{ "id": "49664677-c404-485e-8035-766012f9a9a4", "name": "PCAP verified workflow 2021-10-22 20260919", "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.", "status": "active", "domain": "enterprise-attack", "actor_ids": [], "technique_ids": [ "T1027", "T1071", "T1082", "T1083", "T1106", "T1129", "T1204.002", "T1218", "T1218.010", "T1218.011", "T1219", "T1497", "T1518", "T1518.001", "T1566", "T1574", "T1574.002", "T1622" ], "report_ids": [ "06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "20f513e1-0d5c-4c07-a135-12408729e84e", "449a4d13-67b3-4897-a60b-1da08fcdd5ac", "58057369-e44a-47d1-97a6-8f537e481157", "593d219e-2578-45ab-8d90-697899320a04", "ed278503-bcef-4a9e-985d-fdb452eaa0f4" ], "evidence_nodes": [ { "id": "log-pcap:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "type": "log-pcap-analysis", "label": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2021-10-22-ISC-forensic-challenge-traffic.pcap\nCapture SHA-256: `95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455`\nSemantic result SHA-256: `e2a781b6839946af3b4581e8fbaa850bc68bbe393fce12f786178323e0ccd04d`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 84542 packets across 216 IP endpoints and 2746 transport flows. Observed 2061 DNS events, 120 HTTP requests, 409 TLS ClientHello events, and 4 exported HTTP object(s). Deterministic rules produced 37 finding(s): 0 high, 13 medium, and 24 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 84542\n- Duration: 5547.683987 seconds\n- Captured bytes: 47654732\n- Endpoints: 216\n- Flows: 2746\n\n## Deterministic findings\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 825, frame 1639, frame 2954, frame 15029, frame 17432.\n\nMetrics: `{\"domain\":\"wpad.enemywatch.net\",\"response_count\":42,\"source\":\"10.10.22.156\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 827, frame 1641, frame 2956, frame 15031, frame 17435.\n\nMetrics: `{\"domain\":\"wpad.localdomain\",\"response_count\":42,\"source\":\"10.10.22.156\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 39, frame 752, frame 1643, frame 11964, frame 22840.\n\nMetrics: `{\"domain\":\"wpad.enemywatch.net\",\"response_count\":12,\"source\":\"10.10.22.157\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 41, frame 754, frame 1645, frame 11966, frame 22842.\n\nMetrics: `{\"domain\":\"wpad.localdomain\",\"response_count\":12,\"source\":\"10.10.22.157\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 1719, frame 2522, frame 3813, frame 6217, frame 6501.\n\nMetrics: `{\"domain\":\"wpad.enemywatch.net\",\"response_count\":16,\"source\":\"10.10.22.158\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 1721, frame 2524, frame 3815, frame 6219, frame 6503.\n\nMetrics: `{\"domain\":\"wpad.localdomain\",\"response_count\":16,\"source\":\"10.10.22.158\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 999 / TCP stream 46, frame 1001 / TCP stream 46, frame 1003 / TCP stream 46, frame 1013 / TCP stream 46, frame 1015 / TCP stream 46.\n\nMetrics: `{\"destination\":\"10.10.22.22\",\"event_count\":59,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.10.22.156\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 804 / TCP stream 37, frame 965 / TCP stream 37, frame 994 / TCP stream 37, frame 1062 / TCP stream 55, frame 1069 / TCP stream 55.\n\nMetrics: `{\"destination\":\"10.10.22.22\",\"event_count\":102,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.10.22.156\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 4249 / TCP stream 187, frame 4251 / TCP stream 187, frame 4253 / TCP stream 187, frame 4255 / TCP stream 187, frame 4257 / TCP stream 187.\n\nMetrics: `{\"destination\":\"10.10.22.22\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.10.22.156\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 127 / TCP stream 3, frame 131 / TCP stream 3, frame 134 / TCP stream 3, frame 145 / TCP stream 3, frame 147 / TCP stream 3.\n\nMetrics: `{\"destination\":\"10.10.22.22\",\"event_count\":49,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.10.22.157\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 27 / TCP stream 0, frame 91 / TCP stream 5, frame 120 / TCP stream 5, frame 129 / TCP stream 5, frame 133 / TCP stream 5.\n\nMetrics: `{\"destination\":\"10.10.22.22\",\"event_count\":92,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.10.22.157\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3468 / TCP stream 157, frame 3470 / TCP stream 157, frame 3472 / TCP stream 157, frame 3474 / TCP stream 157, frame 3476 / TCP stream 157.\n\nMetrics: `{\"destination\":\"10.10.22.22\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.10.22.157\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1951 / TCP stream 93, frame 1959 / TCP stream 93, frame 1963 / TCP stream 93, frame 1964 / TCP stream 86, frame 1968 / TCP stream 86.\n\nMetrics: `{\"destination\":\"10.10.22.22\",\"event_count\":53,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.10.22.158\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1696 / TCP stream 79, frame 1776 / TCP stream 84, frame 1907 / TCP stream 79, frame 1938 / TCP stream 84, frame 1960 / TCP stream 84.\n\nMetrics: `{\"destination\":\"10.10.22.22\",\"event_count\":88,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.10.22.158\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 2699 / TCP stream 126, frame 2701 / TCP stream 126, frame 2703 / TCP stream 126, frame 2705 / TCP stream 126, frame 2708 / TCP stream 126.\n\nMetrics: `{\"destination\":\"10.10.22.22\",\"event_count\":43,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.10.22.158\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1000 / TCP stream 46, frame 1002 / TCP stream 46, frame 1004 / TCP stream 46, frame 1014 / TCP stream 46, frame 1016 / TCP stream 46.\n\nMetrics: `{\"destination\":\"10.10.22.156\",\"event_count\":59,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.10.22.22\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 806 / TCP stream 37, frame 968 / TCP stream 37, frame 1064 / TCP stream 55, frame 1071 / TCP stream 55, frame 1073 / TCP stream 55.\n\nMetrics: `{\"destination\":\"10.10.22.156\",\"event_count\":82,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.10.22.22\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 4250 / TCP stream 187, frame 4252 / TCP stream 187, frame 4254 / TCP stream 187, frame 4256 / TCP stream 187, frame 4258 / TCP stream 187.\n\nMetrics: `{\"destination\":\"10.10.22.156\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.10.22.22\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 128 / TCP stream 3, frame 132 / TCP stream 3, frame 135 / TCP stream 3, frame 146 / TCP stream 3, frame 150 / TCP stream 3.\n\nMetrics: `{\"destination\":\"10.10.22.157\",\"event_count\":49,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.10.22.22\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 29 / TCP stream 0, frame 93 / TCP stream 5, frame 124 / TCP stream 5, frame 130 / TCP stream 5, frame 136 / TCP stream 5.\n\nMetrics: `{\"destination\":\"10.10.22.157\",\"event_count\":74,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.10.22.22\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3469 / TCP stream 157, frame 3471 / TCP stream 157, frame 3473 / TCP stream 157, frame 3475 / TCP stream 157, frame 3477 / TCP stream 157.\n\nMetrics: `{\"destination\":\"10.10.22.157\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.10.22.22\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1954 / TCP stream 93, frame 1961 / TCP stream 93, frame 1965 / TCP stream 93, frame 1966 / TCP stream 86, frame 1972 / TCP stream 86.\n\nMetrics: `{\"destination\":\"10.10.22.158\",\"event_count\":53,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.10.22.22\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1698 / TCP stream 79, frame 1779 / TCP stream 84, frame 1925 / TCP stream 79, frame 1947 / TCP stream 84, frame 1962 / TCP stream 84.\n\nMetrics: `{\"destination\":\"10.10.22.158\",\"event_count\":71,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.10.22.22\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 2700 / TCP stream 126, frame 2702 / TCP stream 126, frame 2704 / TCP stream 126, frame 2706 / TCP stream 126, frame 2709 / TCP stream 126.\n\nMetrics: `{\"destination\":\"10.10.22.158\",\"event_count\":43,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.10.22.22\"}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 5644 / TCP stream 232.\n\nMetrics: `{\"destination\":\"37.0.10.22\",\"destination_port\":1187,\"duration_seconds\":336.595,\"packets\":514,\"source\":\"10.10.22.157\",\"wire_bytes\":376928}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 17795 / TCP stream 391.\n\nMetrics: `{\"destination\":\"37.0.10.22\",\"destination_port\":1187,\"duration_seconds\":171.549,\"packets\":72,\"source\":\"10.10.22.157\",\"wire_bytes\":4376}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 24560 / TCP stream 691.\n\nMetrics: `{\"destination\":\"37.0.10.22\",\"destination_port\":1187,\"duration_seconds\":330.753,\"packets\":134,\"source\":\"10.10.22.157\",\"wire_bytes\":8096}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 42858 / TCP stream 810.\n\nMetrics: `{\"destination\":\"23.111.114.52\",\"destination_port\":65400,\"duration_seconds\":3322.704,\"packets\":9622,\"source\":\"10.10.22.156\",\"wire_bytes\":1586196}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 51877 / TCP stream 968.\n\nMetrics: `{\"destination\":\"37.0.10.22\",\"destination_port\":1187,\"duration_seconds\":334.618,\"packets\":136,\"source\":\"10.10.22.157\",\"wire_bytes\":8216}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 61387 / TCP stream 1254.\n\nMetrics: `{\"destination\":\"37.0.10.22\",\"destination_port\":1187,\"duration_seconds\":330.634,\"packets\":134,\"source\":\"10.10.22.157\",\"wire_bytes\":8096}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 67512 / TCP stream 1346.\n\nMetrics: `{\"destination\":\"45.153.241.142\",\"destination_port\":443,\"duration_seconds\":699.347,\"packets\":52,\"source\":\"10.10.22.156\",\"wire_bytes\":3186}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 67513 / TCP stream 1347.\n\nMetrics: `{\"destination\":\"45.153.241.142\",\"destination_port\":443,\"duration_seconds\":699.318,\"packets\":54,\"source\":\"10.10.22.156\",\"wire_bytes\":3306}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 69549 / TCP stream 1450.\n\nMetrics: `{\"destination\":\"37.0.10.22\",\"destination_port\":1187,\"duration_seconds\":331.166,\"packets\":132,\"source\":\"10.10.22.157\",\"wire_bytes\":7976}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 74529 / TCP stream 1485.\n\nMetrics: `{\"destination\":\"45.153.241.142\",\"destination_port\":443,\"duration_seconds\":30.11,\"packets\":19,\"source\":\"10.10.22.156\",\"wire_bytes\":1120}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 76852 / TCP stream 1559.\n\nMetrics: `{\"destination\":\"37.0.10.22\",\"destination_port\":1187,\"duration_seconds\":333.255,\"packets\":132,\"source\":\"10.10.22.157\",\"wire_bytes\":7976}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 81050 / TCP stream 1607.\n\nMetrics: `{\"destination\":\"37.0.10.22\",\"destination_port\":1187,\"duration_seconds\":331.75,\"packets\":134,\"source\":\"10.10.22.157\",\"wire_bytes\":8096}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 83774 / TCP stream 1645.