10, frame 340 / TCP stream 10, frame 344 / TCP stream 10, frame 346 / TCP stream 10.\n\nMetrics: `{\"destination\":\"10.11.26.3\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.11.26.183\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 305 / TCP stream 11, frame 311 / TCP stream 11, frame 313 / TCP stream 11, frame 316 / TCP stream 11, frame 487 / TCP stream 24.\n\nMetrics: `{\"destination\":\"10.11.26.183\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.11.26.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 40 / TCP stream 1, frame 45 / TCP stream 1, frame 363 / TCP stream 16, frame 379 / TCP stream 16, frame 383 / TCP stream 16.\n\nMetrics: `{\"destination\":\"10.11.26.183\",\"event_count\":49,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.11.26.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 333 / TCP stream 10, frame 337 / TCP stream 10, frame 342 / TCP stream 10, frame 345 / TCP stream 10, frame 348 / TCP stream 10.\n\nMetrics: `{\"destination\":\"10.11.26.183\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.11.26.3\"}`\n\n## ATT&CK candidates\n\n- T1071.001 Application Layer Protocol: Web Protocols (command-and-control), confidence=0.85, status=suggested; basis=versioned-deterministic-rule.\n- T1219 Remote Access Software (command-and-control), confidence=0.9, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `oboomwald`; client IPs: 10.11.26.183; frames: 213, 221, 223, 235, 275\n- full-name: `Oliver Q. Boomwald`; client IPs: 10.11.26.183; frames: 355\n- hostname: `DESKTOP-B8TQK49`; client IPs: 10.11.26.183; frames: 69, 70, 145, 146, 174\n- netbios-group: `NEMOTODES`; client IPs: unbound subject; frames: 71, 144, 176, 180, 191\n\n## IOC and artifact candidates\n\n- domain: `a1834.dscg2.akamai.net`; roles: dns-cname\n- domain: `acroipm2.adobe.com`; roles: dns-query, http-host\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `armmf.adobe.com`; roles: dns-query, tls-sni\n- domain: `assets.msn.com`; roles: dns-query, tls-sni\n- domain: `checkappexec.microsoft.com`; roles: dns-query, tls-sni\n- domain: `classicgrand.com`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `code.jquery.com`; roles: dns-query, tls-sni\n- domain: `confirmsubscription.com`; roles: dns-query, tls-sni\n- domain: `css.createsend1.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `d33w6v2v5ta015.cloudfront.net`; roles: dns-cname\n- domain: `data-edge.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `default.exp-tas.com`; roles: dns-query, tls-sni\n- domain: `displaycatalog.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `edge-microsoft-com.dual-a-0036.a-msedge.net`; roles: dns-cname\n- domain: `edge.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fa000000002.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fa000000005.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fa000000116.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fa000000128.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fa000000163.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fd.api.iris.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fonts.googleapis.com`; roles: dns-query, tls-sni\n- domain: `fonts.gstatic.com`; roles: dns-query, tls-sni\n- domain: `geo.netsupportsoftware.com`; roles: dns-query, http-host\n- domain: `img-s-msn-com.akamaized.net`; roles: dns-query, tls-sni\n- domain: `inputsuggestions.msdxcdn.microsoft.com`; roles: dns-query, tls-sni\n- domain: `js.createsend1.com`; roles: dns-query, tls-sni\n- domain: `licensing.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.live.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: tls-sni\n- domain: `maps.googleapis.com`; roles: dns-query, tls-sni\n- domain: `maps.gstatic.com`; roles: dns-query, tls-sni\n- domain: `mobile.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `modandcrackedapk.com`; roles: dns-query, tls-sni\n- domain: `mrodevicemgr.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `nav.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `nemotodes-dc.nemotoads.health`; roles: dns-query\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `officeclient.microsoft.com`; roles: dns-query, tls-sni\n- domain: `prod.mrodevicemgr.live.com.akadns.net`; roles: dns-cname\n- domain: `r10.o.lencr.org`; roles: dns-query, http-host\n- domain: `srtb.msn.com`; roles: dns-query, tls-sni\n- domain: `storecatalogrevocation.storequality.microsoft.com`; roles: dns-query, tls-sni\n- domain: `th.bing.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `windows.msn.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.mshome.net`; roles: dns-query\n- domain: `wpad.nemotoads.health`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.google.com`; roles: dns-query, tls-sni\n- domain: `www.gstatic.com`; roles: dns-query, tls-sni\n- domain: `www.msftconnecttest.com`; roles: dns-query, http-host\n- domain: `www.msn.com`; roles: dns-query, tls-sni\n- ipv4: `10.11.26.183`; roles: network-endpoint\n- ipv4: `10.11.26.255`; roles: network-endpoint\n- ipv4: `10.11.26.3`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.104`; roles: dns-answer\n- ipv4: `104.117.244.105`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.106`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.107`; roles: dns-answer\n- ipv4: `104.117.244.112`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.114`; roles: dns-answer\n- ipv4: `104.117.244.72`; roles: dns-answer\n- ipv4: `104.117.244.74`; roles: dns-answer\n- ipv4: `104.117.244.81`; roles: dns-answer\n- ipv4: `104.117.244.82`; roles: dns-answer\n- ipv4: `104.117.244.88`; roles: dns-answer\n- ipv4: `104.117.244.89`; roles: dns-answer\n- ipv4: `104.117.244.91`; roles: dns-answer\n- ipv4: `104.117.244.96`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.97`; roles: dns-answer\n- ipv4: `104.117.244.99`; roles: dns-answer\n- ipv4: `104.117.247.139`; roles: dns-answer\n- ipv4: `104.117.247.144`; roles: dns-answer\n- ipv4: `104.117.247.162`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.247.184`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.247.186`; roles: dns-answer\n- ipv4: `104.117.247.67`; roles: dns-answer\n- ipv4: `104.117.247.99`; roles: dns-answer, network-endpoint\n- ipv4: `104.26.0.231`; roles: dns-answer\n- ipv4: `104.26.1.231`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.239`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.57`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.93`; roles: dns-answer, network-endpoint\n- ipv4: `13.56.30.207`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `142.250.113.120`; roles: dns-answer, network-endpoint\n- ipv4: `142.250.113.94`; roles: dns-answer, network-endpoint\n- ipv4: `142.250.113.95`; roles: dns-answer\n- ipv4: `142.250.114.95`; roles: dns-answer\n- ipv4: `142.250.115.95`; roles: dns-answer, network-endpoint\n- ipv4: `142.250.138.94`; roles: dns-answer, network-endpoint\n- ipv4: `142.251.116.95`; roles: dns-answer\n- ipv4: `142.251.186.103`; roles: dns-answer\n- ipv4: `142.251.186.104`; roles: dns-answer\n- ipv4: `142.251.186.105`; roles: dns-answer\n- ipv4: `142.251.186.106`; roles: dns-answer\n- ipv4: `142.251.186.147`; roles: dns-answer, network-endpoint\n- ipv4: `142.251.186.95`; roles: dns-answer, network-endpoint\n- ipv4: `142.251.186.99`; roles: dns-answer\n- ipv4: `151.101.130.137`; roles: dns-answer\n- ipv4: `151.101.194.137`; roles: dns-answer\n- ipv4: `151.101.2.137`; roles: dns-answer\n- ipv4: `151.101.66.137`; roles: dns-answer, network-endpoint\n- ipv4: `172.67.68.212`; roles: dns-answer\n- ipv4: `173.222.49.101`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.103`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.61`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.77`; roles: dns-answer\n- ipv4: `18.160.156.92`; roles: dns-answer\n- ipv4: `193.42.38.139`; roles: dns-answer, network-endpoint\n- ipv4: `194.180.191.64`; roles: http-host, network-endpoint\n- ipv4: `20.189.173.16`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.23`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.26`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.6`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.135.2`; roles: dns-answer\n- ipv4: `20.190.135.3`; roles: dns-answer\n- ipv4: `20.190.135.6`; roles: dns-answer\n- ipv4: `20.190.135.7`; roles: dns-answer\n- ipv4: `20.42.73.25`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.73.28`; roles: dns-answer, network-endpoint\n- ipv4: `20.7.1.246`; roles: dns-answer, network-endpoint\n- ipv4: `20.7.2.167`; roles: dns-answer, network-endpoint\n- ipv4: `20.96.153.111`; roles: dns-answer, network-endpoint\n- ipv4: `20.99.184.37`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.239`; roles: dns-answer, network-endpoint\n- ipv4: `213.246.109.5`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.201.68.167`; roles: dns-answer, network-endpoint\n- ipv4: `23.204.171.61`; roles: dns-answer, network-endpoint\n- ipv4: `23.219.87.81`; roles: dns-answer\n- ipv4: `23.221.22.196`; roles: dns-answer\n- ipv4: `23.221.22.205`; roles: dns-answer\n- ipv4: `23.221.22.206`; roles: dns-answer\n- ipv4: `23.221.22.207`; roles: dns-answer\n- ipv4: `23.221.22.208`; roles: dns-answer\n- ipv4: `23.221.22.209`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.22.217`; roles: dns-answer\n- ipv4: `23.221.22.218`; roles: dns-answer\n- ipv4: `23.221.22.219`; roles: dns-answer\n- ipv4: `23.221.22.46`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.22.57`; roles: dns-answer\n- ipv4: `23.53.127.105`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.127.114`; roles: dns-answer\n- ipv4: `23.53.127.200`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `4.149.227.78`; roles: dns-answer, network-endpoint\n- ipv4: `4.150.155.223`; roles: dns-answer, network-endpoint\n- ipv4: `40.118.171.167`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.11`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.14`; roles: dns-answer\n- ipv4: `40.126.28.22`; roles: dns-answer\n- ipv4: `40.126.29.9`; roles: network-endpoint\n- ipv4: `40.126.7.32`; roles: dns-answer\n- ipv4: `52.109.0.136`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.47`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.89`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.165.164.15`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.112.67`; roles: dns-answer, network-endpoint\n- ipv4: `52.8.34.0`; roles: dns-answer, network-endpoint\n- ja3: `0652c09be13a164e73c3c66e2d5cd600`; roles: tls-client-fingerprint\n- ja3: `089117d8abb9d0685ac2756412f44d8c`; roles: tls-client-fingerprint\n- ja3: `091f51a7a1c3a4504a224cc081ce9cee`; roles: tls-client-fingerprint\n- ja3: `0d7e324cc471d537395a5a84963ff4c0`; roles: tls-client-fingerprint\n- ja3: `10b3abe91219287930575e96187aab46`; roles: tls-client-fingerprint\n- ja3: `129a4a4460936a7d35cf0b4a876c02c5`; roles: tls-client-fingerprint\n- ja3: `1a41c18f74e0a1125e7eb86dc20da423`; roles: tls-client-fingerprint\n- ja3: `1aef2a0442d1535b67c961be49fbd9b0`; roles: tls-client-fingerprint\n- ja3: `1d2c110dc93a519d4c14a15898f20f6c`; roles: tls-client-fingerprint\n- ja3: `258a5a1e95b8a911872bae9081526644`; roles: tls-client-fingerprint\n- ja3: `2800f914a7a4ba98aa9df62d316a460c`; roles: tls-client-fingerprint\n- ja3: `2dd32544ddd46095f157e79a028dcda9`; roles: tls-client-fingerprint\n- ja3: `2ef63960b5419ce0be770acb72a1e6d5`; roles: tls-client-fingerprint\n- ja3: `34578b889dbdfd86b5a0639eb869f9c5`; roles: tls-client-fingerprint\n- ja3: `39a2db8b2473a3d4cfe7cb23a26e03d6`; roles: tls-client-fingerprint\n- ja3: `46181092bc7467ccd870ec99523f7113`; roles: tls-client-fingerprint\n- ja3: `488f29e13a0873e296eb2dcca6ec38d0`; roles: tls-client-fingerprint\n- ja3: `4c24b4903c9a3c9b3c46306472bda896`; roles: tls-client-fingerprint\n- ja3: `53e42f80bc48a39739f5221b803b1f70`; roles: tls-client-fingerprint\n- ja3: `5c0851e1f7c97a5fdf8ee34bd73a8ff4`; roles: tls-client-fingerprint\n- ja3: `6634ba84945fce7cc2d7864edc49b103`; roles: tls-client-fingerprint\n- ja3: `68b3ecfaf0034bb9fcbecd518b5ab8d4`; roles: tls-client-fingerprint\n- ja3: `6a5d235ee78c6aede6a61448b4e9ff1e`; roles: tls-client-fingerprint\n- ja3: `7117eb033929b913d5dbbef620c9ca24`; roles: tls-client-fingerprint\n- ja3: `7230db75fbd5472f76d02c10787af505`; roles: tls-client-fingerprint\n- ja3: `82fc3feb7b73141563a581cb3a02b9e2`; roles: tls-client-fingerprint\n- ja3: `893fda16143345fbd7d6384fd5f69a44`; roles: tls-client-fingerprint\n- ja3: `8f08a45cb17ce5d331bb4a861f26181f`; roles: tls-client-fingerprint\n- ja3: `910d5ef16eeb9c556a6f011876c16d38`; roles: tls-client-fingerprint\n- ja3: `9763df22d3de0549862e28d0f1103365`; roles: tls-client-fingerprint\n- ja3: `97cdfdfb6ce55b090e5070647c73305e`; roles: tls-client-fingerprint\n- ja3: `996d810fbaded0fd221205ee7a391364`; roles: tls-client-fingerprint\n- ja3: `9c5ffd0e64cc58a2ad1806964fe2da4e`; roles: tls-client-fingerprint\n- ja3: `a702db92a1dad8b0a7ddf9ef0fcf3d68`; roles: tls-client-fingerprint\n- ja3: `ab617a1bfb55ac132b8893703d7cfec3`; roles: tls-client-fingerprint\n- ja3: `af5ca235cbec16c4b5ad43da2bd9b40a`; roles: tls-client-fingerprint\n- ja3: `b13922eb23a33bd76cd8442814f25cb5`; roles: tls-client-fingerprint\n- ja3: `b6b910fa2621ea444621910f5e10aa4a`; roles: tls-client-fingerprint\n- ja3: `b8f7a95293e0d02d297ecef1efcc79d5`; roles: tls-client-fingerprint\n- ja3: `c73376907efd66947a8978eacfd15135`; roles: tls-client-fingerprint\n- ja3: `c806504b9d641f3b26d1af269ed474ab`; roles: tls-client-fingerprint\n- ja3: `c86423ffed1add9d50dccf646bd7fdbd`; roles: tls-client-fingerprint\n- ja3: `cbcf96af03d431db8e0fd90215b03309`; roles: tls-client-fingerprint\n- ja3: `d7268fba5c8ebdc86121861931c04402`; roles: tls-client-fingerprint\n- ja3: `e544273138fcf6e7dc137dd4f74d6fd0`; roles: tls-client-fingerprint\n- ja3: `e71e6cff682837413473fd63dc10f5d4`; roles: tls-client-fingerprint\n- ja3: `f24a7ea8a60779966dc83806405c4091`; roles: tls-client-fingerprint\n- ja3: `f82158b828f02d82f1f70fbb0f1d6145`; roles: tls-client-fingerprint\n- ja3: `fae0e5d973c96ae1888b99538efa0363`; roles: tls-client-fingerprint\n- sha256: `2b69346572041eefe558a82b58d654237e087ce9ab4e0876254a40a8954279a9`; roles: exported-object\n- sha256: `59dc18363d5d0313ae94aa0ecad2d06dc77144758eeae2cc5ed8b4eee3923752`; roles: exported-object\n- sha256: `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; roles: exported-object\n- sha256: `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; roles: exported-object\n- sha256: `79653567106d923034d36a9025d2d37955ff55dae5d77c1a79a321d850235d00`; roles: exported-object\n- sha256: `839e234a3a10b60d559ee5679d2019ad4e58d9cd66e6cfd971207c3c6ef8ea4d`; roles: exported-object\n- sha256: `975b5678560775735da4a9e8b805dce370329179b8e17ebc1c289aaeb293f7ff`; roles: exported-object\n- sha256: `a5a0a597e4b76ebec517a83126dbce37625a763b57307afe7064d9eb0a523956`; roles: exported-object\n- sha256: `af0c1c32558e6dc1e4e8f3e1d151268b8f6eb7cd844c9ac6dfc4b862decc7983`; roles: exported-object\n- sha256: `cd6f72bd96cbbad446325f8c2d087283f051ccaf77523dc436eec2d98be29bf7`; roles: exported-object\n- sha256: `f0e200cacd273e3dd257057f27aeda839a1f2f31482e0bb01ea8b1363a7af245`; roles: exported-object\n- url: `http://194.180.191.64/fakeurl.htm`; roles: http-request\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?778a0928305752e9`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ce02e9976e1239e1`; roles: http-request\n- url: `http://geo.netsupportsoftware.com/location/loca.asp`; roles: http-request\n- url: `http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D`; roles: http-request\n- url: `http://www.msftconnecttest.com/connecttest.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0)`; roles: http-client\n- user_agent: `NetSupport Manager/1.3`; roles: http-client\n- exported object `MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D`; SHA-256 `cd6f72bd96cbbad446325f8c2d087283f051ccaf77523dc436eec2d98be29bf7`; size 504 bytes\n- exported object `fakeurl(2).htm`; SHA-256 `839e234a3a10b60d559ee5679d2019ad4e58d9cd66e6cfd971207c3c6ef8ea4d`; size 250 bytes\n- exported object `fakeurl(3).htm`; SHA-256 `a5a0a597e4b76ebec517a83126dbce37625a763b57307afe7064d9eb0a523956`; size 152 bytes\n- exported object `fakeurl(5).htm`; SHA-256 `59dc18363d5d0313ae94aa0ecad2d06dc77144758eeae2cc5ed8b4eee3923752`; size 84 bytes\n- exported object `fakeurl(4).htm`; SHA-256 `f0e200cacd273e3dd257057f27aeda839a1f2f31482e0bb01ea8b1363a7af245`; size 76 bytes\n- exported object `fakeurl(1).htm`; SHA-256 `79653567106d923034d36a9025d2d37955ff55dae5d77c1a79a321d850235d00`; size 61 bytes\n- exported object `fakeurl(10).htm`; SHA-256 `975b5678560775735da4a9e8b805dce370329179b8e17ebc1c289aaeb293f7ff`; size 36 bytes\n- exported object `fakeurl(54).htm`; SHA-256 `2b69346572041eefe558a82b58d654237e087ce9ab4e0876254a40a8954279a9`; size 22 bytes\n- exported object `connecttest.txt`; SHA-256 `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; size 22 bytes\n- exported object `loca.asp`; SHA-256 `af0c1c32558e6dc1e4e8f3e1d151268b8f6eb7cd844c9ac6dfc4b862decc7983`; size 16 bytes\n- exported object `ProcessMAU.txt`; SHA-256 `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; size 4 bytes\n\n## Actor similarity leads\n\n- Orangeworm (G0071): 33% TTP overlap. This is an investigation lead, not attribution.\n- SilverTerrier (G0083): 20% TTP overlap. This is an investigation lead, not attribution.\n- RedEcho (G1042): 17% TTP overlap. This is an investigation lead, not attribution.\n- Carbanak (G0008): 10% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 10% TTP overlap. This is an investigation lead, not attribution.\n- GOLD SOUTHFIELD (G0115): 10% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 10% TTP overlap. This is an investigation lead, not attribution.\n- DarkVishnya (G0105): 9% TTP overlap. This is an investigation lead, not attribution.\n- APT18 (G0026): 8% TTP overlap. This is an investigation lead, not attribution.\n- FIN4 (G0085): 8% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `82f0a542eadbd91c1d0554cf45b8bd4f69607e372cf96649bcd6ec9cab5fafb8`; recorded 2026-09-19T12:08:41.573203+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":243,\"observable_limit\":5000,\"observables_checked\":243,\"observables_total\":243,\"prior_case_limit_reached\":false,\"prior_cases_checked\":6,\"truncated\":false}`\n\n- Catalog T1071.001: https://attack.mitre.org/techniques/T1071/001; detection strategies: [{\"attack_id\":\"DET0027\",\"name\":\"Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets\",\"stix_id\":\"x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc\"}]\n- Catalog T1219: https://attack.mitre.org/techniques/T1219; detection strategies: [{\"attack_id\":\"DET0496\",\"name\":\"Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)\",\"stix_id\":\"x-mitre-detection-strategy--ec412019-109f-4f84-aa2f-d623f40254e0\"}]\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 30 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 46 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 54 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":11,\"exported_objects\":66,\"hashed_bytes\":3596,\"hashed_objects\":66,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":11,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":11}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 12/12, identities 4/4, observables 243/243, artifacts 11/11. Full returned inventory is in the JSON result.\n",
      "summary": "Decoded 26922 packets across 61 IP endpoints and 276 transport flows. Observed 343 DNS events, 74 HTTP requests, 109 TLS ClientHello events, and 11 exported HTTP object(s). Deterministic rules produced 12 finding(s): 2 high, 2 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "observables": [
        {
          "type": "domain",
          "value": "a1834.dscg2.akamai.net",
          "confidence": 1,
          "description": "dns-cname; frame 20692 / UDP stream 93, frame 20693 / UDP stream 92"
        },
        {
          "type": "domain",
          "value": "acroipm2.adobe.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 21714 / UDP stream 109, frame 21715 / UDP stream 109, frame 21719 / TCP stream 108"
        },
        {
          "type": "domain",
          "value": "api.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 20707 / UDP stream 96, frame 20708 / UDP stream 97, frame 20743 / UDP stream 97, frame 20750 / UDP stream 96, frame 20772 / TCP stream 90 +1 more"
        },
        {
          "type": "domain",
          "value": "armmf.adobe.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 21723 / UDP stream 111, frame 21724 / UDP stream 111, frame 21728 / TCP stream 109"
        },
        {
          "type": "domain",
          "value": "assets.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 752 / UDP stream 25, frame 753 / UDP stream 25, frame 20709 / UDP stream 98, frame 20710 / UDP stream 99, frame 20744 / UDP stream 99 +4 more"
        },
        {
          "type": "domain",
          "value": "checkappexec.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 12720 / UDP stream 32, frame 12721 / UDP stream 32, frame 12725 / TCP stream 73"
        },
        {
          "type": "domain",