\n\nMetrics: `{\"destination\":\"37.0.10.22\",\"destination_port\":1187,\"duration_seconds\":91.986,\"packets\":41,\"source\":\"10.10.22.157\",\"wire_bytes\":2522}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `agnes.warren`; client IPs: 10.10.22.156; frames: 4153, 4161, 4163, 4175, 4208\n- account: `desktop-87wce26$`; client IPs: 10.10.22.158; frames: 1764, 1791, 1796, 1798, 1809\n- account: `desktop-cfa3367$`; client IPs: 10.10.22.156; frames: 848, 856, 858, 883, 896\n- account: `desktop-nz875r4$`; client IPs: 10.10.22.157; frames: 80, 98, 100, 112, 197\n- account: `kevin.henderson`; client IPs: 10.10.22.158; frames: 2596, 2604, 2606, 2618, 2659\n- account: `marcus.cobb`; client IPs: 10.10.22.157; frames: 3366, 3374, 3376, 3388, 3431\n- domain: `ENEMYWATCH`; client IPs: 10.10.22.156, 10.10.22.157, 10.10.22.158; frames: 2682, 3454, 4233, 56437, 56472\n- full-name: `Agnes Warren`; client IPs: 10.10.22.156; frames: 4264\n- full-name: `Kevin Henderson`; client IPs: 10.10.22.158; frames: 2715\n- full-name: `Marcus Cobb`; client IPs: 10.10.22.157; frames: 3483\n- hostname: `DESKTOP-87WCE26`; client IPs: 10.10.22.158; frames: 1667, 1691, 1726, 2106, 2107\n- hostname: `DESKTOP-CFA3367`; client IPs: 10.10.22.156; frames: 776, 797, 871, 1183, 1197\n- hostname: `DESKTOP-NZ875R4`; client IPs: 10.10.22.157; frames: 1, 42, 333, 343, 545\n- netbios-group: `ENEMYWATCH`; client IPs: unbound subject; frames: 43, 342, 546, 625, 626\n\n## IOC and artifact candidates\n\n- domain: `112.146.66.173.in-addr.arpa`; roles: dns-query\n- domain: `22.22.10.10.in-addr.arpa`; roles: dns-query\n- domain: `a-9999.dc-msedge.net`; roles: dns-cname\n- domain: `a-ring-fallback.msedge.net`; roles: dns-query, tls-sni\n- domain: `a-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `a.nel.cloudflare.com`; roles: dns-query, tls-sni\n- domain: `a1449.dscg2.akamai.net`; roles: dns-cname\n- domain: `activity-geo.trafficmanager.net`; roles: dns-cname\n- domain: `activity.windows.com`; roles: dns-query, tls-sni\n- domain: `api.ipify.org`; roles: dns-query, tls-sni\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `aqsouhyw.bazar`; roles: dns-query\n- domain: `av.dial-up.net`; roles: dns-query\n- domain: `b-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `bing.com`; roles: dns-query, tls-sni\n- domain: `bluehail.bazar`; roles: dns-query\n- domain: `c-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `calacatta.com`; roles: dns-cname\n- domain: `cj.dotomi.com`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `config.edge.skype.com`; roles: dns-query, tls-sni\n- domain: `continuum.dds.microsoft.com`; roles: dns-query, tls-sni\n- domain: `cs-geo-dds.trafficmanager.net`; roles: dns-cname\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `desktop-87wce26.enemywatch.net`; roles: dns-query\n- domain: `desktop-cfa3367.enemywatch.net`; roles: dns-query\n- domain: `desktop-nz875r4.enemywatch.net`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `eafddirect.msedge.net`; roles: dns-query\n- domain: `edge.activity.windows.com`; roles: dns-query, tls-sni\n- domain: `edge.microsoft.com`; roles: dns-query, tls-sni\n- domain: `enemywatch-dc.enemywatch.net`; roles: dns-query\n- domain: `enemywatch.net`; roles: dns-query\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com.akadns.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fp-afd.azurefd.us`; roles: dns-query, tls-sni\n- domain: `fp-as.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-vs-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `grtovxn.enemywatch.net`; roles: dns-query\n- domain: `grtovxn.localdomain`; roles: dns-query\n- domain: `hzmx01.mxmail.netease.com`; roles: dns-query, tls-sni\n- domain: `imap.gmail.com`; roles: dns-query\n- domain: `img-prod-cms-rt-microsoft-com.akamaized.net`; roles: dns-query, tls-sni\n- domain: `inbound.att.net`; roles: dns-query\n- domain: `k-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `kamuchehddhgfgf.ddns.net`; roles: dns-query\n- domain: `l-0005.dc-msedge.net`; roles: dns-cname\n- domain: `l-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `login.live.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `mail.abchk.net`; roles: dns-query, tls-sni\n- domain: `mail.ajeel.fr`; roles: dns-query, tls-sni\n- domain: `mail.akinao-lab.com`; roles: dns-query, tls-sni\n- domain: `mail.anberman.es`; roles: dns-query, tls-sni\n- domain: `mail.atelierscalin.fr`; roles: dns-query, tls-sni\n- domain: `mail.austinjournls.com`; roles: dns-query\n- domain: `mail.be-daventure.fr`; roles: dns-query, tls-sni\n- domain: `mail.bethnet.co.za`; roles: dns-query, tls-sni\n- domain: `mail.brins-d-eveil.fr`; roles: dns-query, tls-sni\n- domain: `mail.burgers.cc`; roles: dns-query\n- domain: `mail.chokshiandchokshi.in`; roles: dns-query\n- domain: `mail.come-paris.fr`; roles: dns-query, tls-sni\n- domain: `mail.corteo.fr`; roles: dns-query, tls-sni\n- domain: `mail.csnert.fr`; roles: dns-query, tls-sni\n- domain: `mail.debtmend.co.za`; roles: dns-query, tls-sni\n- domain: `mail.doctor-healthcare.com`; roles: dns-query, tls-sni\n- domain: `mail.eolas.fr`; roles: dns-query, tls-sni\n- domain: `mail.goldmarkconsultants.com`; roles: dns-query\n- domain: `mail.hrctunisia.com`; roles: dns-query, tls-sni\n- domain: `mail.ipage.com`; roles: dns-query, tls-sni\n- domain: `mail.isoldry.com`; roles: dns-query, tls-sni\n- domain: `mail.kalivet.com`; roles: dns-query, tls-sni\n- domain: `mail.kbcrawl.net`; roles: dns-query, tls-sni\n- domain: `mail.lecmg.fr`; roles: dns-query, tls-sni\n- domain: `mail.loosefoot.com`; roles: dns-query\n- domain: `mail.ma-communication.com`; roles: dns-query, tls-sni\n- domain: `mail.maclen.fr`; roles: dns-query, tls-sni\n- domain: `mail.microvistatech.com`; roles: dns-query, tls-sni\n- domain: `mail.monquartier.com.br`; roles: dns-query\n- domain: `mail.myfairpoint.net`; roles: dns-query\n- domain: `mail.nazarioconstruction.com`; roles: dns-query, tls-sni\n- domain: `mail.otenet.gr`; roles: dns-query, tls-sni\n- domain: `mail.pangia.biz`; roles: dns-query, tls-sni\n- domain: `mail.perpetualplaques.com`; roles: dns-query, tls-sni\n- domain: `mail.ptolemee.com`; roles: dns-query, tls-sni\n- domain: `mail.qualityms.com.mx`; roles: dns-query, tls-sni\n- domain: `mail.smtp2go.com`; roles: dns-query\n- domain: `mail.songazine.fr`; roles: dns-query, tls-sni\n- domain: `mail.tcgasociados.com`; roles: dns-query, tls-sni\n- domain: `mail.tecsindia.com`; roles: dns-query\n- domain: `mail.tetranergy.com`; roles: dns-query, tls-sni\n- domain: `mail.tiretracksusa.com`; roles: dns-query\n- domain: `mail.verificalitas.es`; roles: dns-query, tls-sni\n- domain: `mail.verificalitasoca.es`; roles: dns-query, tls-sni\n- domain: `mail.xenium-partners.fr`; roles: dns-query, tls-sni\n- domain: `mail.yourwebsitemail.com`; roles: dns-query, tls-sni\n- domain: `mail04.l4email.com`; roles: dns-query, tls-sni\n- domain: `microsoft.com`; roles: dns-query, tls-sni\n- domain: `moiazureorigin.clo.footprintdns.com`; roles: dns-query\n- domain: `mta-01.webnode.com`; roles: dns-query, tls-sni\n- domain: `mta.21cn.com`; roles: dns-query, tls-sni\n- domain: `mx.celleno.it`; roles: dns-query\n- domain: `mx02.colt-engine.it`; roles: dns-query\n- domain: `mx1.mail.139.com`; roles: dns-query, tls-sni\n- domain: `myexternalip.com`; roles: dns-query, tls-sni\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `ns0.ovh.net`; roles: dns-cname\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `oftheearth.ca`; roles: dns-cname\n- domain: `outlook.office365.com`; roles: dns-query, tls-sni\n- domain: `pingosip.top`; roles: dns-query, tls-sni\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `pti.store.microsoft.com`; roles: dns-query, tls-sni\n- domain: `reddew28c.bazar`; roles: dns-query\n- domain: `redinnovations.co.uk`; roles: dns-query, tls-sni\n- domain: `rum18.perf.linkedin.com`; roles: dns-query, tls-sni\n- domain: `self.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settingsfd-geo.trafficmanager.net`; roles: dns-cname\n- domain: `slickdeals.net`; roles: dns-query, tls-sni\n- domain: `smtp-com.netzero.net`; roles: dns-cname\n- domain: `smtp-relay.gmail.com`; roles: dns-query\n- domain: `smtp.forpsi.com`; roles: dns-query, tls-sni\n- domain: `smtp.juno.com`; roles: dns-query\n- domain: `smtp.medicinafutura.it`; roles: dns-query, tls-sni\n- domain: `smtp.netzero.com`; roles: dns-query\n- domain: `smtp.outlook.com`; roles: dns-query, tls-sni\n- domain: `smtp.sina.com.cn`; roles: dns-query, tls-sni\n- domain: `smtp.suddenlink.net`; roles: dns-query, tls-sni\n- domain: `smtp.ulpianocarrasco.com`; roles: dns-query, tls-sni\n- domain: `smtp.unisanraffaele.gov.it`; roles: dns-query, tls-sni\n- domain: `smtp.vox.co.za`; roles: dns-query\n- domain: `smtpa.forpsi.com`; roles: dns-cname\n- domain: `sobolpand.top`; roles: dns-query, http-host\n- domain: `spo-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `ssl0.ovh.net`; roles: dns-cname\n- domain: `storeedgefd.dsx.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `t-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `tackleadvisors.com`; roles: dns-query, tls-sni\n- domain: `teams-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `track.cj.akadns.net`; roles: dns-cname\n- domain: `ultimatecuisinecatering.com`; roles: dns-query, tls-sni\n- domain: `umwatson.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `vchbbq.com`; roles: dns-query, tls-sni\n- domain: `vmail.dial-up.net`; roles: dns-cname\n- domain: `w00d8b4e.kasserver.com`; roles: dns-query, tls-sni\n- domain: `whitestorm9p.bazar`; roles: dns-query\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.enemywatch.net`; roles: dns-query\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `www.backmarket.com`; roles: dns-query, tls-sni\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.calacatta.com`; roles: dns-query, tls-sni\n- domain: `www.dellrefurbished.com`; roles: dns-query, tls-sni\n- domain: `www.emjcd.com`; roles: dns-query, tls-sni\n- domain: `www.kqzyfj.com`; roles: dns-query, http-host\n- domain: `www.microsoft.com`; roles: dns-query, tls-sni\n- domain: `www.oftheearth.ca`; roles: dns-query, tls-sni\n- domain: `www.openssl.org`; roles: dns-query, tls-sni\n- domain: `x1.c.lencr.org`; roles: dns-query, http-host\n- domain: `yeahmx01.mxmail.netease.com`; roles: dns-query, tls-sni\n- domain: `znkbmknmqyvbxi.enemywatch.net`; roles: dns-query\n- domain: `znkbmknmqyvbxi.localdomain`; roles: dns-query\n- domain: `zuczbdyvfzio.enemywatch.net`; roles: dns-query\n- domain: `zuczbdyvfzio.localdomain`; roles: dns-query\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `10.10.22.1`; roles: network-endpoint\n- ipv4: `10.10.22.156`; roles: dns-answer, network-endpoint\n- ipv4: `10.10.22.157`; roles: dns-answer, network-endpoint\n- ipv4: `10.10.22.158`; roles: dns-answer, network-endpoint\n- ipv4: `10.10.22.22`; roles: dns-answer, network-endpoint\n- ipv4: `10.10.22.255`; roles: network-endpoint\n- ipv4: `103.129.255.250`; roles: dns-answer, network-endpoint\n- ipv4: `103.129.255.251`; roles: dns-answer\n- ipv4: `103.143.8.71`; roles: network-endpoint\n- ipv4: `104.16.10.88`; roles: dns-answer, network-endpoint\n- ipv4: `104.17.201.57`; roles: dns-answer\n- ipv4: `104.208.16.88`; roles: dns-answer, network-endpoint\n- ipv4: `104.208.16.94`; roles: dns-answer, network-endpoint\n- ipv4: `104.21.32.95`; roles: dns-answer, network-endpoint\n- ipv4: `104.21.65.22`; roles: dns-answer\n- ipv4: `104.215.148.63`; roles: dns-answer, network-endpoint\n- ipv4: `104.46.162.226`; roles: dns-answer, network-endpoint\n- ipv4: `104.94.77.31`; roles: dns-answer, network-endpoint\n- ipv4: `107.161.180.34`; roles: dns-answer, network-endpoint\n- ipv4: `108.168.133.76`; roles: dns-answer, network-endpoint\n- ipv4: `111.223.52.28`; roles: dns-answer, network-endpoint\n- ipv4: `115.112.78.166`; roles: dns-answer, network-endpoint\n- ipv4: `122.179.158.212`; roles: network-endpoint\n- ipv4: `123.126.45.161`; roles: dns-answer, network-endpoint\n- ipv4: `123.58.177.213`; roles: dns-answer, network-endpoint\n- ipv4: `123.58.177.214`; roles: dns-answer\n- ipv4: `123.58.177.220`; roles: dns-answer\n- ipv4: `129.246.14.238`; roles: dns-answer\n- ipv4: `13.107.136.