          "value": "classicgrand.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1173 / UDP stream 33, frame 1174 / UDP stream 34, frame 1177 / UDP stream 37, frame 1178 / UDP stream 38, frame 1179 / UDP stream 37 +5 more"
        },
        {
          "type": "domain",
          "value": "client.wns.windows.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 147 / UDP stream 15, frame 148 / UDP stream 15, frame 26869 / UDP stream 131, frame 26870 / UDP stream 131, frame 152 / TCP stream 5 +1 more"
        },
        {
          "type": "domain",
          "value": "code.jquery.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3939 / UDP stream 71, frame 3940 / UDP stream 72, frame 4018 / UDP stream 72, frame 4022 / UDP stream 71, frame 4120 / TCP stream 67"
        },
        {
          "type": "domain",
          "value": "confirmsubscription.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1334 / UDP stream 41, frame 1335 / UDP stream 42, frame 1336 / UDP stream 42, frame 1337 / UDP stream 41, frame 2683 / UDP stream 57 +5 more"
        },
        {
          "type": "domain",
          "value": "css.createsend1.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3366 / UDP stream 59, frame 3367 / UDP stream 60, frame 3600 / UDP stream 59, frame 3604 / UDP stream 60, frame 3611 / TCP stream 58"
        },
        {
          "type": "domain",
          "value": "ctldl.windowsupdate.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 26510 / UDP stream 128, frame 26511 / UDP stream 128, frame 26515 / TCP stream 134, frame 26518 / TCP stream 134"
        },
        {
          "type": "domain",
          "value": "d33w6v2v5ta015.cloudfront.net",
          "confidence": 1,
          "description": "dns-cname; frame 3599 / UDP stream 61, frame 3600 / UDP stream 59, frame 3601 / UDP stream 62, frame 3604 / UDP stream 60"
        },
        {
          "type": "domain",
          "value": "data-edge.smartscreen.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 924 / UDP stream 27, frame 925 / UDP stream 27, frame 932 / TCP stream 32"
        },
        {
          "type": "domain",
          "value": "default.exp-tas.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 942 / UDP stream 28, frame 945 / UDP stream 28, frame 953 / TCP stream 33, frame 965 / TCP stream 33, frame 1022 / TCP stream 35 +1 more"
        },
        {
          "type": "domain",
          "value": "displaycatalog.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 21419 / UDP stream 105, frame 21420 / UDP stream 105, frame 21437 / TCP stream 101"
        },
        {
          "type": "domain",
          "value": "dns.msftncsi.com",
          "confidence": 1,
          "description": "dns-query; frame 21374 / UDP stream 17, frame 21375 / UDP stream 17, frame 25849 / UDP stream 110, frame 25850 / UDP stream 110, frame 26020 / UDP stream 122 +11 more"
        },
        {
          "type": "domain",
          "value": "ecs.office.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 20496 / UDP stream 81, frame 20497 / UDP stream 81, frame 21853 / UDP stream 114, frame 21854 / UDP stream 114, frame 26233 / UDP stream 125 +14 more"
        },
        {
          "type": "domain",
          "value": "edge-microsoft-com.dual-a-0036.a-msedge.net",
          "confidence": 1,
          "description": "dns-cname; frame 1180 / UDP stream 36"
        },
        {
          "type": "domain",
          "value": "edge.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1175 / UDP stream 35, frame 1176 / UDP stream 36, frame 1180 / UDP stream 36, frame 1182 / UDP stream 35, frame 2548 / UDP stream 55 +15 more"
        },
        {
          "type": "domain",
          "value": "fa000000002.resources.office.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 22384 / UDP stream 116, frame 22387 / UDP stream 116, frame 22395 / TCP stream 121"
        },
        {
          "type": "domain",
          "value": "fa000000005.resources.office.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 22385 / UDP stream 117, frame 22386 / UDP stream 117, frame 22392 / TCP stream 120"
        },
        {
          "type": "domain",
          "value": "fa000000116.resources.office.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 23573 / UDP stream 118, frame 23574 / UDP stream 118, frame 23578 / TCP stream 122"
        },
        {
          "type": "domain",
          "value": "fa000000128.resources.office.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 23587 / UDP stream 119, frame 23589 / UDP stream 119, frame 23594 / TCP stream 123"
        },
        {
          "type": "domain",
          "value": "fa000000163.resources.office.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 23964 / UDP stream 120, frame 24030 / UDP stream 120, frame 24468 / TCP stream 124"
        },
        {
          "type": "domain",
          "value": "fd.api.iris.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 21201 / UDP stream 83, frame 21202 / UDP stream 83, frame 21206 / TCP stream 96"
        },
        {
          "type": "domain",
          "value": "fe3cr.delivery.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 21474 / UDP stream 107, frame 21475 / UDP stream 107, frame 21479 / TCP stream 103"
        },
        {
          "type": "domain",
          "value": "fonts.googleapis.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1718 / UDP stream 43, frame 1719 / UDP stream 44, frame 1754 / UDP stream 44, frame 1755 / UDP stream 43, frame 3767 / UDP stream 65 +5 more"
        },
        {
          "type": "domain",
          "value": "fonts.gstatic.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1751 / UDP stream 45, frame 1752 / UDP stream 46, frame 1753 / UDP stream 46, frame 1757 / UDP stream 45, frame 3850 / UDP stream 69 +7 more"
        },
        {
          "type": "domain",
          "value": "geo.netsupportsoftware.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 20331 / UDP stream 79, frame 20332 / UDP stream 79, frame 20336 / TCP stream 78"
        },
        {
          "type": "domain",
          "value": "img-s-msn-com.akamaized.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 20690 / UDP stream 92, frame 20691 / UDP stream 93, frame 20692 / UDP stream 93, frame 20693 / UDP stream 92, frame 20706 / TCP stream 89"
        },
        {
          "type": "domain",
          "value": "inputsuggestions.msdxcdn.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1052 / UDP stream 30, frame 1053 / UDP stream 30, frame 1054 / UDP stream 30, frame 1058 / TCP stream 36, frame 1062 / TCP stream 36"
        },
        {
          "type": "domain",
          "value": "js.createsend1.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3368 / UDP stream 61, frame 3369 / UDP stream 62, frame 3599 / UDP stream 61, frame 3601 / UDP stream 62, frame 3613 / TCP stream 57"
        },
        {
          "type": "domain",
          "value": "licensing.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 59 / UDP stream 10, frame 60 / UDP stream 10, frame 68 / TCP stream 3, frame 109 / TCP stream 4"
        },
        {
          "type": "domain",
          "value": "login.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 947 / UDP stream 29, frame 949 / UDP stream 29, frame 962 / TCP stream 34"
        },
        {
          "type": "domain",
          "value": "login.microsoftonline.com",
          "confidence": 1,
          "description": "tls-sni; frame 588 / TCP stream 27, frame 623 / TCP stream 27"
        },
        {
          "type": "domain",
          "value": "maps.googleapis.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2095 / UDP stream 51, frame 2096 / UDP stream 52, frame 2109 / UDP stream 51, frame 2114 / UDP stream 52, frame 2153 / TCP stream 52 +1 more"
        },
        {
          "type": "domain",
          "value": "maps.gstatic.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2093 / UDP stream 49, frame 2094 / UDP stream 50, frame 2108 / UDP stream 49, frame 2110 / UDP stream 50, frame 2149 / TCP stream 51"
        },
        {
          "type": "domain",
          "value": "mobile.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 21827 / UDP stream 113, frame 21828 / UDP stream 113, frame 25976 / UDP stream 121, frame 25977 / UDP stream 121, frame 21832 / TCP stream 112 +5 more"
        },
        {
          "type": "domain",
          "value": "modandcrackedapk.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1332 / UDP stream 39, frame 1333 / UDP stream 40, frame 1374 / UDP stream 39, frame 1377 / UDP stream 40, frame 2512 / UDP stream 53 +13 more"
        },
        {
          "type": "domain",
          "value": "mrodevicemgr.officeapps.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 22276 / UDP stream 115, frame 22277 / UDP stream 115, frame 22314 / TCP stream 119"
        },
        {
          "type": "domain",
          "value": "nav.smartscreen.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 904 / UDP stream 26, frame 905 / UDP stream 26, frame 909 / TCP stream 31"
        },
        {
          "type": "domain",
          "value": "nemotodes-dc.nemotoads.health",
          "confidence": 1,
          "description": "dns-query; frame 26594 / UDP stream 131, frame 26595 / UDP stream 131"
        },
        {
          "type": "domain",
          "value": "odc.officeapps.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 681 / UDP stream 24, frame 691 / UDP stream 24, frame 715 / TCP stream 29"
        },
        {
          "type": "domain",
          "value": "officeclient.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 445 / UDP stream 21, frame 455 / UDP stream 21, frame 530 / TCP stream 22"
        },
        {
          "type": "domain",
          "value": "prod.mrodevicemgr.live.com.akadns.net",
          "confidence": 1,
          "description": "dns-cname; frame 22277 / UDP stream 115"
        },
        {
          "type": "domain",
          "value": "r10.o.lencr.org",
          "confidence": 1,
          "description": "dns-query, http-host; frame 12779 / UDP stream 78, frame 12780 / UDP stream 78, frame 12788 / TCP stream 76"
        },
        {
          "type": "domain",
          "value": "srtb.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 20803 / UDP stream 101, frame 20804 / UDP stream 102, frame 20805 / UDP stream 102, frame 20806 / UDP stream 101, frame 20822 / TCP stream 91 +1 more"
        },
        {
          "type": "domain",
          "value": "storecatalogrevocation.storequality.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 21422 / UDP stream 106, frame 21423 / UDP stream 106, frame 21427 / TCP stream 102"
        },
        {
          "type": "domain",
          "value": "th.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 20686 / UDP stream 88, frame 20687 / UDP stream 89, frame 20696 / UDP stream 89, frame 20700 / UDP stream 88, frame 20702"
        },
        {
          "type": "domain",
          "value": "v10.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 20352 / UDP stream 80, frame 20353 / UDP stream 80, frame 21376 / UDP stream 104, frame 21377 / UDP stream 104, frame 21610 / UDP stream 108 +12 more"
        },
        {
          "type": "domain",
          "value": "windows.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 439 / UDP stream 16, frame 440 / UDP stream 16, frame 20615 / UDP stream 84, frame 20616 / UDP stream 85, frame 20617 / UDP stream 84 +7 more"
        },
        {
          "type": "domain",
          "value": "wns.notify.trafficmanager.net",
          "confidence": 1,
          "description": "dns-cname; frame 148 / UDP stream 15, frame 26870 / UDP stream 131"
        },
        {
          "type": "domain",
          "value": "wpad.mshome.net",
          "confidence": 1,
          "description": "dns-query; frame 21 / UDP stream 4, frame 22 / UDP stream 3, frame 23 / UDP stream 4, frame 25 / UDP stream 3, frame 187 / UDP stream 17 +15 more"
        },
        {
          "type": "domain",
          "value": "wpad.nemotoads.health",
          "confidence": 1,
          "description": "dns-query; frame 15 / UDP stream 3, frame 16 / UDP stream 4, frame 19 / UDP stream 4, frame 20 / UDP stream 3, frame 183 / UDP stream 16 +15 more"
        },
        {
          "type": "domain",
          "value": "www.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 446 / UDP stream 22, frame 447 / UDP stream 22, frame 11968 / UDP stream 74, frame 11969 / UDP stream 75, frame 11970 / UDP stream 75 +8 more"
        },
        {
          "type": "domain",
          "value": "www.google.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1759 / UDP stream 47, frame 1760 / UDP stream 48, frame 1761 / UDP stream 48, frame 1773 / UDP stream 47, frame 1823 / TCP stream 49 +1 more"
        },
        {
          "type": "domain",
          "value": "www.gstatic.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3781 / UDP stream 67, frame 3782 / UDP stream 68, frame 3783 / UDP stream 68, frame 3790 / UDP stream 67, frame 3810 / TCP stream 61"
        },
        {
          "type": "domain",
          "value": "www.msftconnecttest.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 1 / UDP stream 0, frame 2 / UDP stream 0, frame 6 / TCP stream 0"
        },
        {
          "type": "domain",
          "value": "www.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 612 / UDP stream 23, frame 619 / UDP stream 23, frame 20641 / UDP stream 86, frame 20642 / UDP stream 87, frame 20643 / UDP stream 86 +5 more"
        },
        {
          "type": "ipv4",
          "value": "10.11.26.183",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.11.26.255",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.11.26.3",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 17 / UDP stream 2, frame 18 / UDP stream 1, frame 20414 / UDP stream 81, frame 26595 / UDP stream 131"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.104",
          "confidence": 1,
          "description": "dns-answer; frame 447 / UDP stream 22"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.105",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 11973 / UDP stream 74, frame 20697 / UDP stream 90, frame 20700 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.106",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.107",
          "confidence": 1,
          "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.112",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 447 / UDP stream 22"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.114",
          "confidence": 1,
          "description": "dns-answer; frame 447 / UDP stream 22, frame 11973 / UDP stream 74"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.72",
          "confidence": 1,
          "description": "dns-answer; frame 447 / UDP stream 22, frame 20697 / UDP stream 90, frame 20700 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.74",
          "confidence": 1,
          "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.81",
          "confidence": 1,
          "description": "dns-answer; frame 447 / UDP stream 22, frame 11973 / UDP stream 74"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.82",
          "confidence": 1,
          "description": "dns-answer; frame 447 / UDP stream 22, frame 20697 / UDP stream 90, frame 20700 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.88",
          "confidence": 1,
          "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.89",
          "confidence": 1,
          "description": "dns-answer; frame 447 / UDP stream 22, frame 11973 / UDP stream 74"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.91",
          "confidence": 1,
          "description": "dns-answer; frame 447 / UDP stream 22"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.96",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 11973 / UDP stream 74"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.97",
          "confidence": 1,
          "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "104.117.244.99",
          "confidence": 1,
          "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "104.117.247.139",
          "confidence": 1,
          "description": "dns-answer; frame 20693 / UDP stream 92"
        },
        {
          "type": "ipv4",
          "value": "104.117.247.144",
          "confidence": 1,
          "description": "dns-answer; frame 2 / UDP stream 0"
        },
        {
          "type": "ipv4",
          "value": "104.117.247.162",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 20693 / UDP stream 92"
        },
        {
          "type": "ipv4",
          "value": "104.117.247.184",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 2 / UDP stream 0"
        },
        {
          "type": "ipv4",
          "value": "104.117.247.186",
          "confidence": 1,
          "description": "dns-answer; frame 20693 / UDP stream 92"
        },
        {
          "type": "ipv4",
          "value": "104.117.247.67",
          "confidence": 1,
          "description": "dns-answer; frame 12780 / UDP stream 78"
        },
        {
          "type": "ipv4",
          "value": "104.117.247.99",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 12780 / UDP stream 78"
        },
        {
          "type": "ipv4",
          "value": "104.26.0.231",
          "confidence": 1,
          "description": "dns-answer; frame 20332 / UDP stream 79"
        },
        {
          "type": "ipv4",
          "value": "104.26.1.231",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 20332 / UDP stream 79"
        },
        {
          "type": "ipv4",
          "value": "13.107.21.239",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 1182 / UDP stream 35, frame 2564 / UDP stream 55, frame 3763 / UDP stream 63, frame 11993 / UDP stream 76"
        },
        {
          "type": "ipv4",
          "value": "13.107.246.57",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 1054 / UDP stream 30"
        },
        {
          "type": "ipv4",
          "value": "13.107.5.93",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 945 / UDP stream 28"
        },
        {
          "type": "ipv4",
          "value": "13.56.30.207",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 1337 / UDP stream 41, frame 2685 / UDP stream 57"
        },
        {
          "type": "ipv4",
          "value": "131.107.255.255",
          "confidence": 1,
          "description": "dns-answer; frame 21375 / UDP stream 17, frame 25850 / UDP stream 110, frame 26021 / UDP stream 122, frame 26209 / UDP stream 124, frame 26356 / UDP stream 126 +3 more"
        },
        {
          "type": "ipv4",
          "value": "142.250.113.120",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 2108 / UDP stream 49"
        },
        {
          "type": "ipv4",
          "value": "142.250.113.94",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 2108 / UDP stream 49, frame 3790 / UDP stream 67"
        },
        {
          "type": "ipv4",
          "value": "142.250.113.95",
          "confidence": 1,
          "description": "dns-answer; frame 2109 / UDP stream 51"
        },
        {
          "type": "ipv4",
          "value": "142.250.114.95",
          "confidence": 1,
          "description": "dns-answer; frame 2109 / UDP stream 51"
        },
        {
          "type": "ipv4",
          "value": "142.250.115.95",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 2109 / UDP stream 51"
        },
        {
          "type": "ipv4",
          "value": "142.250.138.94",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 1757 / UDP stream 45, frame 3852 / UDP stream 69"
        },
        {
          "type": "ipv4",
          "value": "142.251.116.95",
          "confidence": 1,
          "description": "dns-answer; frame 2109 / UDP stream 51"
        }
      ],
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap"
      ],
      "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50",
      "semantic_sha256": "4fa4f2aabaa7bcc51a396dcd62fc65dbd2ee862d01d0ba16095da5915212d518",
      "observable_count": 243,
      "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis",
      "source_analysis_ref": "/api/pcap/analyses/08324647-35af-4af2-8d82-4387eec03918",
      "suspicious_findings": [
        {
          "reason": "The decoded application protocol is HTTP despite use of the conventional TLS port. Rule http-on-tls-port@pcap-rules-v3; confidence 98%.",
          "category": "Cleartext HTTP observed on TCP/443",
          "evidence": "frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77 +53 more",
          "severity": "medium"
        },
        {
          "reason": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior. Rule periodic-http-callbacks@pcap-rules-v3; confidence 88%.",
          "category": "Periodic HTTP callback pattern",
          "evidence": "frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77 +53 more",
          "severity": "high"
        },
        {
          "reason": "An HTTP User-Agent explicitly identifies remote-access software. Validate authorization and endpoint ownership. Rule remote-access-user-agent@pcap-rules-v3; confidence 95%.",
          "category": "Remote-access software network signature",
          "evidence": "frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77 +53 more",
          "severity": "high"
        },
        {
          "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v3; confidence 72%.",
          "category": "Repeated outbound HTTP POST activity",
          "evidence": "frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77 +53 more",
          "severity": "medium"
        },
        {
          "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.",
          "category": "Repeated unsuccessful DNS resolution",
          "evidence": "frame 23 / UDP stream 4, frame 25 / UDP stream 3, frame 189 / UDP stream 17, frame 190 / UDP stream 16, frame 902 / UDP stream 26 +19 more",
          "severity": "low"
        },
        {
          "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.",
          "category": "Repeated unsuccessful DNS resolution",
          "evidence": "frame 19 / UDP stream 4, frame 20 / UDP stream 3, frame 185 / UDP stream 17, frame 186 / UDP stream 16, frame 898 / UDP stream 26 +19 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 304 / TCP stream 11, frame 309 / TCP stream 11, frame 312 / TCP stream 11, frame 315 / TCP stream 11, frame 486 / TCP stream 24 +20 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 36 / TCP stream 1, frame 43 / TCP stream 1, frame 46 / TCP stream 1, frame 359 / TCP stream 16, frame 371 / TCP stream 16 +59 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 330 / TCP stream 10, frame 334 / TCP stream 10, frame 340 / TCP stream 10, frame 344 / TCP stream 10, frame 346 / TCP stream 10 +10 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 305 / TCP stream 11, frame 311 / TCP stream 11, frame 313 / TCP stream 11, frame 316 / TCP stream 11, frame 487 / TCP stream 24 +20 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 40 / TCP stream 1, frame 45 / TCP stream 1, frame 363 / TCP stream 16, frame 379 / TCP stream 16, frame 383 / TCP stream 16 +44 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 333 / TCP stream 10, frame 337 / TCP stream 10, frame 342 / TCP stream 10, frame 345 / TCP stream 10, frame 348 / TCP stream 10 +10 more",
          "severity": "low"
        }
      ],
      "observables_truncated": true,
      "actor_similarity_leads": [
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Orangeworm",
          "similarity": 0.3333,
          "shared_count": 1,
          "group_attack_id": "G0071",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "SilverTerrier",
          "similarity": 0.2,
          "shared_count": 1,
          "group_attack_id": "G0083",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "RedEcho",
          "similarity": 0.1667,
          "shared_count": 1,
          "group_attack_id": "G1042",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Carbanak",
          "similarity": 0.1,
          "shared_count": 1,
          "group_attack_id": "G0008",
          "shared_techniques": [
            "T1219"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Metador",
          "similarity": 0.1,
          "shared_count": 1,
          "group_attack_id": "G1013",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "GOLD SOUTHFIELD",
          "similarity": 0.1,
          "shared_count": 1,
          "group_attack_id": "G0115",
          "shared_techniques": [
            "T1219"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Rancor",
          "similarity": 0.1,
          "shared_count": 1,
          "group_attack_id": "G0075",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "DarkVishnya",
          "similarity": 0.0909,
          "shared_count": 1,
          "group_attack_id": "G0105",
          "shared_techniques": [
            "T1219"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "APT18",
          "similarity": 0.0769,
          "shared_count": 1,
          "group_attack_id": "G0026",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "FIN4",
          "similarity": 0.0769,
          "shared_count": 1,
          "group_attack_id": "G0085",
          "shared_techniques": [
            "T1071.001"
          ]
        }
      ],
      "expected_suspicious_behaviors": []
    },
    {
      "id": "ttp-evidence:08324647-35af-4af2-8d82-4387eec03918:T1071.001",
      "type": "ttp-evidence",
      "label": "T1071.001 Application Layer Protocol: Web Protocols",
      "source": "log-pcap-analysis",
      "status": "suggested",
      "tactic": "command-and-control",
      "evidence": "T1071.001 Application Layer Protocol: Web Protocols",
      "attack_id": "T1071.001",
      "confidence": 0.85,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ttp-evidence:08324647-35af-4af2-8d82-4387eec03918:T1219",
      "type": "ttp-evidence",
      "label": "T1219 Remote Access Software",
      "source": "log-pcap-analysis",
      "status": "suggested",
      "tactic": "command-and-control",
      "evidence": "T1219 Remote Access Software",
      "attack_id": "T1219",
      "confidence": 0.9,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:a1834.dscg2.akamai.net",
      "type": "ioc",
      "value": "a1834.dscg2.akamai.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-cname; frame 20692 / UDP stream 93, frame 20693 / UDP stream 92",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:acroipm2.adobe.com",
      "type": "ioc",
      "value": "acroipm2.adobe.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, http-host; frame 21714 / UDP stream 109, frame 21715 / UDP stream 109, frame 21719 / TCP stream 108",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:api.msn.com",
      "type": "ioc",
      "value": "api.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 20707 / UDP stream 96, frame 20708 / UDP stream 97, frame 20743 / UDP stream 97, frame 20750 / UDP stream 96, frame 20772 / TCP stream 90 +1 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:armmf.adobe.com",
      "type": "ioc",
      "value": "armmf.adobe.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 21723 / UDP stream 111, frame 21724 / UDP stream 111, frame 21728 / TCP stream 109",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:assets.msn.com",
      "type": "ioc",
      "value": "assets.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 752 / UDP stream 25, frame 753 / UDP stream 25, frame 20709 / UDP stream 98, frame 20710 / UDP stream 99, frame 20744 / UDP stream 99 +4 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:checkappexec.microsoft.com",
      "type": "ioc",
      "value": "checkappexec.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 12720 / UDP stream 32, frame 12721 / UDP stream 32, frame 12725 / TCP stream 73",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:classicgrand.com",
      "type": "ioc",
      "value": "classicgrand.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 1173 / UDP stream 33, frame 1174 / UDP stream 34, frame 1177 / UDP stream 37, frame 1178 / UDP stream 38, frame 1179 / UDP stream 37 +5 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:client.wns.windows.com",
      "type": "ioc",
      "value": "client.wns.windows.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 147 / UDP stream 15, frame 148 / UDP stream 15, frame 26869 / UDP stream 131, frame 26870 / UDP stream 131, frame 152 / TCP stream 5 +1 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:code.jquery.com",
      "type": "ioc",
      "value": "code.jquery.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 3939 / UDP stream 71, frame 3940 / UDP stream 72, frame 4018 / UDP stream 72, frame 4022 / UDP stream 71, frame 4120 / TCP stream 67",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:confirmsubscription.com",
      "type": "ioc",
      "value": "confirmsubscription.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 1334 / UDP stream 41, frame 1335 / UDP stream 42, frame 1336 / UDP stream 42, frame 1337 / UDP stream 41, frame 2683 / UDP stream 57 +5 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:css.createsend1.com",
      "type": "ioc",
      "value": "css.createsend1.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 3366 / UDP stream 59, frame 3367 / UDP stream 60, frame 3600 / UDP stream 59, frame 3604 / UDP stream 60, frame 3611 / TCP stream 58",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ctldl.windowsupdate.com",
      "type": "ioc",
      "value": "ctldl.windowsupdate.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, http-host; frame 26510 / UDP stream 128, frame 26511 / UDP stream 128, frame 26515 / TCP stream 134, frame 26518 / TCP stream 134",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:d33w6v2v5ta015.cloudfront.net",
      "type": "ioc",
      "value": "d33w6v2v5ta015.cloudfront.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-cname; frame 3599 / UDP stream 61, frame 3600 / UDP stream 59, frame 3601 / UDP stream 62, frame 3604 / UDP stream 60",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:data-edge.smartscreen.microsoft.com",
      "type": "ioc",
      "value": "data-edge.smartscreen.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 924 / UDP stream 27, frame 925 / UDP stream 27, frame 932 / TCP stream 32",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:default.exp-tas.com",
      "type": "ioc",
      "value": "default.exp-tas.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 942 / UDP stream 28, frame 945 / UDP stream 28, frame 953 / TCP stream 33, frame 965 / TCP stream 33, frame 1022 / TCP stream 35 +1 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:displaycatalog.mp.microsoft.com",
      "type": "ioc",
      "value": "displaycatalog.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 21419 / UDP stream 105, frame 21420 / UDP stream 105, frame 21437 / TCP stream 101",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dns.msftncsi.com",
      "type": "ioc",
      "value": "dns.msftncsi.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query; frame 21374 / UDP stream 17, frame 21375 / UDP stream 17, frame 25849 / UDP stream 110, frame 25850 / UDP stream 110, frame 26020 / UDP stream 122 +11 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ecs.office.com",
      "type": "ioc",
      "value": "ecs.office.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 20496 / UDP stream 81, frame 20497 / UDP stream 81, frame 21853 / UDP stream 114, frame 21854 / UDP stream 114, frame 26233 / UDP stream 125 +14 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:edge-microsoft-com.dual-a-0036.a-msedge.net",
      "type": "ioc",
      "value": "edge-microsoft-com.dual-a-0036.a-msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-cname; frame 1180 / UDP stream 36",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:edge.microsoft.com",
      "type": "ioc",
      "value": "edge.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 1175 / UDP stream 35, frame 1176 / UDP stream 36, frame 1180 / UDP stream 36, frame 1182 / UDP stream 35, frame 2548 / UDP stream 55 +15 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fa000000002.resources.office.net",
      "type": "ioc",
      "value": "fa000000002.resources.office.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 22384 / UDP stream 116, frame 22387 / UDP stream 116, frame 22395 / TCP stream 121",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fa000000005.resources.office.net",
      "type": "ioc",
      "value": "fa000000005.resources.office.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 22385 / UDP stream 117, frame 22386 / UDP stream 117, frame 22392 / TCP stream 120",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fa000000116.resources.office.net",
      "type": "ioc",
      "value": "fa000000116.resources.office.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 23573 / UDP stream 118, frame 23574 / UDP stream 118, frame 23578 / TCP stream 122",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fa000000128.resources.office.net",
      "type": "ioc",
      "value": "fa000000128.resources.office.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 23587 / UDP stream 119, frame 23589 / UDP stream 119, frame 23594 / TCP stream 123",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fa000000163.resources.office.net",
      "type": "ioc",
      "value": "fa000000163.resources.office.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 23964 / UDP stream 120, frame 24030 / UDP stream 120, frame 24468 / TCP stream 124",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fd.api.iris.microsoft.com",
      "type": "ioc",
      "value": "fd.api.iris.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 21201 / UDP stream 83, frame 21202 / UDP stream 83, frame 21206 / TCP stream 96",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe3cr.delivery.mp.microsoft.com",
      "type": "ioc",
      "value": "fe3cr.delivery.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 21474 / UDP stream 107, frame 21475 / UDP stream 107, frame 21479 / TCP stream 103",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fonts.googleapis.com",
      "type": "ioc",
      "value": "fonts.googleapis.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 1718 / UDP stream 43, frame 1719 / UDP stream 44, frame 1754 / UDP stream 44, frame 1755 / UDP stream 43, frame 3767 / UDP stream 65 +5 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fonts.gstatic.com",
      "type": "ioc",
      "value": "fonts.gstatic.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 1751 / UDP stream 45, frame 1752 / UDP stream 46, frame 1753 / UDP stream 46, frame 1757 / UDP stream 45, frame 3850 / UDP stream 69 +7 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:geo.netsupportsoftware.com",
      "type": "ioc",
      "value": "geo.netsupportsoftware.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, http-host; frame 20331 / UDP stream 79, frame 20332 / UDP stream 79, frame 20336 / TCP stream 78",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:img-s-msn-com.akamaized.net",
      "type": "ioc",
      "value": "img-s-msn-com.akamaized.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 20690 / UDP stream 92, frame 20691 / UDP stream 93, frame 20692 / UDP stream 93, frame 20693 / UDP stream 92, frame 20706 / TCP stream 89",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:inputsuggestions.msdxcdn.microsoft.com",
      "type": "ioc",
      "value": "inputsuggestions.msdxcdn.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 1052 / UDP stream 30, frame 1053 / UDP stream 30, frame 1054 / UDP stream 30, frame 1058 / TCP stream 36, frame 1062 / TCP stream 36",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:js.createsend1.com",
      "type": "ioc",
      "value": "js.createsend1.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 3368 / UDP stream 61, frame 3369 / UDP stream 62, frame 3599 / UDP stream 61, frame 3601 / UDP stream 62, frame 3613 / TCP stream 57",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:licensing.mp.microsoft.com",
      "type": "ioc",
      "value": "licensing.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 59 / UDP stream 10, frame 60 / UDP stream 10, frame 68 / TCP stream 3, frame 109 / TCP stream 4",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:login.live.com",
      "type": "ioc",
      "value": "login.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 947 / UDP stream 29, frame 949 / UDP stream 29, frame 962 / TCP stream 34",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:login.microsoftonline.com",
      "type": "ioc",
      "value": "login.microsoftonline.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "tls-sni; frame 588 / TCP stream 27, frame 623 / TCP stream 27",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:maps.googleapis.com",
      "type": "ioc",
      "value": "maps.googleapis.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 2095 / UDP stream 51, frame 2096 / UDP stream 52, frame 2109 / UDP stream 51, frame 2114 / UDP stream 52, frame 2153 / TCP stream 52 +1 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:maps.gstatic.com",
      "type": "ioc",
      "value": "maps.gstatic.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 2093 / UDP stream 49, frame 2094 / UDP stream 50, frame 2108 / UDP stream 49, frame 2110 / UDP stream 50, frame 2149 / TCP stream 51",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mobile.events.data.microsoft.com",
      "type": "ioc",
      "value": "mobile.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 21827 / UDP stream 113, frame 21828 / UDP stream 113, frame 25976 / UDP stream 121, frame 25977 / UDP stream 121, frame 21832 / TCP stream 112 +5 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:modandcrackedapk.com",
      "type": "ioc",
      "value": "modandcrackedapk.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 1332 / UDP stream 39, frame 1333 / UDP stream 40, frame 1374 / UDP stream 39, frame 1377 / UDP stream 40, frame 2512 / UDP stream 53 +13 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mrodevicemgr.officeapps.live.com",
      "type": "ioc",
      "value": "mrodevicemgr.officeapps.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 22276 / UDP stream 115, frame 22277 / UDP stream 115, frame 22314 / TCP stream 119",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:nav.smartscreen.microsoft.com",
      "type": "ioc",
      "value": "nav.smartscreen.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 904 / UDP stream 26, frame 905 / UDP stream 26, frame 909 / TCP stream 31",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:nemotodes-dc.nemotoads.health",
      "type": "ioc",
      "value": "nemotodes-dc.nemotoads.health",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query; frame 26594 / UDP stream 131, frame 26595 / UDP stream 131",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:odc.officeapps.live.com",
      "type": "ioc",
      "value": "odc.officeapps.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 681 / UDP stream 24, frame 691 / UDP stream 24, frame 715 / TCP stream 29",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:officeclient.microsoft.com",
      "type": "ioc",
      "value": "officeclient.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 445 / UDP stream 21, frame 455 / UDP stream 21, frame 530 / TCP stream 22",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:prod.mrodevicemgr.live.com.akadns.net",
      "type": "ioc",
      "value": "prod.mrodevicemgr.live.com.akadns.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-cname; frame 22277 / UDP stream 115",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:r10.o.lencr.org",
      "type": "ioc",
      "value": "r10.o.lencr.org",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, http-host; frame 12779 / UDP stream 78, frame 12780 / UDP stream 78, frame 12788 / TCP stream 76",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:srtb.msn.com",
      "type": "ioc",
      "value": "srtb.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 20803 / UDP stream 101, frame 20804 / UDP stream 102, frame 20805 / UDP stream 102, frame 20806 / UDP stream 101, frame 20822 / TCP stream 91 +1 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:storecatalogrevocation.storequality.microsoft.com",
      "type": "ioc",
      "value": "storecatalogrevocation.storequality.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 21422 / UDP stream 106, frame 21423 / UDP stream 106, frame 21427 / TCP stream 102",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:th.bing.com",
      "type": "ioc",
      "value": "th.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 20686 / UDP stream 88, frame 20687 / UDP stream 89, frame 20696 / UDP stream 89, frame 20700 / UDP stream 88, frame 20702",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:v10.events.data.microsoft.com",
      "type": "ioc",
      "value": "v10.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 20352 / UDP stream 80, frame 20353 / UDP stream 80, frame 21376 / UDP stream 104, frame 21377 / UDP stream 104, frame 21610 / UDP stream 108 +12 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:windows.msn.com",
      "type": "ioc",
      "value": "windows.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 439 / UDP stream 16, frame 440 / UDP stream 16, frame 20615 / UDP stream 84, frame 20616 / UDP stream 85, frame 20617 / UDP stream 84 +7 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wns.notify.trafficmanager.net",
      "type": "ioc",
      "value": "wns.notify.trafficmanager.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-cname; frame 148 / UDP stream 15, frame 26870 / UDP stream 131",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wpad.mshome.net",
      "type": "ioc",
      "value": "wpad.mshome.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query; frame 21 / UDP stream 4, frame 22 / UDP stream 3, frame 23 / UDP stream 4, frame 25 / UDP stream 3, frame 187 / UDP stream 17 +15 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wpad.nemotoads.health",
      "type": "ioc",