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.18.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.4.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.4.50`; roles: dns-answer\n- ipv4: `13.107.42.16`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.42.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.43.14`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.6.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.64.180.106`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.239.72`; roles: dns-answer, network-endpoint\n- ipv4: `13.77.161.179`; roles: dns-answer\n- ipv4: `13.86.61.82`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.178.27`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.10`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.9`; roles: dns-answer, network-endpoint\n- ipv4: `130.61.64.122`; roles: network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `131.253.33.254`; roles: dns-answer, network-endpoint\n- ipv4: `140.82.49.12`; roles: network-endpoint\n- ipv4: `142.250.114.108`; roles: dns-answer\n- ipv4: `142.250.114.109`; roles: dns-answer, network-endpoint\n- ipv4: `142.250.114.28`; roles: dns-answer, network-endpoint\n- ipv4: `159.127.40.144`; roles: dns-answer, network-endpoint\n- ipv4: `162.210.220.137`; roles: network-endpoint\n- ipv4: `167.248.117.81`; roles: network-endpoint\n- ipv4: `168.196.133.84`; roles: dns-answer, network-endpoint\n- ipv4: `172.67.139.101`; roles: dns-answer, network-endpoint\n- ipv4: `172.67.150.172`; roles: dns-answer\n- ipv4: `173.223.109.212`; roles: dns-answer, network-endpoint\n- ipv4: `173.249.53.15`; roles: dns-answer, network-endpoint\n- ipv4: `173.255.233.87`; roles: dns-answer\n- ipv4: `178.23.190.8`; roles: http-host, network-endpoint\n- ipv4: `180.149.244.81`; roles: dns-answer, network-endpoint\n- ipv4: `183.61.185.83`; roles: dns-answer, network-endpoint\n- ipv4: `187.250.109.250`; roles: network-endpoint\n- ipv4: `189.210.115.207`; roles: network-endpoint\n- ipv4: `190.117.91.214`; roles: network-endpoint\n- ipv4: `190.14.37.244`; roles: http-host, network-endpoint\n- ipv4: `192.185.57.27`; roles: dns-answer, network-endpoint\n- ipv4: `193.70.18.144`; roles: dns-answer, network-endpoint\n- ipv4: `194.15.112.173`; roles: network-endpoint\n- ipv4: `194.36.191.35`; roles: http-host, network-endpoint\n- ipv4: `197.221.10.57`; roles: dns-answer, network-endpoint\n- ipv4: `197.242.67.121`; roles: dns-answer, network-endpoint\n- ipv4: `197.97.195.226`; roles: dns-answer, network-endpoint\n- ipv4: `198.136.61.225`; roles: dns-answer, network-endpoint\n- ipv4: `198.50.182.64`; roles: dns-answer, network-endpoint\n- ipv4: `2.222.167.138`; roles: network-endpoint\n- ipv4: `20.140.56.70`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.12`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.7`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.157.11`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.4.251`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.4.116`; roles: dns-answer\n- ipv4: `20.44.10.123`; roles: dns-answer, network-endpoint\n- ipv4: `20.50.80.210`; roles: dns-answer, network-endpoint\n- ipv4: `20.69.137.228`; roles: dns-answer, network-endpoint\n- ipv4: `20.83.81.162`; roles: dns-answer, network-endpoint\n- ipv4: `201.111.144.72`; roles: network-endpoint\n- ipv4: `201.137.10.225`; roles: network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.219`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.254`; roles: dns-answer, network-endpoint\n- ipv4: `207.246.112.221`; roles: network-endpoint\n- ipv4: `208.180.40.68`; roles: dns-answer, network-endpoint\n- ipv4: `208.68.106.6`; roles: dns-answer, network-endpoint\n- ipv4: `209.203.34.199`; roles: dns-answer, network-endpoint\n- ipv4: `209.210.95.228`; roles: network-endpoint\n- ipv4: `217.11.242.15`; roles: dns-answer, network-endpoint\n- ipv4: `217.11.242.6`; roles: dns-answer\n- ipv4: `217.11.242.81`; roles: dns-answer\n- ipv4: `217.116.0.228`; roles: dns-answer, network-endpoint\n- ipv4: `221.176.66.188`; roles: dns-answer, network-endpoint\n- ipv4: `223.29.248.111`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.111.114.52`; roles: network-endpoint\n- ipv4: `23.21.76.7`; roles: dns-answer, network-endpoint\n- ipv4: `23.222.241.43`; roles: dns-answer, network-endpoint\n- ipv4: `23.222.241.55`; roles: dns-answer\n- ipv4: `23.23.138.107`; roles: dns-answer\n- ipv4: `23.23.229.175`; roles: dns-answer\n- ipv4: `23.47.169.181`; roles: dns-answer, network-endpoint\n- ipv4: `23.47.50.172`; roles: dns-answer\n- ipv4: `23.47.50.180`; roles: dns-answer, network-endpoint\n- ipv4: `23.47.52.13`; roles: dns-answer, network-endpoint\n- ipv4: `23.47.52.19`; roles: dns-answer\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `24.231.209.2`; roles: network-endpoint\n- ipv4: `255.255.255.255`; roles: dns-answer, network-endpoint\n- ipv4: `26.85.198.164`; roles: dns-answer\n- ipv4: `31.193.50.122`; roles: dns-answer, network-endpoint\n- ipv4: `31.193.50.2`; roles: dns-answer\n- ipv4: `34.117.59.81`; roles: dns-answer, network-endpoint\n- ipv4: `34.120.119.232`; roles: dns-answer, network-endpoint\n- ipv4: `34.149.19.242`; roles: network-endpoint\n- ipv4: `34.193.71.224`; roles: dns-answer, network-endpoint\n- ipv4: `35.190.80.1`; roles: dns-answer, network-endpoint\n- ipv4: `37.0.10.22`; roles: dns-answer, network-endpoint\n- ipv4: `37.208.181.198`; roles: network-endpoint\n- ipv4: `37.252.0.102`; roles: network-endpoint\n- ipv4: `39.40.37.70`; roles: network-endpoint\n- ipv4: `40.112.72.205`; roles: dns-answer\n- ipv4: `40.113.200.201`; roles: dns-answer\n- ipv4: `40.126.28.11`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.12`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.13`; roles: dns-answer\n- ipv4: `40.126.28.14`; roles: dns-answer\n- ipv4: `40.126.28.18`; roles: dns-answer\n- ipv4: `40.126.28.19`; roles: dns-answer\n- ipv4: `40.126.28.20`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.21`; roles: dns-answer\n- ipv4: `40.126.28.22`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.23`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.10`; roles: dns-answer\n- ipv4: `40.126.29.11`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.12`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.13`; roles: dns-answer\n- ipv4: `40.126.29.14`; roles: dns-answer\n- ipv4: `40.126.29.15`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.5`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.7`; roles: dns-answer\n- ipv4: `40.126.29.8`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.9`; roles: dns-answer\n- ipv4: `40.126.7.32`; roles: dns-answer\n- ipv4: `40.126.7.35`; roles: dns-answer\n- ipv4: `40.76.4.15`; roles: dns-answer\n- ipv4: `40.90.64.59`; roles: dns-answer, network-endpoint\n- ipv4: `40.90.64.61`; roles: dns-answer, network-endpoint\n- ipv4: `40.90.64.98`; roles: dns-answer, network-endpoint\n- ipv4: `40.97.120.130`; roles: dns-answer\n- ipv4: `40.97.120.146`; roles: dns-answer, network-endpoint\n- ipv4: `40.97.120.178`; roles: dns-answer\n- ipv4: `40.97.120.194`; roles: dns-answer\n- ipv4: `40.97.120.210`; roles: dns-answer\n- ipv4: `40.97.120.226`; roles: dns-answer, network-endpoint\n- ipv4: `40.97.120.242`; roles: dns-answer, network-endpoint\n- ipv4: `40.97.120.50`; roles: dns-answer\n- ipv4: `40.97.120.66`; roles: dns-answer\n- ipv4: `40.97.121.18`; roles: dns-answer, network-endpoint\n- ipv4: `40.97.121.2`; roles: dns-answer\n- ipv4: `40.97.121.34`; roles: dns-answer\n- ipv4: `40.97.199.114`; roles: dns-answer, network-endpoint\n- ipv4: `40.97.212.18`; roles: dns-answer\n- ipv4: `40.97.212.2`; roles: dns-answer, network-endpoint\n- ipv4: `40.97.92.34`; roles: dns-answer\n- ipv4: `40.97.96.2`; roles: dns-answer\n- ipv4: `41.86.105.101`; roles: dns-answer, network-endpoint\n- ipv4: `45.153.241.142`; roles: network-endpoint\n- ipv4: `45.33.53.153`; roles: dns-answer\n- ipv4: `45.46.53.140`; roles: network-endpoint\n- ipv4: `45.79.114.202`; roles: dns-answer\n- ipv4: `45.79.170.99`; roles: dns-answer\n- ipv4: `45.79.71.155`; roles: dns-answer\n- ipv4: `47.151.181.188`; roles: network-endpoint\n- ipv4: `47.22.148.6`; roles: network-endpoint\n- ipv4: `47.40.196.233`; roles: network-endpoint\n- ipv4: `50.16.216.118`; roles: dns-answer\n- ipv4: `50.16.235.219`; roles: dns-answer\n- ipv4: `50.16.239.65`; roles: dns-answer\n- ipv4: `50.17.218.95`; roles: dns-answer, network-endpoint\n- ipv4: `50.17.226.156`; roles: dns-answer\n- ipv4: `50.19.104.221`; roles: dns-answer\n- ipv4: `50.19.250.64`; roles: dns-answer\n- ipv4: `50.19.81.52`; roles: dns-answer\n- ipv4: `50.19.92.180`; roles: dns-answer\n- ipv4: `50.194.160.233`; roles: network-endpoint\n- ipv4: `50.77.156.245`; roles: dns-answer, network-endpoint\n- ipv4: `51.132.193.105`; roles: dns-answer, network-endpoint\n- ipv4: `51.158.108.203`; roles: network-endpoint\n- ipv4: `52.109.2.1`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.76.31`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.76.32`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.20`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.196.254`; roles: dns-answer, network-endpoint\n- ipv4: `52.152.108.96`; roles: dns-answer, network-endpoint\n- ipv4: `52.178.17.3`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.210`; roles: dns-answer, network-endpoint\n- ipv4: `52.183.220.149`; roles: dns-answer, network-endpoint\n- ipv4: `52.185.211.133`; roles: dns-answer, network-endpoint\n- ipv4: `52.232.226.150`; roles: dns-answer, network-endpoint\n- ipv4: `52.242.97.97`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.10.242`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.103.18`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.103.2`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.103.34`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.121.114`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.121.130`; roles: dns-answer\n- ipv4: `52.96.121.146`; roles: dns-answer\n- ipv4: `52.96.121.162`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.121.178`; roles: dns-answer\n- ipv4: `52.96.121.194`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.121.210`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.121.242`; roles: dns-answer\n- ipv4: `52.96.121.98`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.122.226`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.122.242`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.122.98`; roles: dns-answer\n- ipv4: `52.96.16.162`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.191.114`; roles: dns-answer\n- ipv4: `52.96.191.98`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.22.178`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.22.2`; roles: dns-answer\n- ipv4: `52.96.55.242`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.57.18`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.57.2`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.57.34`; roles: dns-answer\n- ipv4: `52.96.57.50`; roles: dns-answer\n- ipv4: `52.96.57.66`; roles: dns-answer\n- ipv4: `52.96.57.82`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.57.98`; roles: dns-answer\n- ipv4: `52.96.8.130`; roles: dns-answer\n- ipv4: `52.96.90.18`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.91.66`; roles: dns-answer, network-endpoint\n- ipv4: `54.243.250.193`; roles: dns-answer, network-endpoint\n- ipv4: `54.243.253.71`; roles: dns-answer\n- ipv4: `54.243.29.214`; roles: dns-answer, network-endpoint\n- ipv4: `54.243.41.12`; roles: dns-answer\n- ipv4: `54.243.51.135`; roles: dns-answer\n- ipv4: `60.241.142.83`; roles: dns-answer\n- ipv4: `62.103.147.201`; roles: dns-answer, network-endpoint\n- ipv4: `62.149.128.200`; roles: dns-answer\n- ipv4: `62.149.128.201`; roles: dns-answer\n- ipv4: `62.149.128.202`; roles: dns-answer\n- ipv4: `62.149.128.203`; roles: dns-answer, network-endpoint\n- ipv4: `64.136.44.45`; roles: dns-answer\n- ipv4: `64.136.44.50`; roles: dns-answer\n- ipv4: `64.136.52.45`; roles: dns-answer, network-endpoint\n- ipv4: `64.136.52.50`; roles: dns-answer, network-endpoint\n- ipv4: `64.29.151.102`; roles: dns-answer, network-endpoint\n- ipv4: `64.87.23.16`; roles: dns-answer, network-endpoint\n- ipv4: `64.98.36.176`; roles: dns-answer, network-endpoint\n- ipv4: `65.111.191.196`; roles: dns-answer, network-endpoint\n- ipv4: `65.254.248.195`; roles: dns-answer, network-endpoint\n- ipv4: `66.163.170.35`; roles: dns-answer\n- ipv4: `66.218.88.149`; roles: dns-answer, network-endpoint\n- ipv4: `66.218.88.150`; roles: dns-answer\n- ipv4: `66.218.88.152`; roles: dns-answer\n- ipv4: `66.218.88.154`; roles: dns-answer\n- ipv4: `66.218.88.155`; roles: dns-answer\n- ipv4: `66.218.88.157`; roles: dns-answer\n- ipv4: `66.218.88.158`; roles: dns-answer\n- ipv4: `66.228.43.14`; roles: dns-answer, network-endpoint\n- ipv4: `66.96.147.96`; roles: dns-answer, network-endpoint\n- ipv4: `66.96.162.198`; roles: dns-answer, network-endpoint\n- ipv4: `68.186.192.69`; roles: network-endpoint\n- ipv4: `68.204.7.158`; roles: network-endpoint\n- ipv4: `70.39.150.220`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `72.247.207.22`; roles: dns-answer, network-endpoint\n- ipv4: `72.252.201.69`; roles: network-endpoint\n- ipv4: `73.230.205.91`; roles: network-endpoint\n- ipv4: `73.52.50.32`; roles: network-endpoint\n- ipv4: `73.77.87.137`; roles: network-endpoint\n- ipv4: `74.202.142.20`; roles: dns-answer, network-endpoint\n- ipv4: `8.248.163.254`; roles: dns-answer, network-endpoint\n- ipv4: `8.249.123.254`; roles: dns-answer\n- ipv4: `8.249.219.254`; roles: dns-answer\n- ipv4: `8.249.239.254`; roles: dns-answer\n- ipv4: `8.249.245.254`; roles: dns-answer, network-endpoint\n- ipv4: `8.253.131.120`; roles: dns-answer\n- ipv4: `8.253.156.120`; roles: dns-answer, network-endpoint\n- ipv4: `8.253.45.214`; roles: dns-answer\n- ipv4: `8.8.8.8`; roles: network-endpoint\n- ipv4: `80.6.192.58`; roles: network-endpoint\n- ipv4: `81.2.195.204`; roles: dns-answer, network-endpoint\n- ipv4: `81.241.252.59`; roles: network-endpoint\n- ipv4: `81.31.145.212`; roles: dns-answer\n- ipv4: `81.31.145.216`; roles: dns-answer, network-endpoint\n- ipv4: `82.98.154.100`; roles: dns-answer, network-endpoint\n- ipv4: `83.223.99.191`; roles: dns-answer, network-endpoint\n- ipv4: `83.243.251.46`; roles: network-endpoint\n- ipv4: `85.13.132.2`; roles: dns-answer, network-endpoint\n- ipv4: `86.8.177.143`; roles: network-endpoint\n- ipv4: `89.137.52.44`; roles: network-endpoint\n- ipv4: `9.241.189.20`; roles: dns-answer\n- ipv4: `94.143.155.83`; roles: dns-answer, network-endpoint\n- ipv4: `94.200.181.154`; roles: network-endpoint\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `29a54baac595d45c6a62225f7cde467b`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `51c64c77e60f3980eea90869b68c58a8`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `89be98bbd4f065fe510fca4893cf8d9b`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- ja3: `cd08e31494f9531f560d64c695473da9`; roles: tls-client-fingerprint\n- ja3: `df669e7ea913f1ac0c0cce9a201a2ec1`; roles: tls-client-fingerprint\n- sha256: `11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1`; roles: exported-object\n- sha256: `17c18c10640debcfd5b5f61f07b12d7327809410c3a90f7cd69f21fb869554ea`; roles: exported-object\n- sha256: `95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d`; roles: exported-object\n- sha256: `c8da41ae6e70a1997020d6c903d2627a3ee35383159cd04de53e73ff3f5acd82`; roles: exported-object\n- url: `http://178.23.190.8/44491.6090605324.dat`; roles: http-request\n- url: `http://190.14.37.244/44491.6090605324.dat`; roles: http-request\n- url: `http://194.36.191.35/44491.6090605324.dat`; roles: http-request\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?29290d2fe073e937`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c6f9855cb9e658e6`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?069916a09ccd9a98`; roles: http-request\n- exported object `44491.6090605324(1).dat`; SHA-256 `95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d`; size 911360 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `main.php`; SHA-256 `11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1`; size 337420 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `index.php`; SHA-256 `c8da41ae6e70a1997020d6c903d2627a3ee35383159cd04de53e73ff3f5acd82`; size 183 bytes\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"downloadfile\",\"feature\":\"powershell-download\",\"offset\":83}],\"inspected_bytes\":183,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `click-1225267-10537174-1463076242000%3fsid=552795f4335011ec81850e774cf9d6690INT`; SHA-256 `17c18c10640debcfd5b5f61f07b12d7327809410c3a90f7cd69f21fb869554ea`; size 577 bytes\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `5222f776b8c48e86a0c8622f8a6c5757c219009df704244b52c91467fdafc237`; recorded 2026-09-19T12:10:24.874416+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":512,\"observable_limit\":5000,\"observables_checked\":512,\"observables_total\":512,\"prior_case_limit_reached\":false,\"prior_cases_checked\":14,\"truncated\":false}`\n\n- Prior analysis `96e0e828-93ae-49d5-8104-9f14cb584c3e` shares 31 observations. This does not establish a common campaign.\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 25 observations. This does not establish a common campaign.\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 69 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 27 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 30 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 27 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 22 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 22 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 43 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 24 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 34 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 43 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":4,\"exported_objects\":6,\"hashed_bytes\":3072260,\"hashed_objects\":6,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":4,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":4}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 37/37, identities 14/14, observables 500/512, artifacts 4/4. Full returned inventory is in the JSON result.\n", "summary": "Decoded 84542 packets across 216 IP endpoints and 2746 transport flows. Observed 2061 DNS events, 120 HTTP requests, 409 TLS ClientHello events, and 4 exported HTTP object(s). Deterministic rules produced 37 finding(s): 0 high, 13 medium, and 24 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "observables": [ { "type": "domain", "value": "112.146.66.173.in-addr.arpa", "confidence": 1, "description": "dns-query; frame 31724 / UDP stream 545, frame 31727 / UDP stream 545, frame 31728 / UDP stream 545" }, { "type": "domain", "value": "22.22.10.10.in-addr.arpa", "confidence": 1, "description": "dns-query; frame 26197 / UDP stream 508, frame 26198 / UDP stream 508" }, { "type": "domain", "value": "a-9999.dc-msedge.net", "confidence": 1, "description": "dns-cname; frame 2971 / UDP stream 125" }, { "type": "domain", "value": "a-ring-fallback.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 2959 / UDP stream 125, frame 2971 / UDP stream 125, frame 3002 / TCP stream 142" }, { "type": "domain", "value": "a-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 4559 / UDP stream 161, frame 4631 / UDP stream 161, frame 4707 / TCP stream 207" }, { "type": "domain", "value": "a.nel.cloudflare.com", "confidence": 1, "description": "dns-query, tls-sni; frame 6394 / UDP stream 193, frame 6395 / UDP stream 193, frame 6400 / TCP stream 243" }, { "type": "domain", "value": "a1449.dscg2.akamai.net", "confidence": 1, "description": "dns-cname; frame 5439 / UDP stream 177" }, { "type": "domain", "value": "activity-geo.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 3185 / UDP stream 130, frame 3805 / UDP stream 141, frame 5112 / UDP stream 170" }, { "type": "domain", "value": "activity.windows.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3164 / UDP stream 130, frame 3185 / UDP stream 130, frame 3804 / UDP stream 141, frame 3805 / UDP stream 141, frame 5111 / UDP stream 170 +5 more" }, { "type": "domain", "value": "api.ipify.org", "confidence": 1, "description": "dns-query, tls-sni; frame 42927 / UDP stream 550, frame 42928 / UDP stream 550, frame 42929 / UDP stream 550, frame 44310 / UDP stream 562, frame 44311 / UDP stream 562 +15 more" }, { "type": "domain", "value": "api.msn.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2901 / UDP stream 118, frame 2902 / UDP stream 118, frame 3631 / UDP stream 137, frame 3632 / UDP stream 137, frame 4399 / UDP stream 152 +7 more" }, { "type": "domain", "value": "aqsouhyw.bazar", "confidence": 1, "description": "dns-query; frame 11572 / UDP stream 256, frame 11573 / UDP stream 256, frame 23266 / UDP stream 407, frame 23269 / UDP stream 407" }, { "type": "domain", "value": "av.dial-up.net", "confidence": 1, "description": "dns-query; frame 65025 / UDP stream 827, frame 65027 / UDP stream 827, frame 65028 / UDP stream 827, frame 83360 / UDP stream 1066, frame 83362 / UDP stream 1066 +1 more" }, { "type": "domain", "value": "b-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 4453 / UDP stream 155, frame 4462 / UDP stream 155, frame 4487 / TCP stream 200" }, { "type": "domain", "value": "bing.com", "confidence": 1, "description": "dns-query, tls-sni; frame 16326 / UDP stream 294, frame 16327 / UDP stream 294, frame 16328 / UDP stream 294, frame 72054 / UDP stream 955, frame 72060 / UDP stream 955 +12 more" }, { "type": "domain", "value": "bluehail.bazar", "confidence": 1, "description": "dns-query; frame 11568 / UDP stream 254, frame 11569 / UDP stream 254, frame 19687 / UDP stream 335, frame 19688 / UDP stream 335, frame 22460 / UDP stream 355 +3 more" }, { "type": "domain", "value": "c-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 2945 / UDP stream 121, frame 2957 / UDP stream 121, frame 2968 / TCP stream 139" }, { "type": "domain", "value": "calacatta.com", "confidence": 1, "description": "dns-cname; frame 11093 / UDP stream 234" }, { "type": "domain", "value": "cj.dotomi.com", "confidence": 1, "description": "dns-query, tls-sni; frame 80449 / UDP stream 1034, frame 80450 / UDP stream 1034, frame 80451 / UDP stream 1034, frame 80457 / TCP stream 1584" }, { "type": "domain", "value": "client.wns.windows.com", "confidence": 1, "description": "dns-query, tls-sni; frame 2847 / UDP stream 116, frame 2851 / UDP stream 116, frame 3575 / UDP stream 135, frame 3576 / UDP stream 135, frame 4356 / UDP stream 151 +4 more" }, { "type": "domain", "value": "config.edge.skype.com", "confidence": 1, "description": "dns-query, tls-sni; frame 6220 / UDP stream 187, frame 6221 / UDP stream 187, frame 6231 / TCP stream 239" }, { "type": "domain", "value": "continuum.dds.