      "value": "wpad.nemotoads.health",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query; frame 15 / UDP stream 3, frame 16 / UDP stream 4, frame 19 / UDP stream 4, frame 20 / UDP stream 3, frame 183 / UDP stream 16 +15 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.bing.com",
      "type": "ioc",
      "value": "www.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 446 / UDP stream 22, frame 447 / UDP stream 22, frame 11968 / UDP stream 74, frame 11969 / UDP stream 75, frame 11970 / UDP stream 75 +8 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.google.com",
      "type": "ioc",
      "value": "www.google.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 1759 / UDP stream 47, frame 1760 / UDP stream 48, frame 1761 / UDP stream 48, frame 1773 / UDP stream 47, frame 1823 / TCP stream 49 +1 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.gstatic.com",
      "type": "ioc",
      "value": "www.gstatic.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 3781 / UDP stream 67, frame 3782 / UDP stream 68, frame 3783 / UDP stream 68, frame 3790 / UDP stream 67, frame 3810 / TCP stream 61",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.msftconnecttest.com",
      "type": "ioc",
      "value": "www.msftconnecttest.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, http-host; frame 1 / UDP stream 0, frame 2 / UDP stream 0, frame 6 / TCP stream 0",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.msn.com",
      "type": "ioc",
      "value": "www.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-query, tls-sni; frame 612 / UDP stream 23, frame 619 / UDP stream 23, frame 20641 / UDP stream 86, frame 20642 / UDP stream 87, frame 20643 / UDP stream 86 +5 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.11.26.183",
      "type": "ioc",
      "value": "10.11.26.183",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.11.26.255",
      "type": "ioc",
      "value": "10.11.26.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.11.26.3",
      "type": "ioc",
      "value": "10.11.26.3",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 17 / UDP stream 2, frame 18 / UDP stream 1, frame 20414 / UDP stream 81, frame 26595 / UDP stream 131",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.104",
      "type": "ioc",
      "value": "104.117.244.104",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 447 / UDP stream 22",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.105",
      "type": "ioc",
      "value": "104.117.244.105",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 11973 / UDP stream 74, frame 20697 / UDP stream 90, frame 20700 / UDP stream 88",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.106",
      "type": "ioc",
      "value": "104.117.244.106",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.107",
      "type": "ioc",
      "value": "104.117.244.107",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.112",
      "type": "ioc",
      "value": "104.117.244.112",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 447 / UDP stream 22",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.114",
      "type": "ioc",
      "value": "104.117.244.114",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 447 / UDP stream 22, frame 11973 / UDP stream 74",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.72",
      "type": "ioc",
      "value": "104.117.244.72",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 447 / UDP stream 22, frame 20697 / UDP stream 90, frame 20700 / UDP stream 88",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.74",
      "type": "ioc",
      "value": "104.117.244.74",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.81",
      "type": "ioc",
      "value": "104.117.244.81",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 447 / UDP stream 22, frame 11973 / UDP stream 74",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.82",
      "type": "ioc",
      "value": "104.117.244.82",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 447 / UDP stream 22, frame 20697 / UDP stream 90, frame 20700 / UDP stream 88",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.88",
      "type": "ioc",
      "value": "104.117.244.88",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.89",
      "type": "ioc",
      "value": "104.117.244.89",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 447 / UDP stream 22, frame 11973 / UDP stream 74",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.91",
      "type": "ioc",
      "value": "104.117.244.91",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 447 / UDP stream 22",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.96",
      "type": "ioc",
      "value": "104.117.244.96",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 11973 / UDP stream 74",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.97",
      "type": "ioc",
      "value": "104.117.244.97",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.244.99",
      "type": "ioc",
      "value": "104.117.244.99",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 20697 / UDP stream 90, frame 20700 / UDP stream 88",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.247.139",
      "type": "ioc",
      "value": "104.117.247.139",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 20693 / UDP stream 92",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.247.144",
      "type": "ioc",
      "value": "104.117.247.144",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 2 / UDP stream 0",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.247.162",
      "type": "ioc",
      "value": "104.117.247.162",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 20693 / UDP stream 92",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.247.184",
      "type": "ioc",
      "value": "104.117.247.184",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 2 / UDP stream 0",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.247.186",
      "type": "ioc",
      "value": "104.117.247.186",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 20693 / UDP stream 92",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.247.67",
      "type": "ioc",
      "value": "104.117.247.67",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 12780 / UDP stream 78",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.117.247.99",
      "type": "ioc",
      "value": "104.117.247.99",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 12780 / UDP stream 78",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.26.0.231",
      "type": "ioc",
      "value": "104.26.0.231",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 20332 / UDP stream 79",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.26.1.231",
      "type": "ioc",
      "value": "104.26.1.231",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 20332 / UDP stream 79",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.21.239",
      "type": "ioc",
      "value": "13.107.21.239",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 1182 / UDP stream 35, frame 2564 / UDP stream 55, frame 3763 / UDP stream 63, frame 11993 / UDP stream 76",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.246.57",
      "type": "ioc",
      "value": "13.107.246.57",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 1054 / UDP stream 30",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.5.93",
      "type": "ioc",
      "value": "13.107.5.93",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 945 / UDP stream 28",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.56.30.207",
      "type": "ioc",
      "value": "13.56.30.207",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 1337 / UDP stream 41, frame 2685 / UDP stream 57",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:131.107.255.255",
      "type": "ioc",
      "value": "131.107.255.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 21375 / UDP stream 17, frame 25850 / UDP stream 110, frame 26021 / UDP stream 122, frame 26209 / UDP stream 124, frame 26356 / UDP stream 126 +3 more",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:142.250.113.120",
      "type": "ioc",
      "value": "142.250.113.120",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 2108 / UDP stream 49",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:142.250.113.94",
      "type": "ioc",
      "value": "142.250.113.94",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 2108 / UDP stream 49, frame 3790 / UDP stream 67",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:142.250.113.95",
      "type": "ioc",
      "value": "142.250.113.95",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 2109 / UDP stream 51",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:142.250.114.95",
      "type": "ioc",
      "value": "142.250.114.95",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 2109 / UDP stream 51",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:142.250.115.95",
      "type": "ioc",
      "value": "142.250.115.95",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 2109 / UDP stream 51",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:142.250.138.94",
      "type": "ioc",
      "value": "142.250.138.94",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer, network-endpoint; frame 1757 / UDP stream 45, frame 3852 / UDP stream 69",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:142.251.116.95",
      "type": "ioc",
      "value": "142.251.116.95",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "description": "dns-answer; frame 2109 / UDP stream 51",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "finding-826deb5286207c26818905b0",
      "type": "pcap-finding",
      "label": "Cleartext HTTP observed on TCP/443",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "uri": "http://194.180.191.64/fakeurl.htm",
        "host": "194.180.191.64",
        "source": "10.11.26.183",
        "destination": "194.180.191.64",
        "request_count": 58
      },
      "rule_id": "http-on-tls-port",
      "severity": "medium",
      "confidence": 0.98,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "The decoded application protocol is HTTP despite use of the conventional TLS port.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 77,
          "frame_number": 20340,
          "display_filter": "frame.number == 20340",
          "timestamp_epoch": "1732596645.849438000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20342,
          "display_filter": "frame.number == 20342",
          "timestamp_epoch": "1732596646.046139000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20348,
          "display_filter": "frame.number == 20348",
          "timestamp_epoch": "1732596646.348055000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20350,
          "display_filter": "frame.number == 20350",
          "timestamp_epoch": "1732596646.749227000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20572,
          "display_filter": "frame.number == 20572",
          "timestamp_epoch": "1732596706.921682000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21145,
          "display_filter": "frame.number == 21145",
          "timestamp_epoch": "1732596767.103354000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21153,
          "display_filter": "frame.number == 21153",
          "timestamp_epoch": "1732596827.260093000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21246,
          "display_filter": "frame.number == 21246",
          "timestamp_epoch": "1732596887.427092000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21295,
          "display_filter": "frame.number == 21295",
          "timestamp_epoch": "1732596947.485672000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21337,
          "display_filter": "frame.number == 21337",
          "timestamp_epoch": "1732597007.546358000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21352,
          "display_filter": "frame.number == 21352",
          "timestamp_epoch": "1732597067.608604000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21364,
          "display_filter": "frame.number == 21364",
          "timestamp_epoch": "1732597127.763032000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21415,
          "display_filter": "frame.number == 21415",
          "timestamp_epoch": "1732597187.818149000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21608,
          "display_filter": "frame.number == 21608",
          "timestamp_epoch": "1732597248.022865000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21708,
          "display_filter": "frame.number == 21708",
          "timestamp_epoch": "1732597308.318189000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21782,
          "display_filter": "frame.number == 21782",
          "timestamp_epoch": "1732597368.487475000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21792,
          "display_filter": "frame.number == 21792",
          "timestamp_epoch": "1732597428.558212000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21823,
          "display_filter": "frame.number == 21823",
          "timestamp_epoch": "1732597488.715402000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25880,
          "display_filter": "frame.number == 25880",
          "timestamp_epoch": "1732597548.896946000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25891,
          "display_filter": "frame.number == 25891",
          "timestamp_epoch": "1732597608.946138000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25937,
          "display_filter": "frame.number == 25937",
          "timestamp_epoch": "1732597669.001919000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25968,
          "display_filter": "frame.number == 25968",
          "timestamp_epoch": "1732597729.062950000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25985,
          "display_filter": "frame.number == 25985",
          "timestamp_epoch": "1732597789.216290000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26022,
          "display_filter": "frame.number == 26022",
          "timestamp_epoch": "1732597849.369834000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26051,
          "display_filter": "frame.number == 26051",
          "timestamp_epoch": "1732597909.523158000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26055,
          "display_filter": "frame.number == 26055",
          "timestamp_epoch": "1732597969.680246000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26066,
          "display_filter": "frame.number == 26066",
          "timestamp_epoch": "1732598029.737747000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26074,
          "display_filter": "frame.number == 26074",
          "timestamp_epoch": "1732598089.880222000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26087,
          "display_filter": "frame.number == 26087",
          "timestamp_epoch": "1732598149.936096000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26097,
          "display_filter": "frame.number == 26097",
          "timestamp_epoch": "1732598210.090084000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26107,
          "display_filter": "frame.number == 26107",
          "timestamp_epoch": "1732598270.148715000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26119,
          "display_filter": "frame.number == 26119",
          "timestamp_epoch": "1732598330.207754000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26133,
          "display_filter": "frame.number == 26133",
          "timestamp_epoch": "1732598390.367131000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26215,
          "display_filter": "frame.number == 26215",
          "timestamp_epoch": "1732598450.424378000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26297,
          "display_filter": "frame.number == 26297",
          "timestamp_epoch": "1732598510.485705000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26301,
          "display_filter": "frame.number == 26301",
          "timestamp_epoch": "1732598570.640951000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26317,
          "display_filter": "frame.number == 26317",
          "timestamp_epoch": "1732598630.794559000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26325,
          "display_filter": "frame.number == 26325",
          "timestamp_epoch": "1732598691.056411000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26339,
          "display_filter": "frame.number == 26339",
          "timestamp_epoch": "1732598751.112829000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26357,
          "display_filter": "frame.number == 26357",
          "timestamp_epoch": "1732598811.175685000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26371,
          "display_filter": "frame.number == 26371",
          "timestamp_epoch": "1732598871.330432000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26381,
          "display_filter": "frame.number == 26381",
          "timestamp_epoch": "1732598931.593448000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26395,
          "display_filter": "frame.number == 26395",
          "timestamp_epoch": "1732598991.748754000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26407,
          "display_filter": "frame.number == 26407",
          "timestamp_epoch": "1732599052.010090000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26425,
          "display_filter": "frame.number == 26425",
          "timestamp_epoch": "1732599112.161738000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26431,
          "display_filter": "frame.number == 26431",
          "timestamp_epoch": "1732599172.411164000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26441,
          "display_filter": "frame.number == 26441",
          "timestamp_epoch": "1732599232.561197000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26449,
          "display_filter": "frame.number == 26449",
          "timestamp_epoch": "1732599292.717415000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26508,
          "display_filter": "frame.number == 26508",
          "timestamp_epoch": "1732599352.967228000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26533,
          "display_filter": "frame.number == 26533",
          "timestamp_epoch": "1732599413.228563000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26554,
          "display_filter": "frame.number == 26554",
          "timestamp_epoch": "1732599473.382552000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26570,
          "display_filter": "frame.number == 26570",
          "timestamp_epoch": "1732599533.536694000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26809,
          "display_filter": "frame.number == 26809",
          "timestamp_epoch": "1732599628.801338000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26811,
          "display_filter": "frame.number == 26811",
          "timestamp_epoch": "1732599629.009850000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26814,
          "display_filter": "frame.number == 26814",
          "timestamp_epoch": "1732599629.317405000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26842,
          "display_filter": "frame.number == 26842",
          "timestamp_epoch": "1732599689.372894000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26901,
          "display_filter": "frame.number == 26901",
          "timestamp_epoch": "1732599749.528770000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26913,
          "display_filter": "frame.number == 26913",
          "timestamp_epoch": "1732599809.682016000"
        }
      ]
    },
    {
      "id": "finding-89d44c49a788d0f0f0614088",
      "type": "pcap-finding",
      "label": "Periodic HTTP callback pattern",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "uri": "http://194.180.191.64/fakeurl.htm",
        "host": "194.180.191.64",
        "port": 443,
        "method": "POST",
        "source": "10.11.26.183",
        "destination": "194.180.191.64",
        "request_count": 58,
        "median_interval_seconds": 60.154,
        "median_absolute_deviation": 0.091
      },
      "rule_id": "periodic-http-callbacks",
      "severity": "high",
      "confidence": 0.88,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 77,
          "frame_number": 20340,
          "display_filter": "frame.number == 20340",
          "timestamp_epoch": "1732596645.849438000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20342,
          "display_filter": "frame.number == 20342",
          "timestamp_epoch": "1732596646.046139000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20348,
          "display_filter": "frame.number == 20348",
          "timestamp_epoch": "1732596646.348055000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20350,
          "display_filter": "frame.number == 20350",
          "timestamp_epoch": "1732596646.749227000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20572,
          "display_filter": "frame.number == 20572",
          "timestamp_epoch": "1732596706.921682000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21145,
          "display_filter": "frame.number == 21145",
          "timestamp_epoch": "1732596767.103354000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21153,