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3051 / UDP stream 128, frame 3052 / UDP stream 128, frame 3667 / UDP stream 139, frame 3668 / UDP stream 139, frame 4813 / UDP stream 165 +4 more" }, { "type": "domain", "value": "cs-geo-dds.trafficmanager.net", "confidence": 1, "description": "dns-cname; frame 3052 / UDP stream 128, frame 3668 / UDP stream 139, frame 4817 / UDP stream 165" }, { "type": "domain", "value": "ctldl.windowsupdate.com", "confidence": 1, "description": "dns-query, http-host; frame 4878 / UDP stream 167, frame 4991 / UDP stream 167, frame 5388 / UDP stream 176, frame 5389 / UDP stream 176, frame 15933 / UDP stream 283 +15 more" }, { "type": "domain", "value": "desktop-87wce26.enemywatch.net", "confidence": 1, "description": "dns-query; frame 2311 / UDP stream 100, frame 2312 / UDP stream 100, frame 17944 / UDP stream 331, frame 17945 / UDP stream 331, frame 25085 / UDP stream 496 +9 more" }, { "type": "domain", "value": "desktop-cfa3367.enemywatch.net", "confidence": 1, "description": "dns-query; frame 17862 / UDP stream 324, frame 17863 / UDP stream 324, frame 24787 / UDP stream 491, frame 24790 / UDP stream 491, frame 56013 / UDP stream 352 +7 more" }, { "type": "domain", "value": "desktop-nz875r4.enemywatch.net", "confidence": 1, "description": "dns-query; frame 17592 / UDP stream 313, frame 17593 / UDP stream 313, frame 24585 / UDP stream 481, frame 24587 / UDP stream 481, frame 55651 / UDP stream 686 +7 more" }, { "type": "domain", "value": "dns.msftncsi.com", "confidence": 1, "description": "dns-query; frame 36 / UDP stream 9, frame 37 / UDP stream 9, frame 828 / UDP stream 45, frame 829 / UDP stream 45, frame 1722 / UDP stream 85 +15 more" }, { "type": "domain", "value": "eafddirect.msedge.net", "confidence": 1, "description": "dns-query; frame 2927 / UDP stream 120, frame 2929 / UDP stream 120" }, { "type": "domain", "value": "edge.activity.windows.com", "confidence": 1, "description": "dns-query, tls-sni; frame 6264 / UDP stream 190, frame 6282 / UDP stream 190, frame 6294 / TCP stream 242" }, { "type": "domain", "value": "edge.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 6223 / UDP stream 189, frame 6224 / UDP stream 189, frame 6233 / TCP stream 240, frame 6448 / TCP stream 244" }, { "type": "domain", "value": "enemywatch-dc.enemywatch.net", "confidence": 1, "description": "dns-query; frame 17 / UDP stream 5, frame 18 / UDP stream 5, frame 340 / UDP stream 23, frame 341 / UDP stream 23, frame 793 / UDP stream 37 +13 more" }, { "type": "domain", "value": "enemywatch.net", "confidence": 1, "description": "dns-query; frame 2313 / UDP stream 101, frame 2314 / UDP stream 101, frame 2630 / UDP stream 114, frame 2631 / UDP stream 114, frame 3398 / UDP stream 134 +15 more" }, { "type": "domain", "value": "fe2cr.update.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 11163 / UDP stream 237, frame 11164 / UDP stream 237, frame 11619 / UDP stream 259, frame 11620 / UDP stream 259, frame 11621 / UDP stream 259 +5 more" }, { "type": "domain", "value": "fe2cr.update.microsoft.com.akadns.net", "confidence": 1, "description": "dns-cname; frame 11164 / UDP stream 237, frame 11621 / UDP stream 259, frame 13322 / UDP stream 271" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 11311 / UDP stream 240, frame 11315 / UDP stream 240, frame 11332 / UDP stream 240, frame 11350 / UDP stream 240, frame 11776 / UDP stream 262 +6 more" }, { "type": "domain", "value": "fp-afd.azurefd.us", "confidence": 1, "description": "dns-query, tls-sni; frame 4585 / UDP stream 164, frame 4651 / UDP stream 164, frame 4718 / TCP stream 209" }, { "type": "domain", "value": "fp-as.azureedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 4445 / UDP stream 154, frame 4460 / UDP stream 154, frame 4470 / TCP stream 199" }, { "type": "domain", "value": "fp-vs-nocache.azureedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 4477 / UDP stream 159, frame 4478 / UDP stream 159, frame 4545 / TCP stream 201" }, { "type": "domain", "value": "grtovxn.enemywatch.net", "confidence": 1, "description": "dns-query; frame 6484 / UDP stream 196, frame 6486 / UDP stream 196, frame 6545 / UDP stream 208, frame 6546 / UDP stream 208" }, { "type": "domain", "value": "grtovxn.localdomain", "confidence": 1, "description": "dns-query; frame 6488 / UDP stream 198, frame 6497 / UDP stream 198, frame 6513 / UDP stream 198, frame 6522 / UDP stream 198, frame 6550 / UDP stream 209 +1 more" }, { "type": "domain", "value": "hzmx01.mxmail.netease.com", "confidence": 1, "description": "dns-query, tls-sni; frame 74767 / UDP stream 969, frame 74769 / UDP stream 969, frame 74770 / UDP stream 969, frame 74798 / TCP stream 1489" }, { "type": "domain", "value": "imap.gmail.com", "confidence": 1, "description": "dns-query; frame 44498 / UDP stream 564, frame 44499 / UDP stream 564, frame 44500 / UDP stream 564, frame 51449 / UDP stream 661, frame 51450 / UDP stream 661 +1 more" }, { "type": "domain", "value": "img-prod-cms-rt-microsoft-com.akamaized.net", "confidence": 1, "description": "dns-query, tls-sni; frame 5438 / UDP stream 177, frame 5439 / UDP stream 177, frame 5443 / TCP stream 228" }, { "type": "domain", "value": "inbound.att.net", "confidence": 1, "description": "dns-query; frame 49366 / UDP stream 639, frame 49367 / UDP stream 639, frame 49369 / UDP stream 639" }, { "type": "domain", "value": "k-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 2970 / UDP stream 126, frame 2973 / UDP stream 126, frame 4474 / UDP stream 156, frame 4483 / UDP stream 156, frame 2996 / TCP stream 141 +1 more" }, { "type": "domain", "value": "kamuchehddhgfgf.ddns.net", "confidence": 1, "description": "dns-query; frame 5642 / UDP stream 181, frame 5643 / UDP stream 181, frame 11082 / UDP stream 233, frame 11083 / UDP stream 233, frame 11095 / UDP stream 235 +15 more" }, { "type": "domain", "value": "l-0005.dc-msedge.net", "confidence": 1, "description": "dns-cname; frame 4540 / UDP stream 158" }, { "type": "domain", "value": "l-ring.msedge.net", "confidence": 1, "description": "dns-query, tls-sni; frame 4475 / UDP stream 157, frame 4482 / UDP stream 157, frame 4543 / TCP stream 202" }, { "type": "domain", "value": "login.live.com", "confidence": 1, "description": "dns-query, tls-sni; frame 3060 / UDP stream 129, frame 3070 / UDP stream 129, frame 3670 / UDP stream 140, frame 3671 / UDP stream 140, frame 4816 / UDP stream 166 +12 more" }, { "type": "domain", "value": "login.microsoftonline.com", "confidence": 1, "description": "dns-query, tls-sni; frame 7216 / UDP stream 216, frame 7217 / UDP stream 216, frame 26150 / UDP stream 505, frame 26151 / UDP stream 505, frame 29179 / UDP stream 516 +15 more" }, { "type": "domain", "value": "mail.abchk.net", "confidence": 1, "description": "dns-query, tls-sni; frame 80874 / UDP stream 1043, frame 80882 / UDP stream 1043, frame 80885 / UDP stream 1043, frame 80916 / TCP stream 1600" }, { "type": "domain", "value": "mail.ajeel.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 71444 / UDP stream 944, frame 71446 / UDP stream 944, frame 71451 / UDP stream 944, frame 71457 / UDP stream 944, frame 71458 / UDP stream 944 +1 more" }, { "type": "domain", "value": "mail.akinao-lab.com", "confidence": 1, "description": "dns-query, tls-sni; frame 54427 / UDP stream 677, frame 54428 / UDP stream 677, frame 54431 / UDP stream 677, frame 54485 / TCP stream 979" }, { "type": "domain", "value": "mail.anberman.es", "confidence": 1, "description": "dns-query, tls-sni; frame 50906 / UDP stream 648, frame 50909 / UDP stream 648, frame 50913 / UDP stream 648, frame 75740 / UDP stream 987, frame 75742 / UDP stream 987 +3 more" }, { "type": "domain", "value": "mail.atelierscalin.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 77263 / UDP stream 1017, frame 77267 / UDP stream 1017, frame 77268 / UDP stream 1017, frame 77316 / TCP stream 1563" }, { "type": "domain", "value": "mail.austinjournls.com", "confidence": 1, "description": "dns-query; frame 55418 / UDP stream 683, frame 55419 / UDP stream 683, frame 55422 / UDP stream 683, frame 55427 / UDP stream 683, frame 55440 / UDP stream 683 +15 more" }, { "type": "domain", "value": "mail.be-daventure.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 82936 / UDP stream 1060, frame 82938 / UDP stream 1060, frame 82939 / UDP stream 1060, frame 82970 / TCP stream 1628" }, { "type": "domain", "value": "mail.bethnet.co.za", "confidence": 1, "description": "dns-query, tls-sni; frame 56651 / UDP stream 705, frame 56652 / UDP stream 705, frame 56655 / UDP stream 705, frame 56947 / TCP stream 1046, frame 57138 / TCP stream 1050 +4 more" }, { "type": "domain", "value": "mail.brins-d-eveil.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 61170 / UDP stream 777, frame 61172 / UDP stream 777, frame 61174 / UDP stream 777, frame 81548 / UDP stream 1052, frame 81550 / UDP stream 1052 +6 more" }, { "type": "domain", "value": "mail.burgers.cc", "confidence": 1, "description": "dns-query; frame 73614 / UDP stream 961, frame 73619 / UDP stream 961, frame 73621 / UDP stream 961" }, { "type": "domain", "value": "mail.chokshiandchokshi.in", "confidence": 1, "description": "dns-query; frame 69986 / UDP stream 936, frame 69988 / UDP stream 936" }, { "type": "domain", "value": "mail.come-paris.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 57935 / UDP stream 718, frame 57938 / UDP stream 718, frame 57939 / UDP stream 718, frame 57975 / TCP stream 1075, frame 58833 / TCP stream 1105" }, { "type": "domain", "value": "mail.corteo.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 59508 / UDP stream 744, frame 59510 / UDP stream 744, frame 59513 / UDP stream 744, frame 59553 / TCP stream 1133, frame 60152 / TCP stream 1162" }, { "type": "domain", "value": "mail.csnert.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 69524 / UDP stream 932, frame 69526 / UDP stream 932, frame 69531 / UDP stream 932, frame 69588 / TCP stream 1448" }, { "type": "domain", "value": "mail.debtmend.co.za", "confidence": 1, "description": "dns-query, tls-sni; frame 53946 / UDP stream 674, frame 53947 / UDP stream 674, frame 53950 / UDP stream 674, frame 53954 / UDP stream 674, frame 53956 / UDP stream 674 +1 more" }, { "type": "domain", "value": "mail.doctor-healthcare.com", "confidence": 1, "description": "dns-query, tls-sni; frame 82993 / UDP stream 1061, frame 82995 / UDP stream 1061, frame 82998 / UDP stream 1061, frame 83101 / TCP stream 1629, frame 83606 / TCP stream 1635" }, { "type": "domain", "value": "mail.eolas.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 58161 / UDP stream 721, frame 58163 / UDP stream 721, frame 58164 / UDP stream 721, frame 58217 / TCP stream 1081, frame 58561 / TCP stream 1092 +3 more" }, { "type": "domain", "value": "mail.goldmarkconsultants.com", "confidence": 1, "description": "dns-query; frame 55891 / UDP stream 691, frame 55893 / UDP stream 691, frame 55894 / UDP stream 691" }, { "type": "domain", "value": "mail.hrctunisia.com", "confidence": 1, "description": "dns-query, tls-sni; frame 69206 / UDP stream 925, frame 69208 / UDP stream 925, frame 69209 / UDP stream 925, frame 69241 / TCP stream 1437" }, { "type": "domain", "value": "mail.ipage.com", "confidence": 1, "description": "dns-query, tls-sni; frame 64868 / UDP stream 826, frame 64869 / UDP stream 826, frame 64898 / TCP stream 1277" }, { "type": "domain", "value": "mail.isoldry.com", "confidence": 1, "description": "dns-query, tls-sni; frame 49389 / UDP stream 640, frame 49390 / UDP stream 640, frame 49394 / UDP stream 640, frame 72037 / UDP stream 954, frame 72038 / UDP stream 954 +2 more" }, { "type": "domain", "value": "mail.kalivet.com", "confidence": 1, "description": "dns-query, tls-sni; frame 77125 / UDP stream 1016, frame 77127 / UDP stream 1016, frame 77128 / UDP stream 1016, frame 77157 / TCP stream 1561" }, { "type": "domain", "value": "mail.kbcrawl.net", "confidence": 1, "description": "dns-query, tls-sni; frame 51818 / UDP stream 673, frame 51819 / UDP stream 673, frame 51821 / UDP stream 673, frame 75109 / UDP stream 978, frame 75111 / UDP stream 978 +4 more" }, { "type": "domain", "value": "mail.lecmg.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 55847 / UDP stream 690, frame 55849 / UDP stream 690, frame 55850 / UDP stream 690, frame 76828 / UDP stream 1015, frame 76829 / UDP stream 1015 +3 more" }, { "type": "domain", "value": "mail.loosefoot.com", "confidence": 1, "description": "dns-query; frame 51635 / UDP stream 667, frame 51636 / UDP stream 667, frame 51639 / UDP stream 667" }, { "type": "domain", "value": "mail.ma-communication.com", "confidence": 1, "description": "dns-query, tls-sni; frame 83417 / UDP stream 1067, frame 83419 / UDP stream 1067, frame 83422 / UDP stream 1067, frame 83469 / TCP stream 1634, frame 83847 / TCP stream 1646" }, { "type": "domain", "value": "mail.maclen.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 61176 / UDP stream 778, frame 61177 / UDP stream 778, frame 61182 / UDP stream 778, frame 61262 / TCP stream 1250, frame 61447 / TCP stream 1256 +1 more" }, { "type": "domain", "value": "mail.microvistatech.com", "confidence": 1, "description": "dns-query, tls-sni; frame 64418 / UDP stream 823, frame 64420 / UDP stream 823, frame 64421 / UDP stream 823, frame 64451 / TCP stream 1273" }, { "type": "domain", "value": "mail.monquartier.com.br", "confidence": 1, "description": "dns-query; frame 68533 / UDP stream 909, frame 68535 / UDP stream 909, frame 68538 / UDP stream 909" }, { "type": "domain", "value": "mail.myfairpoint.net", "confidence": 1, "description": "dns-query; frame 43091 / UDP stream 553, frame 43093 / UDP stream 553, frame 43096 / UDP stream 553, frame 51409 / UDP stream 660, frame 51410 / UDP stream 660 +1 more" }, { "type": "domain", "value": "mail.nazarioconstruction.com", "confidence": 1, "description": "dns-query, tls-sni; frame 54177 / UDP stream 675, frame 54179 / UDP stream 675, frame 54181 / UDP stream 675, frame 54231 / TCP stream 976" }, { "type": "domain", "value": "mail.otenet.gr", "confidence": 1, "description": "dns-query, tls-sni; frame 84137 / UDP stream 1083, frame 84140 / UDP stream 1083, frame 84192 / TCP stream 1651" }, { "type": "domain", "value": "mail.pangia.biz", "confidence": 1, "description": "dns-query, tls-sni; frame 68957 / UDP stream 919, frame 68959 / UDP stream 919, frame 69006 / TCP stream 1428" }, { "type": "domain", "value": "mail.perpetualplaques.com", "confidence": 1, "description": "dns-query, tls-sni; frame 68095 / UDP stream 892, frame 68097 / UDP stream 892, frame 68098 / UDP stream 892, frame 68131 / TCP stream 1379" }, { "type": "domain", "value": "mail.ptolemee.com", "confidence": 1, "description": "dns-query, tls-sni; frame 58938 / UDP stream 735, frame 58944 / UDP stream 735, frame 58946 / UDP stream 735, frame 59241 / TCP stream 1111" }, { "type": "domain", "value": "mail.qualityms.com.mx", "confidence": 1, "description": "dns-query, tls-sni; frame 51117 / UDP stream 658, frame 51118 / UDP stream 658, frame 51120 / UDP stream 658, frame 51375 / TCP stream 948" }, { "type": "domain", "value": "mail.smtp2go.com", "confidence": 1, "description": "dns-query; frame 44492 / UDP stream 563, frame 44494 / UDP stream 563, frame 44496 / UDP stream 563, frame 51513 / UDP stream 664, frame 51514 / UDP stream 664 +1 more" }, { "type": "domain", "value": "mail.songazine.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 60180 / UDP stream 759, frame 60182 / UDP stream 759, frame 60185 / UDP stream 759, frame 60266 / TCP stream 1166" }, { "type": "domain", "value": "mail.tcgasociados.com", "confidence": 1, "description": "dns-query, tls-sni; frame 74552 / UDP stream 963, frame 74554 / UDP stream 963, frame 74555 / UDP stream 963, frame 74583 / TCP stream 1486" }, { "type": "domain", "value": "mail.tecsindia.com", "confidence": 1, "description": "dns-query; frame 65453 / UDP stream 830, frame 65454 / UDP stream 830, frame 65457 / UDP stream 830" }, { "type": "domain", "value": "mail.tetranergy.com", "confidence": 1, "description": "dns-query, tls-sni; frame 45308 / UDP stream 573, frame 45309 / UDP stream 573, frame 45316 / UDP stream 573, frame 45323 / UDP stream 573, frame 45328 / UDP stream 573 +1 more" }, { "type": "domain", "value": "mail.tiretracksusa.com", "confidence": 1, "description": "dns-query; frame 81369 / UDP stream 1049, frame 81371 / UDP stream 1049" }, { "type": "domain", "value": "mail.verificalitas.es", "confidence": 1, "description": "dns-query, tls-sni; frame 83016 / UDP stream 1062, frame 83018 / UDP stream 1062, frame 83021 / UDP stream 1062, frame 83089 / TCP stream 1630" }, { "type": "domain", "value": "mail.verificalitasoca.es", "confidence": 1, "description": "dns-query, tls-sni; frame 67618 / UDP stream 877, frame 67624 / UDP stream 877, frame 67626 / UDP stream 877, frame 67655 / TCP stream 1354" }, { "type": "domain", "value": "mail.xenium-partners.fr", "confidence": 1, "description": "dns-query, tls-sni; frame 56718 / UDP stream 707, frame 56720 / UDP stream 707, frame 56721 / UDP stream 707, frame 56777 / TCP stream 1045, frame 56834 / TCP stream 1047" }, { "type": "domain", "value": "mail.yourwebsitemail.com", "confidence": 1, "description": "dns-query, tls-sni; frame 79141 / UDP stream 1028, frame 79143 / UDP stream 1028, frame 79170 / TCP stream 1576" }, { "type": "domain", "value": "mail04.l4email.com", "confidence": 1, "description": "dns-query, tls-sni; frame 56145 / UDP stream 696, frame 56146 / UDP stream 696, frame 56147 / UDP stream 696, frame 56181 / TCP stream 1021" }, { "type": "domain", "value": "microsoft.com", "confidence": 1, "description": "dns-query, tls-sni; frame 17273 / UDP stream 297, frame 17274 / UDP stream 297, frame 17278 / TCP stream 350" }, { "type": "domain", "value": "moiazureorigin.clo.footprintdns.com", "confidence": 1, "description": "dns-query; frame 2972 / UDP stream 127, frame 3072 / UDP stream 127, frame 3200 / UDP stream 127, frame 3241 / UDP stream 127, frame 3242 / UDP stream 127" } ], "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap" ], "source_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455", "semantic_sha256": "e2a781b6839946af3b4581e8fbaa850bc68bbe393fce12f786178323e0ccd04d", "observable_count": 512, "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis", "source_analysis_ref": "/api/pcap/analyses/8f0da1cd-9998-4d41-9fc7-683302a6ee24", "suspicious_findings": [ { "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.", "category": "Repeated unsuccessful DNS resolution", "evidence": "frame 825 / UDP stream 43, frame 1639 / UDP stream 70, frame 2954 / UDP stream 123, frame 15029 / UDP stream 278, frame 17432 / UDP stream 302 +37 more", "severity": "low" }, { "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.", "category": "Repeated unsuccessful DNS resolution", "evidence": "frame 827 / UDP stream 44, frame 1641 / UDP stream 71, frame 2956 / UDP stream 124, frame 15031 / UDP stream 279, frame 17435 / UDP stream 303 +37 more", "severity": "low" }, { "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.", "category": "Repeated unsuccessful DNS resolution", "evidence": "frame 39 / UDP stream 10, frame 752 / UDP stream 32, frame 1643 / UDP stream 72, frame 11964 / UDP stream 264, frame 22840 / UDP stream 376 +7 more", "severity": "low" }, { "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.", "category": "Repeated unsuccessful DNS resolution", "evidence": "frame 41 / UDP stream 11, frame 754 / UDP stream 33, frame 1645 / UDP stream 73, frame 11966 / UDP stream 265, frame 22842 / UDP stream 377 +7 more", "severity": "low" }, { "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.", "category": "Repeated unsuccessful DNS resolution", "evidence": "frame 1719 / UDP stream 83, frame 2522 / UDP stream 110, frame 3813 / UDP stream 142, frame 6217 / UDP stream 185, frame 6501 / UDP stream 200 +11 more", "severity": "low" }, { "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.", "category": "Repeated unsuccessful DNS resolution", "evidence": "frame 1721 / UDP stream 84, frame 2524 / UDP stream 111, frame 3815 / UDP stream 143, frame 6219 / UDP stream 186, frame 6503 / UDP stream 201 +11 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 999 / TCP stream 46, frame 1001 / TCP stream 46, frame 1003 / TCP stream 46, frame 1013 / TCP stream 46, frame 1015 / TCP stream 46 +54 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 804 / TCP stream 37, frame 965 / TCP stream 37, frame 994 / TCP stream 37, frame 1062 / TCP stream 55, frame 1069 / TCP stream 55 +95 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 4249 / TCP stream 187, frame 4251 / TCP stream 187, frame 4253 / TCP stream 187, frame 4255 / TCP stream 187, frame 4257 / TCP stream 187 +10 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 127 / TCP stream 3, frame 131 / TCP stream 3, frame 134 / TCP stream 3, frame 145 / TCP stream 3, frame 147 / TCP stream 3 +44 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 27 / TCP stream 0, frame 91 / TCP stream 5, frame 120 / TCP stream 5, frame 129 / TCP stream 5, frame 133 / TCP stream 5 +87 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 3468 / TCP stream 157, frame 3470 / TCP stream 157, frame 3472 / TCP stream 157, frame 3474 / TCP stream 157, frame 3476 / TCP stream 157 +10 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 1951 / TCP stream 93, frame 1959 / TCP stream 93, frame 1963 / TCP stream 93, frame 1964 / TCP stream 86, frame 1968 / TCP stream 86 +48 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 1696 / TCP stream 79, frame 1776 / TCP stream 84, frame 1907 / TCP stream 79, frame 1938 / TCP stream 84, frame 1960 / TCP stream 84 +83 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 2699 / TCP stream 126, frame 2701 / TCP stream 126, frame 2703 / TCP stream 126, frame 2705 / TCP stream 126, frame 2708 / TCP stream 126 +38 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 1000 / TCP stream 46, frame 1002 / TCP stream 46, frame 1004 / TCP stream 46, frame 1014 / TCP stream 46, frame 1016 / TCP stream 46 +54 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 806 / TCP stream 37, frame 968 / TCP stream 37, frame 1064 / TCP stream 55, frame 1071 / TCP stream 55, frame 1073 / TCP stream 55 +77 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 4250 / TCP stream 187, frame 4252 / TCP stream 187, frame 4254 / TCP stream 187, frame 4256 / TCP stream 187, frame 4258 / TCP stream 187 +10 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 128 / TCP stream 3, frame 132 / TCP stream 3, frame 135 / TCP stream 3, frame 146 / TCP stream 3, frame 150 / TCP stream 3 +44 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 29 / TCP stream 0, frame 93 / TCP stream 5, frame 124 / TCP stream 