          "display_filter": "frame.number == 21153",
          "timestamp_epoch": "1732596827.260093000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21246,
          "display_filter": "frame.number == 21246",
          "timestamp_epoch": "1732596887.427092000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21295,
          "display_filter": "frame.number == 21295",
          "timestamp_epoch": "1732596947.485672000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21337,
          "display_filter": "frame.number == 21337",
          "timestamp_epoch": "1732597007.546358000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21352,
          "display_filter": "frame.number == 21352",
          "timestamp_epoch": "1732597067.608604000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21364,
          "display_filter": "frame.number == 21364",
          "timestamp_epoch": "1732597127.763032000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21415,
          "display_filter": "frame.number == 21415",
          "timestamp_epoch": "1732597187.818149000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21608,
          "display_filter": "frame.number == 21608",
          "timestamp_epoch": "1732597248.022865000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21708,
          "display_filter": "frame.number == 21708",
          "timestamp_epoch": "1732597308.318189000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21782,
          "display_filter": "frame.number == 21782",
          "timestamp_epoch": "1732597368.487475000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21792,
          "display_filter": "frame.number == 21792",
          "timestamp_epoch": "1732597428.558212000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21823,
          "display_filter": "frame.number == 21823",
          "timestamp_epoch": "1732597488.715402000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25880,
          "display_filter": "frame.number == 25880",
          "timestamp_epoch": "1732597548.896946000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25891,
          "display_filter": "frame.number == 25891",
          "timestamp_epoch": "1732597608.946138000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25937,
          "display_filter": "frame.number == 25937",
          "timestamp_epoch": "1732597669.001919000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25968,
          "display_filter": "frame.number == 25968",
          "timestamp_epoch": "1732597729.062950000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25985,
          "display_filter": "frame.number == 25985",
          "timestamp_epoch": "1732597789.216290000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26022,
          "display_filter": "frame.number == 26022",
          "timestamp_epoch": "1732597849.369834000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26051,
          "display_filter": "frame.number == 26051",
          "timestamp_epoch": "1732597909.523158000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26055,
          "display_filter": "frame.number == 26055",
          "timestamp_epoch": "1732597969.680246000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26066,
          "display_filter": "frame.number == 26066",
          "timestamp_epoch": "1732598029.737747000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26074,
          "display_filter": "frame.number == 26074",
          "timestamp_epoch": "1732598089.880222000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26087,
          "display_filter": "frame.number == 26087",
          "timestamp_epoch": "1732598149.936096000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26097,
          "display_filter": "frame.number == 26097",
          "timestamp_epoch": "1732598210.090084000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26107,
          "display_filter": "frame.number == 26107",
          "timestamp_epoch": "1732598270.148715000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26119,
          "display_filter": "frame.number == 26119",
          "timestamp_epoch": "1732598330.207754000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26133,
          "display_filter": "frame.number == 26133",
          "timestamp_epoch": "1732598390.367131000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26215,
          "display_filter": "frame.number == 26215",
          "timestamp_epoch": "1732598450.424378000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26297,
          "display_filter": "frame.number == 26297",
          "timestamp_epoch": "1732598510.485705000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26301,
          "display_filter": "frame.number == 26301",
          "timestamp_epoch": "1732598570.640951000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26317,
          "display_filter": "frame.number == 26317",
          "timestamp_epoch": "1732598630.794559000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26325,
          "display_filter": "frame.number == 26325",
          "timestamp_epoch": "1732598691.056411000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26339,
          "display_filter": "frame.number == 26339",
          "timestamp_epoch": "1732598751.112829000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26357,
          "display_filter": "frame.number == 26357",
          "timestamp_epoch": "1732598811.175685000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26371,
          "display_filter": "frame.number == 26371",
          "timestamp_epoch": "1732598871.330432000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26381,
          "display_filter": "frame.number == 26381",
          "timestamp_epoch": "1732598931.593448000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26395,
          "display_filter": "frame.number == 26395",
          "timestamp_epoch": "1732598991.748754000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26407,
          "display_filter": "frame.number == 26407",
          "timestamp_epoch": "1732599052.010090000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26425,
          "display_filter": "frame.number == 26425",
          "timestamp_epoch": "1732599112.161738000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26431,
          "display_filter": "frame.number == 26431",
          "timestamp_epoch": "1732599172.411164000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26441,
          "display_filter": "frame.number == 26441",
          "timestamp_epoch": "1732599232.561197000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26449,
          "display_filter": "frame.number == 26449",
          "timestamp_epoch": "1732599292.717415000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26508,
          "display_filter": "frame.number == 26508",
          "timestamp_epoch": "1732599352.967228000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26533,
          "display_filter": "frame.number == 26533",
          "timestamp_epoch": "1732599413.228563000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26554,
          "display_filter": "frame.number == 26554",
          "timestamp_epoch": "1732599473.382552000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26570,
          "display_filter": "frame.number == 26570",
          "timestamp_epoch": "1732599533.536694000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26809,
          "display_filter": "frame.number == 26809",
          "timestamp_epoch": "1732599628.801338000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26811,
          "display_filter": "frame.number == 26811",
          "timestamp_epoch": "1732599629.009850000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26814,
          "display_filter": "frame.number == 26814",
          "timestamp_epoch": "1732599629.317405000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26842,
          "display_filter": "frame.number == 26842",
          "timestamp_epoch": "1732599689.372894000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26901,
          "display_filter": "frame.number == 26901",
          "timestamp_epoch": "1732599749.528770000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26913,
          "display_filter": "frame.number == 26913",
          "timestamp_epoch": "1732599809.682016000"
        }
      ]
    },
    {
      "id": "finding-f2eac4fa26ed6ea5ec889582",
      "type": "pcap-finding",
      "label": "Remote-access software network signature",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.11.26.183",
        "user_agent": "NetSupport Manager/1.3",
        "destination": "194.180.191.64",
        "request_count": 58
      },
      "rule_id": "remote-access-user-agent",
      "severity": "high",
      "confidence": 0.95,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "An HTTP User-Agent explicitly identifies remote-access software. Validate authorization and endpoint ownership.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 77,
          "frame_number": 20340,
          "display_filter": "frame.number == 20340",
          "timestamp_epoch": "1732596645.849438000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20342,
          "display_filter": "frame.number == 20342",
          "timestamp_epoch": "1732596646.046139000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20348,
          "display_filter": "frame.number == 20348",
          "timestamp_epoch": "1732596646.348055000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20350,
          "display_filter": "frame.number == 20350",
          "timestamp_epoch": "1732596646.749227000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20572,
          "display_filter": "frame.number == 20572",
          "timestamp_epoch": "1732596706.921682000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21145,
          "display_filter": "frame.number == 21145",
          "timestamp_epoch": "1732596767.103354000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21153,
          "display_filter": "frame.number == 21153",
          "timestamp_epoch": "1732596827.260093000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21246,
          "display_filter": "frame.number == 21246",
          "timestamp_epoch": "1732596887.427092000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21295,
          "display_filter": "frame.number == 21295",
          "timestamp_epoch": "1732596947.485672000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21337,
          "display_filter": "frame.number == 21337",
          "timestamp_epoch": "1732597007.546358000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21352,
          "display_filter": "frame.number == 21352",
          "timestamp_epoch": "1732597067.608604000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21364,
          "display_filter": "frame.number == 21364",
          "timestamp_epoch": "1732597127.763032000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21415,
          "display_filter": "frame.number == 21415",
          "timestamp_epoch": "1732597187.818149000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21608,
          "display_filter": "frame.number == 21608",
          "timestamp_epoch": "1732597248.022865000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21708,
          "display_filter": "frame.number == 21708",
          "timestamp_epoch": "1732597308.318189000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21782,
          "display_filter": "frame.number == 21782",
          "timestamp_epoch": "1732597368.487475000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21792,
          "display_filter": "frame.number == 21792",
          "timestamp_epoch": "1732597428.558212000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21823,
          "display_filter": "frame.number == 21823",
          "timestamp_epoch": "1732597488.715402000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25880,
          "display_filter": "frame.number == 25880",
          "timestamp_epoch": "1732597548.896946000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25891,
          "display_filter": "frame.number == 25891",
          "timestamp_epoch": "1732597608.946138000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25937,
          "display_filter": "frame.number == 25937",
          "timestamp_epoch": "1732597669.001919000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25968,
          "display_filter": "frame.number == 25968",
          "timestamp_epoch": "1732597729.062950000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25985,
          "display_filter": "frame.number == 25985",
          "timestamp_epoch": "1732597789.216290000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26022,
          "display_filter": "frame.number == 26022",
          "timestamp_epoch": "1732597849.369834000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26051,
          "display_filter": "frame.number == 26051",
          "timestamp_epoch": "1732597909.523158000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26055,
          "display_filter": "frame.number == 26055",
          "timestamp_epoch": "1732597969.680246000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26066,
          "display_filter": "frame.number == 26066",
          "timestamp_epoch": "1732598029.737747000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26074,
          "display_filter": "frame.number == 26074",
          "timestamp_epoch": "1732598089.880222000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26087,
          "display_filter": "frame.number == 26087",
          "timestamp_epoch": "1732598149.936096000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26097,
          "display_filter": "frame.number == 26097",
          "timestamp_epoch": "1732598210.090084000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26107,
          "display_filter": "frame.number == 26107",
          "timestamp_epoch": "1732598270.148715000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26119,
          "display_filter": "frame.number == 26119",
          "timestamp_epoch": "1732598330.207754000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26133,
          "display_filter": "frame.number == 26133",
          "timestamp_epoch": "1732598390.367131000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26215,
          "display_filter": "frame.number == 26215",
          "timestamp_epoch": "1732598450.424378000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26297,
          "display_filter": "frame.number == 26297",
          "timestamp_epoch": "1732598510.485705000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26301,
          "display_filter": "frame.number == 26301",
          "timestamp_epoch": "1732598570.640951000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26317,
          "display_filter": "frame.number == 26317",
          "timestamp_epoch": "1732598630.794559000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26325,
          "display_filter": "frame.number == 26325",
          "timestamp_epoch": "1732598691.056411000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26339,
          "display_filter": "frame.number == 26339",
          "timestamp_epoch": "1732598751.112829000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26357,
          "display_filter": "frame.number == 26357",
          "timestamp_epoch": "1732598811.175685000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26371,
          "display_filter": "frame.number == 26371",
          "timestamp_epoch": "1732598871.330432000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26381,
          "display_filter": "frame.number == 26381",
          "timestamp_epoch": "1732598931.593448000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26395,
          "display_filter": "frame.number == 26395",
          "timestamp_epoch": "1732598991.748754000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26407,
          "display_filter": "frame.number == 26407",
          "timestamp_epoch": "1732599052.010090000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26425,
          "display_filter": "frame.number == 26425",
          "timestamp_epoch": "1732599112.161738000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26431,
          "display_filter": "frame.number == 26431",
          "timestamp_epoch": "1732599172.411164000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26441,
          "display_filter": "frame.number == 26441",
          "timestamp_epoch": "1732599232.561197000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26449,
          "display_filter": "frame.number == 26449",
          "timestamp_epoch": "1732599292.717415000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26508,
          "display_filter": "frame.number == 26508",
          "timestamp_epoch": "1732599352.967228000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26533,
          "display_filter": "frame.number == 26533",
          "timestamp_epoch": "1732599413.228563000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26554,
          "display_filter": "frame.number == 26554",
          "timestamp_epoch": "1732599473.382552000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26570,
          "display_filter": "frame.number == 26570",
          "timestamp_epoch": "1732599533.536694000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26809,
          "display_filter": "frame.number == 26809",
          "timestamp_epoch": "1732599628.801338000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26811,
          "display_filter": "frame.number == 26811",
          "timestamp_epoch": "1732599629.009850000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26814,
          "display_filter": "frame.number == 26814",
          "timestamp_epoch": "1732599629.317405000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26842,
          "display_filter": "frame.number == 26842",
          "timestamp_epoch": "1732599689.372894000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26901,
          "display_filter": "frame.number == 26901",
          "timestamp_epoch": "1732599749.528770000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26913,
          "display_filter": "frame.number == 26913",
          "timestamp_epoch": "1732599809.682016000"
        }
      ]
    },
    {
      "id": "finding-a133356b6375dd54a56b447f",
      "type": "pcap-finding",
      "label": "Repeated outbound HTTP POST activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "uri": "http://194.180.191.64/fakeurl.htm",
        "host": "194.180.191.64",
        "port": 443,
        "source": "10.11.26.183",
        "destination": "194.180.191.64",
        "request_count": 58,
        "declared_body_bytes": 2624
      },
      "rule_id": "repeated-http-posts",
      "severity": "medium",
      "confidence": 0.72,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 77,
          "frame_number": 20340,
          "display_filter": "frame.number == 20340",
          "timestamp_epoch": "1732596645.849438000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20342,
          "display_filter": "frame.number == 20342",
          "timestamp_epoch": "1732596646.046139000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20348,
          "display_filter": "frame.number == 20348",
          "timestamp_epoch": "1732596646.348055000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20350,
          "display_filter": "frame.number == 20350",
          "timestamp_epoch": "1732596646.749227000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 20572,
          "display_filter": "frame.number == 20572",
          "timestamp_epoch": "1732596706.921682000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21145,
          "display_filter": "frame.number == 21145",
          "timestamp_epoch": "1732596767.103354000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21153,
          "display_filter": "frame.number == 21153",
          "timestamp_epoch": "1732596827.260093000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21246,
          "display_filter": "frame.number == 21246",
          "timestamp_epoch": "1732596887.427092000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21295,
          "display_filter": "frame.number == 21295",
          "timestamp_epoch": "1732596947.485672000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21337,
          "display_filter": "frame.number == 21337",
          "timestamp_epoch": "1732597007.546358000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21352,
          "display_filter": "frame.number == 21352",
          "timestamp_epoch": "1732597067.608604000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21364,
          "display_filter": "frame.number == 21364",
          "timestamp_epoch": "1732597127.763032000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21415,
          "display_filter": "frame.number == 21415",
          "timestamp_epoch": "1732597187.818149000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21608,