5, frame 130 / TCP stream 5, frame 136 / TCP stream 5 +69 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 3469 / TCP stream 157, frame 3471 / TCP stream 157, frame 3473 / TCP stream 157, frame 3475 / TCP stream 157, frame 3477 / TCP stream 157 +10 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 1954 / TCP stream 93, frame 1961 / TCP stream 93, frame 1965 / TCP stream 93, frame 1966 / TCP stream 86, frame 1972 / TCP stream 86 +48 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 1698 / TCP stream 79, frame 1779 / TCP stream 84, frame 1925 / TCP stream 79, frame 1947 / TCP stream 84, frame 1962 / TCP stream 84 +66 more", "severity": "low" }, { "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.", "category": "Directory-service protocol activity", "evidence": "frame 2700 / TCP stream 126, frame 2702 / TCP stream 126, frame 2704 / TCP stream 126, frame 2706 / TCP stream 126, frame 2709 / TCP stream 126 +38 more", "severity": "low" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 5644 / TCP stream 232", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 17795 / TCP stream 391", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 24560 / TCP stream 691", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 42858 / TCP stream 810", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 51877 / TCP stream 968", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 61387 / TCP stream 1254", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 67512 / TCP stream 1346", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 67513 / TCP stream 1347", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 69549 / TCP stream 1450", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 74529 / TCP stream 1485", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 76852 / TCP stream 1559", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 81050 / TCP stream 1607", "severity": "medium" }, { "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.", "category": "Sustained external TCP conversation outside decoded application coverage", "evidence": "frame 83774 / TCP stream 1645", "severity": "medium" } ], "observables_truncated": true, "actor_similarity_leads": [], "expected_suspicious_behaviors": [] }, { "id": "ioc:112.146.66.173.in-addr.arpa", "type": "ioc", "value": "112.146.66.173.in-addr.arpa", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 31724 / UDP stream 545, frame 31727 / UDP stream 545, frame 31728 / UDP stream 545", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:22.22.10.10.in-addr.arpa", "type": "ioc", "value": "22.22.10.10.in-addr.arpa", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 26197 / UDP stream 508, frame 26198 / UDP stream 508", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a-9999.dc-msedge.net", "type": "ioc", "value": "a-9999.dc-msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-cname; frame 2971 / UDP stream 125", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a-ring-fallback.msedge.net", "type": "ioc", "value": "a-ring-fallback.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 2959 / UDP stream 125, frame 2971 / UDP stream 125, frame 3002 / TCP stream 142", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a-ring.msedge.net", "type": "ioc", "value": "a-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 4559 / UDP stream 161, frame 4631 / UDP stream 161, frame 4707 / TCP stream 207", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a.nel.cloudflare.com", "type": "ioc", "value": "a.nel.cloudflare.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 6394 / UDP stream 193, frame 6395 / UDP stream 193, frame 6400 / TCP stream 243", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:a1449.dscg2.akamai.net", "type": "ioc", "value": "a1449.dscg2.akamai.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-cname; frame 5439 / UDP stream 177", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:activity-geo.trafficmanager.net", "type": "ioc", "value": "activity-geo.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-cname; frame 3185 / UDP stream 130, frame 3805 / UDP stream 141, frame 5112 / UDP stream 170", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:activity.windows.com", "type": "ioc", "value": "activity.windows.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 3164 / UDP stream 130, frame 3185 / UDP stream 130, frame 3804 / UDP stream 141, frame 3805 / UDP stream 141, frame 5111 / UDP stream 170 +5 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:api.ipify.org", "type": "ioc", "value": "api.ipify.org", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 42927 / UDP stream 550, frame 42928 / UDP stream 550, frame 42929 / UDP stream 550, frame 44310 / UDP stream 562, frame 44311 / UDP stream 562 +15 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:api.msn.com", "type": "ioc", "value": "api.msn.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 2901 / UDP stream 118, frame 2902 / UDP stream 118, frame 3631 / UDP stream 137, frame 3632 / UDP stream 137, frame 4399 / UDP stream 152 +7 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:aqsouhyw.bazar", "type": "ioc", "value": "aqsouhyw.bazar", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 11572 / UDP stream 256, frame 11573 / UDP stream 256, frame 23266 / UDP stream 407, frame 23269 / UDP stream 407", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:av.dial-up.net", "type": "ioc", "value": "av.dial-up.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 65025 / UDP stream 827, frame 65027 / UDP stream 827, frame 65028 / UDP stream 827, frame 83360 / UDP stream 1066, frame 83362 / UDP stream 1066 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:b-ring.msedge.net", "type": "ioc", "value": "b-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 4453 / UDP stream 155, frame 4462 / UDP stream 155, frame 4487 / TCP stream 200", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:bing.com", "type": "ioc", "value": "bing.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 16326 / UDP stream 294, frame 16327 / UDP stream 294, frame 16328 / UDP stream 294, frame 72054 / UDP stream 955, frame 72060 / UDP stream 955 +12 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:bluehail.bazar", "type": "ioc", "value": "bluehail.bazar", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 11568 / UDP stream 254, frame 11569 / UDP stream 254, frame 19687 / UDP stream 335, frame 19688 / UDP stream 335, frame 22460 / UDP stream 355 +3 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:c-ring.msedge.net", "type": "ioc", "value": "c-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 2945 / UDP stream 121, frame 2957 / UDP stream 121, frame 2968 / TCP stream 139", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:calacatta.com", "type": "ioc", "value": "calacatta.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-cname; frame 11093 / UDP stream 234", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:cj.dotomi.com", "type": "ioc", "value": "cj.dotomi.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 80449 / UDP stream 1034, frame 80450 / UDP stream 1034, frame 80451 / UDP stream 1034, frame 80457 / TCP stream 1584", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:client.wns.windows.com", "type": "ioc", "value": "client.wns.windows.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 2847 / UDP stream 116, frame 2851 / UDP stream 116, frame 3575 / UDP stream 135, frame 3576 / UDP stream 135, frame 4356 / UDP stream 151 +4 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:config.edge.skype.com", "type": "ioc", "value": "config.edge.skype.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 6220 / UDP stream 187, frame 6221 / UDP stream 187, frame 6231 / TCP stream 239", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:continuum.dds.microsoft.com", "type": "ioc", "value": "continuum.dds.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 3051 / UDP stream 128, frame 3052 / UDP stream 128, frame 3667 / UDP stream 139, frame 3668 / UDP stream 139, frame 4813 / UDP stream 165 +4 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:cs-geo-dds.trafficmanager.net", "type": "ioc", "value": "cs-geo-dds.trafficmanager.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-cname; frame 3052 / UDP stream 128, frame 3668 / UDP stream 139, frame 4817 / UDP stream 165", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:ctldl.windowsupdate.com", "type": "ioc", "value": "ctldl.windowsupdate.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, http-host; frame 4878 / UDP stream 167, frame 4991 / UDP stream 167, frame 5388 / UDP stream 176, frame 5389 / UDP stream 176, frame 15933 / UDP stream 283 +15 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:desktop-87wce26.enemywatch.net", "type": "ioc", "value": "desktop-87wce26.enemywatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 2311 / UDP stream 100, frame 2312 / UDP stream 100, frame 17944 / UDP stream 331, frame 17945 / UDP stream 331, frame 25085 / UDP stream 496 +9 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:desktop-cfa3367.enemywatch.net", "type": "ioc", "value": "desktop-cfa3367.enemywatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 17862 / UDP stream 324, frame 17863 / UDP stream 324, frame 24787 / UDP stream 491, frame 24790 / UDP stream 491, frame 56013 / UDP stream 352 +7 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:desktop-nz875r4.enemywatch.net", "type": "ioc", "value": "desktop-nz875r4.enemywatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 17592 / UDP stream 313, frame 17593 / UDP stream 313, frame 24585 / UDP stream 481, frame 24587 / UDP stream 481, frame 55651 / UDP stream 686 +7 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:dns.msftncsi.com", "type": "ioc", "value": "dns.msftncsi.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 36 / UDP stream 9, frame 37 / UDP stream 9, frame 828 / UDP stream 45, frame 829 / UDP stream 45, frame 1722 / UDP stream 85 +15 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:eafddirect.msedge.net", "type": "ioc", "value": "eafddirect.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 2927 / UDP stream 120, frame 2929 / UDP stream 120", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:edge.activity.windows.com", "type": "ioc", "value": "edge.activity.windows.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 6264 / UDP stream 190, frame 6282 / UDP stream 190, frame 6294 / TCP stream 242", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:edge.microsoft.com", "type": "ioc", "value": "edge.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 6223 / UDP stream 189, frame 6224 / UDP stream 189, frame 6233 / TCP stream 240, frame 6448 / TCP stream 244", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:enemywatch-dc.enemywatch.net", "type": "ioc", "value": "enemywatch-dc.enemywatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 17 / UDP stream 5, frame 18 / UDP stream 5, frame 340 / UDP stream 23, frame 341 / UDP stream 23, frame 793 / UDP stream 37 +13 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:enemywatch.net", "type": "ioc", "value": "enemywatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 2313 / UDP stream 101, frame 2314 / UDP stream 101, frame 2630 / UDP stream 114, frame 2631 / UDP stream 114, frame 3398 / UDP stream 134 +15 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe2cr.update.microsoft.com", "type": "ioc", "value": "fe2cr.update.