          "display_filter": "frame.number == 21608",
          "timestamp_epoch": "1732597248.022865000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21708,
          "display_filter": "frame.number == 21708",
          "timestamp_epoch": "1732597308.318189000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21782,
          "display_filter": "frame.number == 21782",
          "timestamp_epoch": "1732597368.487475000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21792,
          "display_filter": "frame.number == 21792",
          "timestamp_epoch": "1732597428.558212000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 21823,
          "display_filter": "frame.number == 21823",
          "timestamp_epoch": "1732597488.715402000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25880,
          "display_filter": "frame.number == 25880",
          "timestamp_epoch": "1732597548.896946000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25891,
          "display_filter": "frame.number == 25891",
          "timestamp_epoch": "1732597608.946138000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25937,
          "display_filter": "frame.number == 25937",
          "timestamp_epoch": "1732597669.001919000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25968,
          "display_filter": "frame.number == 25968",
          "timestamp_epoch": "1732597729.062950000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 25985,
          "display_filter": "frame.number == 25985",
          "timestamp_epoch": "1732597789.216290000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26022,
          "display_filter": "frame.number == 26022",
          "timestamp_epoch": "1732597849.369834000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26051,
          "display_filter": "frame.number == 26051",
          "timestamp_epoch": "1732597909.523158000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26055,
          "display_filter": "frame.number == 26055",
          "timestamp_epoch": "1732597969.680246000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26066,
          "display_filter": "frame.number == 26066",
          "timestamp_epoch": "1732598029.737747000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26074,
          "display_filter": "frame.number == 26074",
          "timestamp_epoch": "1732598089.880222000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26087,
          "display_filter": "frame.number == 26087",
          "timestamp_epoch": "1732598149.936096000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26097,
          "display_filter": "frame.number == 26097",
          "timestamp_epoch": "1732598210.090084000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26107,
          "display_filter": "frame.number == 26107",
          "timestamp_epoch": "1732598270.148715000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26119,
          "display_filter": "frame.number == 26119",
          "timestamp_epoch": "1732598330.207754000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26133,
          "display_filter": "frame.number == 26133",
          "timestamp_epoch": "1732598390.367131000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26215,
          "display_filter": "frame.number == 26215",
          "timestamp_epoch": "1732598450.424378000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26297,
          "display_filter": "frame.number == 26297",
          "timestamp_epoch": "1732598510.485705000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26301,
          "display_filter": "frame.number == 26301",
          "timestamp_epoch": "1732598570.640951000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26317,
          "display_filter": "frame.number == 26317",
          "timestamp_epoch": "1732598630.794559000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26325,
          "display_filter": "frame.number == 26325",
          "timestamp_epoch": "1732598691.056411000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26339,
          "display_filter": "frame.number == 26339",
          "timestamp_epoch": "1732598751.112829000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26357,
          "display_filter": "frame.number == 26357",
          "timestamp_epoch": "1732598811.175685000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26371,
          "display_filter": "frame.number == 26371",
          "timestamp_epoch": "1732598871.330432000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26381,
          "display_filter": "frame.number == 26381",
          "timestamp_epoch": "1732598931.593448000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26395,
          "display_filter": "frame.number == 26395",
          "timestamp_epoch": "1732598991.748754000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26407,
          "display_filter": "frame.number == 26407",
          "timestamp_epoch": "1732599052.010090000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26425,
          "display_filter": "frame.number == 26425",
          "timestamp_epoch": "1732599112.161738000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26431,
          "display_filter": "frame.number == 26431",
          "timestamp_epoch": "1732599172.411164000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26441,
          "display_filter": "frame.number == 26441",
          "timestamp_epoch": "1732599232.561197000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26449,
          "display_filter": "frame.number == 26449",
          "timestamp_epoch": "1732599292.717415000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26508,
          "display_filter": "frame.number == 26508",
          "timestamp_epoch": "1732599352.967228000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26533,
          "display_filter": "frame.number == 26533",
          "timestamp_epoch": "1732599413.228563000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26554,
          "display_filter": "frame.number == 26554",
          "timestamp_epoch": "1732599473.382552000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 26570,
          "display_filter": "frame.number == 26570",
          "timestamp_epoch": "1732599533.536694000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26809,
          "display_filter": "frame.number == 26809",
          "timestamp_epoch": "1732599628.801338000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26811,
          "display_filter": "frame.number == 26811",
          "timestamp_epoch": "1732599629.009850000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26814,
          "display_filter": "frame.number == 26814",
          "timestamp_epoch": "1732599629.317405000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26842,
          "display_filter": "frame.number == 26842",
          "timestamp_epoch": "1732599689.372894000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26901,
          "display_filter": "frame.number == 26901",
          "timestamp_epoch": "1732599749.528770000"
        },
        {
          "tcp_stream": 140,
          "frame_number": 26913,
          "display_filter": "frame.number == 26913",
          "timestamp_epoch": "1732599809.682016000"
        }
      ]
    },
    {
      "id": "finding-977311ea28e6696a0adf6d4c",
      "type": "pcap-finding",
      "label": "Repeated unsuccessful DNS resolution",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "domain": "wpad.mshome.net",
        "source": "10.11.26.183",
        "response_count": 24
      },
      "rule_id": "repeated-nxdomain",
      "severity": "low",
      "confidence": 0.5,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "udp_stream": 4,
          "frame_number": 23,
          "display_filter": "frame.number == 23",
          "timestamp_epoch": "1732596578.919448000"
        },
        {
          "udp_stream": 3,
          "frame_number": 25,
          "display_filter": "frame.number == 25",
          "timestamp_epoch": "1732596578.919535000"
        },
        {
          "udp_stream": 17,
          "frame_number": 189,
          "display_filter": "frame.number == 189",
          "timestamp_epoch": "1732596584.253026000"
        },
        {
          "udp_stream": 16,
          "frame_number": 190,
          "display_filter": "frame.number == 190",
          "timestamp_epoch": "1732596584.253067000"
        },
        {
          "udp_stream": 26,
          "frame_number": 902,
          "display_filter": "frame.number == 902",
          "timestamp_epoch": "1732596599.779310000"
        },
        {
          "udp_stream": 17,
          "frame_number": 903,
          "display_filter": "frame.number == 903",
          "timestamp_epoch": "1732596599.779345000"
        },
        {
          "udp_stream": 32,
          "frame_number": 1117,
          "display_filter": "frame.number == 1117",
          "timestamp_epoch": "1732596610.942457000"
        },
        {
          "udp_stream": 32,
          "frame_number": 8691,
          "display_filter": "frame.number == 8691",
          "timestamp_epoch": "1732596618.945400000"
        },
        {
          "udp_stream": 17,
          "frame_number": 20494,
          "display_filter": "frame.number == 20494",
          "timestamp_epoch": "1732596659.836575000"
        },
        {
          "udp_stream": 81,
          "frame_number": 20495,
          "display_filter": "frame.number == 20495",
          "timestamp_epoch": "1732596659.836636000"
        },
        {
          "udp_stream": 83,
          "frame_number": 20614,
          "display_filter": "frame.number == 20614",
          "timestamp_epoch": "1732596717.645876000"
        },
        {
          "udp_stream": 83,
          "frame_number": 21092,
          "display_filter": "frame.number == 21092",
          "timestamp_epoch": "1732596725.657338000"
        },
        {
          "udp_stream": 109,
          "frame_number": 21668,
          "display_filter": "frame.number == 21668",
          "timestamp_epoch": "1732597259.884101000"
        },
        {
          "udp_stream": 110,
          "frame_number": 21669,
          "display_filter": "frame.number == 21669",
          "timestamp_epoch": "1732597259.884131000"
        },
        {
          "udp_stream": 112,
          "frame_number": 21748,
          "display_filter": "frame.number == 21748",
          "timestamp_epoch": "1732597317.772416000"
        },
        {
          "udp_stream": 112,
          "frame_number": 21756,
          "display_filter": "frame.number == 21756",
          "timestamp_epoch": "1732597325.779840000"
        },
        {
          "udp_stream": 123,
          "frame_number": 26036,
          "display_filter": "frame.number == 26036",
          "timestamp_epoch": "1732597859.914522000"
        },
        {
          "udp_stream": 124,
          "frame_number": 26037,
          "display_filter": "frame.number == 26037",
          "timestamp_epoch": "1732597859.914603000"
        },
        {
          "udp_stream": 125,
          "frame_number": 26225,
          "display_filter": "frame.number == 26225",
          "timestamp_epoch": "1732598459.951992000"
        },
        {
          "udp_stream": 126,
          "frame_number": 26226,
          "display_filter": "frame.number == 26226",
          "timestamp_epoch": "1732598459.952027000"
        },
        {
          "udp_stream": 127,
          "frame_number": 26417,
          "display_filter": "frame.number == 26417",
          "timestamp_epoch": "1732599059.998703000"
        },
        {
          "udp_stream": 128,
          "frame_number": 26418,
          "display_filter": "frame.number == 26418",
          "timestamp_epoch": "1732599059.998779000"
        },
        {
          "udp_stream": 133,
          "frame_number": 26832,
          "display_filter": "frame.number == 26832",
          "timestamp_epoch": "1732599660.031331000"
        },
        {
          "udp_stream": 131,
          "frame_number": 26833,
          "display_filter": "frame.number == 26833",
          "timestamp_epoch": "1732599660.031369000"
        }
      ]
    },
    {
      "id": "finding-3526e260798a47582bdaad59",
      "type": "pcap-finding",
      "label": "Repeated unsuccessful DNS resolution",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "domain": "wpad.nemotoads.health",
        "source": "10.11.26.183",
        "response_count": 24
      },
      "rule_id": "repeated-nxdomain",
      "severity": "low",
      "confidence": 0.5,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "udp_stream": 4,
          "frame_number": 19,
          "display_filter": "frame.number == 19",
          "timestamp_epoch": "1732596578.919159000"
        },
        {
          "udp_stream": 3,
          "frame_number": 20,
          "display_filter": "frame.number == 20",
          "timestamp_epoch": "1732596578.919159000"
        },
        {
          "udp_stream": 17,
          "frame_number": 185,
          "display_filter": "frame.number == 185",
          "timestamp_epoch": "1732596584.252589000"
        },
        {
          "udp_stream": 16,
          "frame_number": 186,
          "display_filter": "frame.number == 186",
          "timestamp_epoch": "1732596584.252645000"
        },
        {
          "udp_stream": 26,
          "frame_number": 898,
          "display_filter": "frame.number == 898",
          "timestamp_epoch": "1732596599.778838000"
        },
        {
          "udp_stream": 17,
          "frame_number": 899,
          "display_filter": "frame.number == 899",
          "timestamp_epoch": "1732596599.778882000"
        },
        {
          "udp_stream": 32,
          "frame_number": 1115,
          "display_filter": "frame.number == 1115",
          "timestamp_epoch": "1732596610.942148000"
        },
        {
          "udp_stream": 32,
          "frame_number": 8688,
          "display_filter": "frame.number == 8688",
          "timestamp_epoch": "1732596618.944965000"
        },
        {
          "udp_stream": 81,
          "frame_number": 20490,
          "display_filter": "frame.number == 20490",
          "timestamp_epoch": "1732596659.782088000"
        },
        {
          "udp_stream": 17,
          "frame_number": 20491,
          "display_filter": "frame.number == 20491",
          "timestamp_epoch": "1732596659.782134000"
        },
        {
          "udp_stream": 83,
          "frame_number": 20612,
          "display_filter": "frame.number == 20612",
          "timestamp_epoch": "1732596717.645557000"
        },
        {
          "udp_stream": 83,
          "frame_number": 21090,
          "display_filter": "frame.number == 21090",
          "timestamp_epoch": "1732596725.656822000"
        },
        {
          "udp_stream": 110,
          "frame_number": 21664,
          "display_filter": "frame.number == 21664",
          "timestamp_epoch": "1732597259.823544000"
        },
        {
          "udp_stream": 109,
          "frame_number": 21665,
          "display_filter": "frame.number == 21665",
          "timestamp_epoch": "1732597259.823606000"
        },
        {
          "udp_stream": 112,
          "frame_number": 21746,
          "display_filter": "frame.number == 21746",
          "timestamp_epoch": "1732597317.772120000"
        },
        {
          "udp_stream": 112,
          "frame_number": 21754,
          "display_filter": "frame.number == 21754",
          "timestamp_epoch": "1732597325.778936000"
        },
        {
          "udp_stream": 123,
          "frame_number": 26032,
          "display_filter": "frame.number == 26032",
          "timestamp_epoch": "1732597859.867198000"
        },
        {
          "udp_stream": 124,
          "frame_number": 26033,
          "display_filter": "frame.number == 26033",
          "timestamp_epoch": "1732597859.867272000"
        },
        {
          "udp_stream": 126,
          "frame_number": 26221,
          "display_filter": "frame.number == 26221",
          "timestamp_epoch": "1732598459.902062000"
        },
        {
          "udp_stream": 125,
          "frame_number": 26222,
          "display_filter": "frame.number == 26222",
          "timestamp_epoch": "1732598459.902091000"
        },
        {
          "udp_stream": 128,
          "frame_number": 26413,
          "display_filter": "frame.number == 26413",
          "timestamp_epoch": "1732599059.936808000"
        },
        {
          "udp_stream": 127,
          "frame_number": 26414,
          "display_filter": "frame.number == 26414",
          "timestamp_epoch": "1732599059.936885000"
        },
        {
          "udp_stream": 131,
          "frame_number": 26828,
          "display_filter": "frame.number == 26828",
          "timestamp_epoch": "1732599659.986175000"
        },
        {
          "udp_stream": 133,
          "frame_number": 26829,
          "display_filter": "frame.number == 26829",
          "timestamp_epoch": "1732599659.986270000"
        }
      ]
    },
    {
      "id": "finding-6ccecc4b31af99f2715e3a0a",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.11.26.183",
        "protocol": "drsuapi",
        "destination": "10.11.26.3",
        "event_count": 25,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 11,
          "frame_number": 304,
          "display_filter": "frame.number == 304",
          "timestamp_epoch": "1732596595.586808000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 309,
          "display_filter": "frame.number == 309",
          "timestamp_epoch": "1732596595.587339000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 312,
          "display_filter": "frame.number == 312",
          "timestamp_epoch": "1732596595.587890000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 315,
          "display_filter": "frame.number == 315",
          "timestamp_epoch": "1732596595.588486000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 486,
          "display_filter": "frame.number == 486",
          "timestamp_epoch": "1732596597.430818000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 488,
          "display_filter": "frame.number == 488",
          "timestamp_epoch": "1732596597.431540000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 490,
          "display_filter": "frame.number == 490",
          "timestamp_epoch": "1732596597.432409000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 500,
          "display_filter": "frame.number == 500",
          "timestamp_epoch": "1732596597.434219000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 502,
          "display_filter": "frame.number == 502",
          "timestamp_epoch": "1732596597.434750000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 504,
          "display_filter": "frame.number == 504",
          "timestamp_epoch": "1732596597.435524000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1120,
          "display_filter": "frame.number == 1120",
          "timestamp_epoch": "1732596611.004869000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1122,
          "display_filter": "frame.number == 1122",
          "timestamp_epoch": "1732596611.005414000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1124,
          "display_filter": "frame.number == 1124",
          "timestamp_epoch": "1732596611.006319000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1128,
          "display_filter": "frame.number == 1128",
          "timestamp_epoch": "1732596611.008033000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1130,
          "display_filter": "frame.number == 1130",
          "timestamp_epoch": "1732596611.008586000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1132,
          "display_filter": "frame.number == 1132",
          "timestamp_epoch": "1732596611.009379000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20433,
          "display_filter": "frame.number == 20433",
          "timestamp_epoch": "1732596656.533998000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20435,
          "display_filter": "frame.number == 20435",
          "timestamp_epoch": "1732596656.534849000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20437,
          "display_filter": "frame.number == 20437",
          "timestamp_epoch": "1732596656.535867000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20441,
          "display_filter": "frame.number == 20441",
          "timestamp_epoch": "1732596656.537556000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20443,
          "display_filter": "frame.number == 20443",
          "timestamp_epoch": "1732596656.538202000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20445,
          "display_filter": "frame.number == 20445",
          "timestamp_epoch": "1732596656.539148000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 26626,
          "display_filter": "frame.number == 26626",
          "timestamp_epoch": "1732599597.841790000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 26628,
          "display_filter": "frame.number == 26628",
          "timestamp_epoch": "1732599597.842980000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 26630,
          "display_filter": "frame.number == 26630",
          "timestamp_epoch": "1732599597.844431000"
        }
      ]
    },
    {
      "id": "finding-37ae52acec082e76514687be",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.11.26.183",
        "protocol": "ldap",
        "destination": "10.11.26.3",
        "event_count": 64,
        "operation_numbers": [
          "",
          "0",
          "2",
          "3"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 1,
          "frame_number": 36,
          "display_filter": "frame.number == 36",
          "timestamp_epoch": "1732596579.029388000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 43,
          "display_filter": "frame.number == 43",
          "timestamp_epoch": "1732596579.031921000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 46,
          "display_filter": "frame.number == 46",
          "timestamp_epoch": "1732596579.034568000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 359,
          "display_filter": "frame.number == 359",
          "timestamp_epoch": "1732596595.594374000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 371,
          "display_filter": "frame.number == 371",
          "timestamp_epoch": "1732596595.596273000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 382,
          "display_filter": "frame.number == 382",
          "timestamp_epoch": "1732596595.600858000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 388,
          "display_filter": "frame.number == 388",
          "timestamp_epoch": "1732596595.603729000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 391,
          "display_filter": "frame.number == 391",
          "timestamp_epoch": "1732596595.605015000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 393,
          "display_filter": "frame.number == 393",
          "timestamp_epoch": "1732596595.605405000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 395,
          "display_filter": "frame.number == 395",
          "timestamp_epoch": "1732596595.605921000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 397,
          "display_filter": "frame.number == 397",
          "timestamp_epoch": "1732596595.612414000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 401,
          "display_filter": "frame.number == 401",
          "timestamp_epoch": "1732596595.614914000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 510,
          "display_filter": "frame.number == 510",
          "timestamp_epoch": "1732596597.438168000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 515,
          "display_filter": "frame.number == 515",
          "timestamp_epoch": "1732596597.440552000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 518,
          "display_filter": "frame.number == 518",
          "timestamp_epoch": "1732596597.443147000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 522,
          "display_filter": "frame.number == 522",
          "timestamp_epoch": "1732596597.446466000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 524,
          "display_filter": "frame.number == 524",
          "timestamp_epoch": "1732596597.447634000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 535,
          "display_filter": "frame.number == 535",
          "timestamp_epoch": "1732596597.465797000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 538,
          "display_filter": "frame.number == 538",
          "timestamp_epoch": "1732596597.467107000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 543,
          "display_filter": "frame.number == 543",
          "timestamp_epoch": "1732596597.468024000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 545,
          "display_filter": "frame.number == 545",
          "timestamp_epoch": "1732596597.468754000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 548,
          "display_filter": "frame.number == 548",
          "timestamp_epoch": "1732596597.468892000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 1138,
          "display_filter": "frame.number == 1138",
          "timestamp_epoch": "1732596611.011629000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 1141,
          "display_filter": "frame.number == 1141",
          "timestamp_epoch": "1732596611.014485000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 1143,
          "display_filter": "frame.number == 1143",
          "timestamp_epoch": "1732596611.015315000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 1145,
          "display_filter": "frame.number == 1145",
          "timestamp_epoch": "1732596611.016071000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 1151,
          "display_filter": "frame.number == 1151",
          "timestamp_epoch": "1732596611.018656000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 1154,
          "display_filter": "frame.number == 1154",
          "timestamp_epoch": "1732596611.021073000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 1159,
          "display_filter": "frame.number == 1159",
          "timestamp_epoch": "1732596611.022315000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 1161,
          "display_filter": "frame.number == 1161",
          "timestamp_epoch": "1732596611.023177000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 1163,
          "display_filter": "frame.number == 1163",
          "timestamp_epoch": "1732596611.023322000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20450,
          "display_filter": "frame.number == 20450",
          "timestamp_epoch": "1732596656.541082000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20455,
          "display_filter": "frame.number == 20455",
          "timestamp_epoch": "1732596656.543311000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20458,
          "display_filter": "frame.number == 20458",
          "timestamp_epoch": "1732596656.545813000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20460,
          "display_filter": "frame.number == 20460",
          "timestamp_epoch": "1732596656.546756000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20462,
          "display_filter": "frame.number == 20462",
          "timestamp_epoch": "1732596656.547675000"
        },
        {
          "tcp_stream": 83,
          "frame_number": 20468,
          "display_filter": "frame.number == 20468",
          "timestamp_epoch": "1732596656.550432000"
        },
        {
          "tcp_stream": 83,
          "frame_number": 20471,
          "display_filter": "frame.number == 20471",
          "timestamp_epoch": "1732596656.552990000"
        },
        {
          "tcp_stream": 83,
          "frame_number": 20476,
          "display_filter": "frame.number == 20476",
          "timestamp_epoch": "1732596656.554350000"
        },
        {
          "tcp_stream": 83,
          "frame_number": 20478,
          "display_filter": "frame.number == 20478",
          "timestamp_epoch": "1732596656.555397000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20480,
          "display_filter": "frame.number == 20480",
          "timestamp_epoch": "1732596656.555572000"
        },
        {
          "tcp_stream": 93,
          "frame_number": 21162,
          "display_filter": "frame.number == 21162",
          "timestamp_epoch": "1732596827.738941000"
        },
        {
          "tcp_stream": 93,
          "frame_number": 21179,
          "display_filter": "frame.number == 21179",
          "timestamp_epoch": "1732596827.745508000"
        },
        {
          "tcp_stream": 93,
          "frame_number": 21182,
          "display_filter": "frame.number == 21182",
          "timestamp_epoch": "1732596827.749181000"
        },
        {
          "tcp_stream": 93,
          "frame_number": 21184,
          "display_filter": "frame.number == 21184",
          "timestamp_epoch": "1732596827.750218000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 21192,
          "display_filter": "frame.number == 21192",
          "timestamp_epoch": "1732596827.760127000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 21195,
          "display_filter": "frame.number == 21195",
          "timestamp_epoch": "1732596827.761428000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 21197,
          "display_filter": "frame.number == 21197",
          "timestamp_epoch": "1732596827.761912000"
        },
        {
          "tcp_stream": 97,
          "frame_number": 21257,
          "display_filter": "frame.number == 21257",
          "timestamp_epoch": "1732596897.033500000"
        },
        {
          "tcp_stream": 97,
          "frame_number": 21262,
          "display_filter": "frame.number == 21262",
          "timestamp_epoch": "1732596897.036140000"
        },
        {
          "tcp_stream": 97,
          "frame_number": 21265,
          "display_filter": "frame.number == 21265",
          "timestamp_epoch": "1732596897.039773000"
        },
        {
          "tcp_stream": 97,
          "frame_number": 21267,
          "display_filter": "frame.number == 21267",
          "timestamp_epoch": "1732596897.040938000"
        },
        {
          "tcp_stream": 98,
          "frame_number": 21275,
          "display_filter": "frame.number == 21275",
          "timestamp_epoch": "1732596897.048150000"
        },
        {
          "tcp_stream": 98,
          "frame_number": 21278,
          "display_filter": "frame.number == 21278",
          "timestamp_epoch": "1732596897.050523000"
        },
        {
          "tcp_stream": 98,
          "frame_number": 21280,
          "display_filter": "frame.number == 21280",
          "timestamp_epoch": "1732596897.051336000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 26599,
          "display_filter": "frame.number == 26599",
          "timestamp_epoch": "1732599597.741334000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 26604,
          "display_filter": "frame.number == 26604",
          "timestamp_epoch": "1732599597.744037000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 26632,
          "display_filter": "frame.number == 26632",
          "timestamp_epoch": "1732599597.868867000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 26643,
          "display_filter": "frame.number == 26643",
          "timestamp_epoch": "1732599597.983021000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 26646,
          "display_filter": "frame.number == 26646",
          "timestamp_epoch": "1732599597.985102000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 26648,
          "display_filter": "frame.number == 26648",
          "timestamp_epoch": "1732599597.986188000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 26650,
          "display_filter": "frame.number == 26650",
          "timestamp_epoch": "1732599597.988239000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 26787,
          "display_filter": "frame.number == 26787",
          "timestamp_epoch": "1732599598.044618000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 26791,
          "display_filter": "frame.number == 26791",
          "timestamp_epoch": "1732599598.049093000"
        }
      ]
    },
    {
      "id": "finding-fe6b4fe22ff26b68a72f2ad0",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.11.26.183",
        "protocol": "samr",
        "destination": "10.11.26.3",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 10,
          "frame_number": 330,
          "display_filter": "frame.number == 330",
          "timestamp_epoch": "1732596595.590229000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 334,
          "display_filter": "frame.number == 334",
          "timestamp_epoch": "1732596595.590763000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 340,
          "display_filter": "frame.number == 340",
          "timestamp_epoch": "1732596595.591192000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 344,
          "display_filter": "frame.number == 344",
          "timestamp_epoch": "1732596595.591682000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 346,
          "display_filter": "frame.number == 346",
          "timestamp_epoch": "1732596595.592111000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 349,
          "display_filter": "frame.number == 349",
          "timestamp_epoch": "1732596595.592658000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 351,
          "display_filter": "frame.number == 351",
          "timestamp_epoch": "1732596595.593077000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 353,
          "display_filter": "frame.number == 353",
          "timestamp_epoch": "1732596595.593657000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 358,
          "display_filter": "frame.number == 358",
          "timestamp_epoch": "1732596595.594248000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 361,
          "display_filter": "frame.number == 361",
          "timestamp_epoch": "1732596595.594830000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 366,
          "display_filter": "frame.number == 366",
          "timestamp_epoch": "1732596595.595354000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 368,
          "display_filter": "frame.number == 368",
          "timestamp_epoch": "1732596595.595836000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 372,
          "display_filter": "frame.number == 372",
          "timestamp_epoch": "1732596595.596294000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 375,
          "display_filter": "frame.number == 375",
          "timestamp_epoch": "1732596595.596654000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 377,
          "display_filter": "frame.number == 377",
          "timestamp_epoch": "1732596595.597066000"
        }
      ]
    },
    {
      "id": "finding-f201a1cea0a8f116e3aa9f3e",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.11.26.3",
        "protocol": "drsuapi",
        "destination": "10.11.26.183",
        "event_count": 25,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 11,
          "frame_number": 305,
          "display_filter": "frame.number == 305",
          "timestamp_epoch": "1732596595.587007000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 311,
          "display_filter": "frame.number == 311",
          "timestamp_epoch": "1732596595.587700000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 313,
          "display_filter": "frame.number == 313",
          "timestamp_epoch": "1732596595.588294000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 316,
          "display_filter": "frame.number == 316",
          "timestamp_epoch": "1732596595.588613000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 487,
          "display_filter": "frame.number == 487",
          "timestamp_epoch": "1732596597.431332000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 489,
          "display_filter": "frame.number == 489",
          "timestamp_epoch": "1732596597.432272000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 491,
          "display_filter": "frame.number == 491",
          "timestamp_epoch": "1732596597.432620000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 501,
          "display_filter": "frame.number == 501",
          "timestamp_epoch": "1732596597.434596000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 503,
          "display_filter": "frame.number == 503",
          "timestamp_epoch": "1732596597.435395000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 505,
          "display_filter": "frame.number == 505",
          "timestamp_epoch": "1732596597.435730000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1121,
          "display_filter": "frame.number == 1121",
          "timestamp_epoch": "1732596611.005236000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1123,
          "display_filter": "frame.number == 1123",
          "timestamp_epoch": "1732596611.006177000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1125,
          "display_filter": "frame.number == 1125",
          "timestamp_epoch": "1732596611.006536000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1129,
          "display_filter": "frame.number == 1129",
          "timestamp_epoch": "1732596611.008413000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1131,
          "display_filter": "frame.number == 1131",
          "timestamp_epoch": "1732596611.009217000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 1133,
          "display_filter": "frame.number == 1133",
          "timestamp_epoch": "1732596611.009581000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20434,
          "display_filter": "frame.number == 20434",
          "timestamp_epoch": "1732596656.534486000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20436,
          "display_filter": "frame.number == 20436",
          "timestamp_epoch": "1732596656.535544000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20438,
          "display_filter": "frame.number == 20438",
          "timestamp_epoch": "1732596656.536083000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20442,
          "display_filter": "frame.number == 20442",
          "timestamp_epoch": "1732596656.537881000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20444,
          "display_filter": "frame.number == 20444",
          "timestamp_epoch": "1732596656.538841000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 20446,
          "display_filter": "frame.number == 20446",
          "timestamp_epoch": "1732596656.539357000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 26627,
          "display_filter": "frame.number == 26627",
          "timestamp_epoch": "1732599597.842269000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 26629,
          "display_filter": "frame.number == 26629",
          "timestamp_epoch": "1732599597.843863000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 26631,
          "display_filter": "frame.number == 26631",
          "timestamp_epoch": "1732599597.844792000"
        }
      ]
    },
    {
      "id": "finding-273a41d00ef67b8cf7e27d53",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.11.26.3",
        "protocol": "ldap",
        "destination": "10.11.26.183",
        "event_count": 49,
        "operation_numbers": [
          "",
          "1",
          "4,19,19,19,5",
          "4,5",
          "5"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 1,
          "frame_number": 40,
          "display_filter": "frame.number == 40",
          "timestamp_epoch": "1732596579.030853000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 45,
          "display_filter": "frame.number == 45",
          "timestamp_epoch": "1732596579.034205000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 363,
          "display_filter": "frame.number == 363",
          "timestamp_epoch": "1732596595.595173000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 379,
          "display_filter": "frame.number == 379",
          "timestamp_epoch": "1732596595.597345000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 383,
          "display_filter": "frame.number == 383",
          "timestamp_epoch": "1732596595.601465000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 390,
          "display_filter": "frame.number == 390",
          "timestamp_epoch": "1732596595.604722000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 392,
          "display_filter": "frame.number == 392",
          "timestamp_epoch": "1732596595.605218000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 394,
          "display_filter": "frame.number == 394",
          "timestamp_epoch": "1732596595.605655000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 396,
          "display_filter": "frame.number == 396",
          "timestamp_epoch": "1732596595.606287000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 512,
          "display_filter": "frame.number == 512",
          "timestamp_epoch": "1732596597.439561000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 517,
          "display_filter": "frame.number == 517",
          "timestamp_epoch": "1732596597.442740000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 520,
          "display_filter": "frame.number == 520",
          "timestamp_epoch": "1732596597.443804000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 523,
          "display_filter": "frame.number == 523",
          "timestamp_epoch": "1732596597.447405000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 525,
          "display_filter": "frame.number == 525",
          "timestamp_epoch": "1732596597.448211000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 537,
          "display_filter": "frame.number == 537",
          "timestamp_epoch": "1732596597.466785000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 541,
          "display_filter": "frame.number == 541",
          "timestamp_epoch": "1732596597.467868000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 544,
          "display_filter": "frame.number == 544",
          "timestamp_epoch": "1732596597.468577000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 1140,
          "display_filter": "frame.number == 1140",
          "timestamp_epoch": "1732596611.014080000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 1142,
          "display_filter": "frame.number == 1142",
          "timestamp_epoch": "1732596611.015142000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 1144,
          "display_filter": "frame.number == 1144",
          "timestamp_epoch": "1732596611.015919000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 1146,
          "display_filter": "frame.number == 1146",
          "timestamp_epoch": "1732596611.016629000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 1153,
          "display_filter": "frame.number == 1153",
          "timestamp_epoch": "1732596611.020767000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 1157,
          "display_filter": "frame.number == 1157",
          "timestamp_epoch": "1732596611.022156000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 1160,
          "display_filter": "frame.number == 1160",
          "timestamp_epoch": "1732596611.023059000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20452,
          "display_filter": "frame.number == 20452",
          "timestamp_epoch": "1732596656.542432000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20457,
          "display_filter": "frame.number == 20457",
          "timestamp_epoch": "1732596656.545412000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20459,
          "display_filter": "frame.number == 20459",
          "timestamp_epoch": "1732596656.546433000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20461,
          "display_filter": "frame.number == 20461",
          "timestamp_epoch": "1732596656.547363000"
        },
        {
          "tcp_stream": 82,
          "frame_number": 20463,
          "display_filter": "frame.number == 20463",
          "timestamp_epoch": "1732596656.548244000"
        },
        {
          "tcp_stream": 83,
          "frame_number": 20470,
          "display_filter": "frame.number == 20470",
          "timestamp_epoch": "1732596656.552608000"
        },
        {
          "tcp_stream": 83,
          "frame_number": 20474,
          "display_filter": "frame.number == 20474",
          "timestamp_epoch": "1732596656.554080000"
        },
        {
          "tcp_stream": 83,
          "frame_number": 20477,
          "display_filter": "frame.number == 20477",
          "timestamp_epoch": "1732596656.555100000"
        },
        {
          "tcp_stream": 93,
          "frame_number": 21164,
          "display_filter": "frame.number == 21164",
          "timestamp_epoch": "1732596827.740374000"
        },
        {
          "tcp_stream": 93,
          "frame_number": 21181,
          "display_filter": "frame.number == 21181",
          "timestamp_epoch": "1732596827.747859000"
        },
        {
          "tcp_stream": 93,
          "frame_number": 21183,
          "display_filter": "frame.number == 21183",
          "timestamp_epoch": "1732596827.750040000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 21194,
          "display_filter": "frame.number == 21194",
          "timestamp_epoch": "1732596827.761122000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 21196,
          "display_filter": "frame.number == 21196",
          "timestamp_epoch": "1732596827.761727000"
        },
        {
          "tcp_stream": 97,
          "frame_number": 21259,
          "display_filter": "frame.number == 21259",
          "timestamp_epoch": "1732596897.034953000"
        },
        {
          "tcp_stream": 97,
          "frame_number": 21264,
          "display_filter": "frame.number == 21264",
          "timestamp_epoch": "1732596897.038424000"
        },
        {
          "tcp_stream": 97,
          "frame_number": 21266,
          "display_filter": "frame.number == 21266",
          "timestamp_epoch": "1732596897.040650000"
        },
        {
          "tcp_stream": 98,
          "frame_number": 21277,
          "display_filter": "frame.number == 21277",
          "timestamp_epoch": "1732596897.050275000"
        },
        {
          "tcp_stream": 98,
          "frame_number": 21279,
          "display_filter": "frame.number == 21279",
          "timestamp_epoch": "1732596897.051221000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 26601,
          "display_filter": "frame.number == 26601",
          "timestamp_epoch": "1732599597.742724000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 26606,
          "display_filter": "frame.number == 26606",
          "timestamp_epoch": "1732599597.746289000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 26633,
          "display_filter": "frame.number == 26633",
          "timestamp_epoch": "1732599597.869495000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 26645,
          "display_filter": "frame.number == 26645",
          "timestamp_epoch": "1732599597.984023000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 26647,
          "display_filter": "frame.number == 26647",
          "timestamp_epoch": "1732599597.985532000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 26649,
          "display_filter": "frame.number == 26649",
          "timestamp_epoch": "1732599597.986650000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 26651,
          "display_filter": "frame.number == 26651",
          "timestamp_epoch": "1732599597.989094000"
        }
      ]
    },
    {
      "id": "finding-d322b50ffa8c20a5d431f3cf",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.11.26.3",
        "protocol": "samr",
        "destination": "10.11.26.183",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 10,
          "frame_number": 333,
          "display_filter": "frame.number == 333",
          "timestamp_epoch": "1732596595.590598000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 337,
          "display_filter": "frame.number == 337",
          "timestamp_epoch": "1732596595.591034000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 342,
          "display_filter": "frame.number == 342",
          "timestamp_epoch": "1732596595.591453000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 345,
          "display_filter": "frame.number == 345",
          "timestamp_epoch": "1732596595.591967000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 348,
          "display_filter": "frame.number == 348",
          "timestamp_epoch": "1732596595.592505000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 350,
          "display_filter": "frame.number == 350",
          "timestamp_epoch": "1732596595.592934000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 352,
          "display_filter": "frame.number == 352",
          "timestamp_epoch": "1732596595.593509000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 355,
          "display_filter": "frame.number == 355",
          "timestamp_epoch": "1732596595.594089000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 360,
          "display_filter": "frame.number == 360",
          "timestamp_epoch": "1732596595.594659000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 364,
          "display_filter": "frame.number == 364",
          "timestamp_epoch": "1732596595.595194000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 367,
          "display_filter": "frame.number == 367",
          "timestamp_epoch": "1732596595.595679000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 369,
          "display_filter": "frame.number == 369",
          "timestamp_epoch": "1732596595.596027000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 374,
          "display_filter": "frame.number == 374",
          "timestamp_epoch": "1732596595.596520000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 376,
          "display_filter": "frame.number == 376",
          "timestamp_epoch": "1732596595.596929000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 378,
          "display_filter": "frame.number == 378",
          "timestamp_epoch": "1732596595.597278000"
        }
      ]
    },
    {
      "id": "identity-fd47d673fd5747084676d0a3",
      "type": "identity",
      "label": "account: oboomwald",
      "value": "oboomwald",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.11.26.183"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 6,
          "frame_number": 213,
          "display_filter": "frame.number == 213",
          "timestamp_epoch": "1732596595.423123000"
        },
        {
          "tcp_stream": 7,
          "frame_number": 221,
          "display_filter": "frame.number == 221",
          "timestamp_epoch": "1732596595.429067000"
        },
        {
          "tcp_stream": 7,
          "frame_number": 223,
          "display_filter": "frame.number == 223",
          "timestamp_epoch": "1732596595.431118000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 235,
          "display_filter": "frame.number == 235",
          "timestamp_epoch": "1732596595.434581000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 275,
          "display_filter": "frame.number == 275",
          "timestamp_epoch": "1732596595.584724000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 279,
          "display_filter": "frame.number == 279",
          "timestamp_epoch": "1732596595.584902000"
        },
        {
          "tcp_stream": 14,
          "frame_number": 298,
          "display_filter": "frame.number == 298",
          "timestamp_epoch": "1732596595.586603000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 355,
          "display_filter": "frame.number == 355",
          "timestamp_epoch": "1732596595.594089000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 421,
          "display_filter": "frame.number == 421",
          "timestamp_epoch": "1732596595.833972000"
        },
        {
          "tcp_stream": 94,
          "frame_number": 21173,
          "display_filter": "frame.number == 21173",
          "timestamp_epoch": "1732596827.744857000"
        }
      ]
    },
    {
      "id": "identity-c0280ad99582cbbb7ad5d540",
      "type": "identity",
      "label": "full-name: Oliver Q. Boomwald",
      "value": "Oliver Q. Boomwald",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.11.26.183"
      ],
      "identity_type": "full-name",
      "frame_evidence": [
        {
          "tcp_stream": 10,
          "frame_number": 355,
          "display_filter": "frame.number == 355",
          "timestamp_epoch": "1732596595.594089000"
        }
      ]
    },
    {
      "id": "identity-485ba9018a9ace8de5f9b397",
      "type": "identity",
      "label": "hostname: DESKTOP-B8TQK49",
      "value": "DESKTOP-B8TQK49",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.11.26.183"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 12,
          "frame_number": 69,
          "display_filter": "frame.number == 69",
          "timestamp_epoch": "1732596581.324171000"
        },
        {
          "udp_stream": 12,
          "frame_number": 70,
          "display_filter": "frame.number == 70",
          "timestamp_epoch": "1732596581.324270000"
        },
        {
          "udp_stream": 12,
          "frame_number": 145,
          "display_filter": "frame.number == 145",
          "timestamp_epoch": "1732596582.087011000"
        },
        {
          "udp_stream": 12,
          "frame_number": 146,
          "display_filter": "frame.number == 146",
          "timestamp_epoch": "1732596582.087011000"
        },
        {
          "udp_stream": 12,
          "frame_number": 174,
          "display_filter": "frame.number == 174",
          "timestamp_epoch": "1732596582.863956000"
        },
        {
          "udp_stream": 12,
          "frame_number": 175,
          "display_filter": "frame.number == 175",
          "timestamp_epoch": "1732596582.863956000"
        },
        {
          "udp_stream": 12,
          "frame_number": 181,
          "display_filter": "frame.number == 181",
          "timestamp_epoch": "1732596583.619885000"
        },
        {
          "udp_stream": 12,
          "frame_number": 182,
          "display_filter": "frame.number == 182",
          "timestamp_epoch": "1732596583.620016000"
        },
        {
          "udp_stream": 18,
          "frame_number": 200,
          "display_filter": "frame.number == 200",
          "timestamp_epoch": "1732596587.487349000"
        },
        {
          "udp_stream": 18,
          "frame_number": 201,
          "display_filter": "frame.number == 201",
          "timestamp_epoch": "1732596587.491453000"
        },
        {
          "udp_stream": 18,
          "frame_number": 1092,
          "display_filter": "frame.number == 1092",
          "timestamp_epoch": "1732596610.399200000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 1103,
          "display_filter": "frame.number == 1103",
          "timestamp_epoch": "1732596610.419229000"
        },
        {
          "udp_stream": 18,
          "frame_number": 1109,
          "display_filter": "frame.number == 1109",
          "timestamp_epoch": "1732596610.422359000"
        },
        {
          "udp_stream": 18,
          "frame_number": 1112,
          "display_filter": "frame.number == 1112",
          "timestamp_epoch": "1732596610.434887000"
        },
        {
          "tcp_stream": 74,
          "frame_number": 12755,
          "display_filter": "frame.number == 12755",
          "timestamp_epoch": "1732596640.456514000"
        },
        {
          "udp_stream": 18,
          "frame_number": 12761,
          "display_filter": "frame.number == 12761",
          "timestamp_epoch": "1732596640.459523000"
        },
        {
          "udp_stream": 18,
          "frame_number": 12764,
          "display_filter": "frame.number == 12764",
          "timestamp_epoch": "1732596640.476277000"
        },
        {
          "tcp_stream": 85,
          "frame_number": 20528,
          "display_filter": "frame.number == 20528",
          "timestamp_epoch": "1732596670.484518000"
        },
        {
          "udp_stream": 18,
          "frame_number": 20534,
          "display_filter": "frame.number == 20534",
          "timestamp_epoch": "1732596670.489238000"
        },
        {
          "udp_stream": 18,
          "frame_number": 20537,
          "display_filter": "frame.number == 20537",
          "timestamp_epoch": "1732596670.509451000"
        }
      ]
    },
    {
      "id": "identity-daeac9de21ccaa814c532d97",
      "type": "identity",
      "label": "netbios-group: NEMOTODES",
      "value": "NEMOTODES",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [],
      "identity_type": "netbios-group",
      "frame_evidence": [
        {
          "udp_stream": 12,
          "frame_number": 71,
          "display_filter": "frame.number == 71",
          "timestamp_epoch": "1732596581.324341000"
        },
        {
          "udp_stream": 12,
          "frame_number": 144,
          "display_filter": "frame.number == 144",
          "timestamp_epoch": "1732596582.086915000"
        },
        {
          "udp_stream": 12,
          "frame_number": 176,
          "display_filter": "frame.number == 176",
          "timestamp_epoch": "1732596582.864083000"
        },
        {
          "udp_stream": 12,
          "frame_number": 180,
          "display_filter": "frame.number == 180",
          "timestamp_epoch": "1732596583.619885000"
        },
        {
          "udp_stream": 12,
          "frame_number": 191,
          "display_filter": "frame.number == 191",
          "timestamp_epoch": "1732596584.407629000"
        },
        {
          "udp_stream": 12,
          "frame_number": 193,
          "display_filter": "frame.number == 193",
          "timestamp_epoch": "1732596585.167073000"
        },
        {
          "udp_stream": 12,
          "frame_number": 197,
          "display_filter": "frame.number == 197",
          "timestamp_epoch": "1732596585.940378000"
        },
        {
          "udp_stream": 12,
          "frame_number": 199,
          "display_filter": "frame.number == 199",
          "timestamp_epoch": "1732596586.702380000"
        }
      ]
    },
    {
      "id": "artifact-f74a886bbea2a330f4d65651",
      "type": "file-artifact",
      "label": "MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D",
      "value": "cd6f72bd96cbbad446325f8c2d087283f051ccaf77523dc436eec2d98be29bf7",
      "sha256": "cd6f72bd96cbbad446325f8c2d087283f051ccaf77523dc436eec2d98be29bf7",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 504,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-97efc5cd34a046313da7c210",
      "type": "file-artifact",
      "label": "fakeurl(2).htm",
      "value": "839e234a3a10b60d559ee5679d2019ad4e58d9cd66e6cfd971207c3c6ef8ea4d",
      "sha256": "839e234a3a10b60d559ee5679d2019ad4e58d9cd66e6cfd971207c3c6ef8ea4d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 250,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/html"
    },
    {
      "id": "artifact-5a9ba1b214d7efe4b7932b0e",
      "type": "file-artifact",
      "label": "fakeurl(3).htm",
      "value": "a5a0a597e4b76ebec517a83126dbce37625a763b57307afe7064d9eb0a523956",
      "sha256": "a5a0a597e4b76ebec517a83126dbce37625a763b57307afe7064d9eb0a523956",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 152,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/html"
    },
    {
      "id": "artifact-fa987e65729b7bbc996cb52c",
      "type": "file-artifact",
      "label": "fakeurl(5).htm",
      "value": "59dc18363d5d0313ae94aa0ecad2d06dc77144758eeae2cc5ed8b4eee3923752",
      "sha256": "59dc18363d5d0313ae94aa0ecad2d06dc77144758eeae2cc5ed8b4eee3923752",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 84,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/html"
    },
    {
      "id": "artifact-ef0e7e08ce1dfd18b2d49737",
      "type": "file-artifact",
      "label": "fakeurl(4).htm",
      "value": "f0e200cacd273e3dd257057f27aeda839a1f2f31482e0bb01ea8b1363a7af245",
      "sha256": "f0e200cacd273e3dd257057f27aeda839a1f2f31482e0bb01ea8b1363a7af245",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 76,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/html"
    },
    {
      "id": "artifact-f5ee19f48ebb7f4b5cf36dee",
      "type": "file-artifact",
      "label": "fakeurl(1).htm",
      "value": "79653567106d923034d36a9025d2d37955ff55dae5d77c1a79a321d850235d00",
      "sha256": "79653567106d923034d36a9025d2d37955ff55dae5d77c1a79a321d850235d00",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 61,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/html"
    },
    {
      "id": "artifact-e4bed6f90635e4518afc6182",
      "type": "file-artifact",
      "label": "fakeurl(10).htm",
      "value": "975b5678560775735da4a9e8b805dce370329179b8e17ebc1c289aaeb293f7ff",
      "sha256": "975b5678560775735da4a9e8b805dce370329179b8e17ebc1c289aaeb293f7ff",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 36,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/html"
    },
    {
      "id": "artifact-e4d376cccfe6c5ce635d3c78",
      "type": "file-artifact",
      "label": "fakeurl(54).htm",
      "value": "2b69346572041eefe558a82b58d654237e087ce9ab4e0876254a40a8954279a9",
      "sha256": "2b69346572041eefe558a82b58d654237e087ce9ab4e0876254a40a8954279a9",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 22,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/html"
    },
    {
      "id": "artifact-c953bbb4ee0b46fd26e2f2e8",
      "type": "file-artifact",
      "label": "connecttest.txt",
      "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61",
      "sha256": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 22,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/plain"
    },
    {
      "id": "artifact-e09b8d6347b7b6beb1cd03b3",
      "type": "file-artifact",
      "label": "loca.asp",
      "value": "af0c1c32558e6dc1e4e8f3e1d151268b8f6eb7cd844c9ac6dfc4b862decc7983",
      "sha256": "af0c1c32558e6dc1e4e8f3e1d151268b8f6eb7cd844c9ac6dfc4b862decc7983",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 16,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-5ffe760eae605b04408a10c1",
      "type": "file-artifact",
      "label": "ProcessMAU.txt",
      "value": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820",
      "sha256": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 4,
      "source_ref": "2024-11-26-traffic-analysis-exercise.pcap",
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "source_refs": [
        "2024-11-26-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/plain"
    }
  ],
  "evidence_edges": [],
  "timeline": [
    {
      "at": "2026-09-19T12:50:34.898Z",
      "event": "Added Log/PCAP analysis 2024-11-26-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2024-11-26-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 2
    },
    {
      "at": "2026-09-19T12:58:23.896Z",
      "event": "Added Log/PCAP analysis 2024-11-26-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2024-11-26-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 2
    }
  ],
  "created_at": "2026-09-19T12:50:32.080473+00:00",
  "updated_at": "2026-09-19T12:58:23.945819+00:00"
}