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 11163 / UDP stream 237, frame 11164 / UDP stream 237, frame 11619 / UDP stream 259, frame 11620 / UDP stream 259, frame 11621 / UDP stream 259 +5 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe2cr.update.microsoft.com.akadns.net", "type": "ioc", "value": "fe2cr.update.microsoft.com.akadns.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-cname; frame 11164 / UDP stream 237, frame 11621 / UDP stream 259, frame 13322 / UDP stream 271", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fe3cr.delivery.mp.microsoft.com", "type": "ioc", "value": "fe3cr.delivery.mp.microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 11311 / UDP stream 240, frame 11315 / UDP stream 240, frame 11332 / UDP stream 240, frame 11350 / UDP stream 240, frame 11776 / UDP stream 262 +6 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fp-afd.azurefd.us", "type": "ioc", "value": "fp-afd.azurefd.us", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 4585 / UDP stream 164, frame 4651 / UDP stream 164, frame 4718 / TCP stream 209", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fp-as.azureedge.net", "type": "ioc", "value": "fp-as.azureedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 4445 / UDP stream 154, frame 4460 / UDP stream 154, frame 4470 / TCP stream 199", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:fp-vs-nocache.azureedge.net", "type": "ioc", "value": "fp-vs-nocache.azureedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 4477 / UDP stream 159, frame 4478 / UDP stream 159, frame 4545 / TCP stream 201", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:grtovxn.enemywatch.net", "type": "ioc", "value": "grtovxn.enemywatch.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 6484 / UDP stream 196, frame 6486 / UDP stream 196, frame 6545 / UDP stream 208, frame 6546 / UDP stream 208", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:grtovxn.localdomain", "type": "ioc", "value": "grtovxn.localdomain", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 6488 / UDP stream 198, frame 6497 / UDP stream 198, frame 6513 / UDP stream 198, frame 6522 / UDP stream 198, frame 6550 / UDP stream 209 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:hzmx01.mxmail.netease.com", "type": "ioc", "value": "hzmx01.mxmail.netease.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 74767 / UDP stream 969, frame 74769 / UDP stream 969, frame 74770 / UDP stream 969, frame 74798 / TCP stream 1489", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:imap.gmail.com", "type": "ioc", "value": "imap.gmail.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 44498 / UDP stream 564, frame 44499 / UDP stream 564, frame 44500 / UDP stream 564, frame 51449 / UDP stream 661, frame 51450 / UDP stream 661 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:img-prod-cms-rt-microsoft-com.akamaized.net", "type": "ioc", "value": "img-prod-cms-rt-microsoft-com.akamaized.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 5438 / UDP stream 177, frame 5439 / UDP stream 177, frame 5443 / TCP stream 228", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:inbound.att.net", "type": "ioc", "value": "inbound.att.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 49366 / UDP stream 639, frame 49367 / UDP stream 639, frame 49369 / UDP stream 639", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:k-ring.msedge.net", "type": "ioc", "value": "k-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 2970 / UDP stream 126, frame 2973 / UDP stream 126, frame 4474 / UDP stream 156, frame 4483 / UDP stream 156, frame 2996 / TCP stream 141 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:kamuchehddhgfgf.ddns.net", "type": "ioc", "value": "kamuchehddhgfgf.ddns.net", "source": "ioc-investigation", "verdict": "needs review", "ioc_type": "domain", "source_ref": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "kamuchehddhgfgf.ddns.net was classified as domain. Investigation verdict is needs review with score 22/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis", "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157", "ioc-investigation" ], "suspicion_score": 22 }, { "id": "ioc:l-0005.dc-msedge.net", "type": "ioc", "value": "l-0005.dc-msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-cname; frame 4540 / UDP stream 158", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:l-ring.msedge.net", "type": "ioc", "value": "l-ring.msedge.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 4475 / UDP stream 157, frame 4482 / UDP stream 157, frame 4543 / TCP stream 202", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:login.live.com", "type": "ioc", "value": "login.live.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 3060 / UDP stream 129, frame 3070 / UDP stream 129, frame 3670 / UDP stream 140, frame 3671 / UDP stream 140, frame 4816 / UDP stream 166 +12 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:login.microsoftonline.com", "type": "ioc", "value": "login.microsoftonline.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 7216 / UDP stream 216, frame 7217 / UDP stream 216, frame 26150 / UDP stream 505, frame 26151 / UDP stream 505, frame 29179 / UDP stream 516 +15 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.abchk.net", "type": "ioc", "value": "mail.abchk.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 80874 / UDP stream 1043, frame 80882 / UDP stream 1043, frame 80885 / UDP stream 1043, frame 80916 / TCP stream 1600", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.ajeel.fr", "type": "ioc", "value": "mail.ajeel.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 71444 / UDP stream 944, frame 71446 / UDP stream 944, frame 71451 / UDP stream 944, frame 71457 / UDP stream 944, frame 71458 / UDP stream 944 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.akinao-lab.com", "type": "ioc", "value": "mail.akinao-lab.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 54427 / UDP stream 677, frame 54428 / UDP stream 677, frame 54431 / UDP stream 677, frame 54485 / TCP stream 979", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.anberman.es", "type": "ioc", "value": "mail.anberman.es", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 50906 / UDP stream 648, frame 50909 / UDP stream 648, frame 50913 / UDP stream 648, frame 75740 / UDP stream 987, frame 75742 / UDP stream 987 +3 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.atelierscalin.fr", "type": "ioc", "value": "mail.atelierscalin.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 77263 / UDP stream 1017, frame 77267 / UDP stream 1017, frame 77268 / UDP stream 1017, frame 77316 / TCP stream 1563", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.austinjournls.com", "type": "ioc", "value": "mail.austinjournls.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 55418 / UDP stream 683, frame 55419 / UDP stream 683, frame 55422 / UDP stream 683, frame 55427 / UDP stream 683, frame 55440 / UDP stream 683 +15 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.be-daventure.fr", "type": "ioc", "value": "mail.be-daventure.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 82936 / UDP stream 1060, frame 82938 / UDP stream 1060, frame 82939 / UDP stream 1060, frame 82970 / TCP stream 1628", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.bethnet.co.za", "type": "ioc", "value": "mail.bethnet.co.za", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 56651 / UDP stream 705, frame 56652 / UDP stream 705, frame 56655 / UDP stream 705, frame 56947 / TCP stream 1046, frame 57138 / TCP stream 1050 +4 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.brins-d-eveil.fr", "type": "ioc", "value": "mail.brins-d-eveil.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 61170 / UDP stream 777, frame 61172 / UDP stream 777, frame 61174 / UDP stream 777, frame 81548 / UDP stream 1052, frame 81550 / UDP stream 1052 +6 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.burgers.cc", "type": "ioc", "value": "mail.burgers.cc", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 73614 / UDP stream 961, frame 73619 / UDP stream 961, frame 73621 / UDP stream 961", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.chokshiandchokshi.in", "type": "ioc", "value": "mail.chokshiandchokshi.in", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 69986 / UDP stream 936, frame 69988 / UDP stream 936", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.come-paris.fr", "type": "ioc", "value": "mail.come-paris.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 57935 / UDP stream 718, frame 57938 / UDP stream 718, frame 57939 / UDP stream 718, frame 57975 / TCP stream 1075, frame 58833 / TCP stream 1105", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.corteo.fr", "type": "ioc", "value": "mail.corteo.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 59508 / UDP stream 744, frame 59510 / UDP stream 744, frame 59513 / UDP stream 744, frame 59553 / TCP stream 1133, frame 60152 / TCP stream 1162", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.csnert.fr", "type": "ioc", "value": "mail.csnert.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 69524 / UDP stream 932, frame 69526 / UDP stream 932, frame 69531 / UDP stream 932, frame 69588 / TCP stream 1448", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.debtmend.co.za", "type": "ioc", "value": "mail.debtmend.co.za", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 53946 / UDP stream 674, frame 53947 / UDP stream 674, frame 53950 / UDP stream 674, frame 53954 / UDP stream 674, frame 53956 / UDP stream 674 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.doctor-healthcare.com", "type": "ioc", "value": "mail.doctor-healthcare.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 82993 / UDP stream 1061, frame 82995 / UDP stream 1061, frame 82998 / UDP stream 1061, frame 83101 / TCP stream 1629, frame 83606 / TCP stream 1635", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.eolas.fr", "type": "ioc", "value": "mail.eolas.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 58161 / UDP stream 721, frame 58163 / UDP stream 721, frame 58164 / UDP stream 721, frame 58217 / TCP stream 1081, frame 58561 / TCP stream 1092 +3 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.goldmarkconsultants.com", "type": "ioc", "value": "mail.goldmarkconsultants.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 55891 / UDP stream 691, frame 55893 / UDP stream 691, frame 55894 / UDP stream 691", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.hrctunisia.com", "type": "ioc", "value": "mail.hrctunisia.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 69206 / UDP stream 925, frame 69208 / UDP stream 925, frame 69209 / UDP stream 925, frame 69241 / TCP stream 1437", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.ipage.com", "type": "ioc", "value": "mail.ipage.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 64868 / UDP stream 826, frame 64869 / UDP stream 826, frame 64898 / TCP stream 1277", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.isoldry.com", "type": "ioc", "value": "mail.isoldry.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 49389 / UDP stream 640, frame 49390 / UDP stream 640, frame 49394 / UDP stream 640, frame 72037 / UDP stream 954, frame 72038 / UDP stream 954 +2 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.kalivet.com", "type": "ioc", "value": "mail.kalivet.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 77125 / UDP stream 1016, frame 77127 / UDP stream 1016, frame 77128 / UDP stream 1016, frame 77157 / TCP stream 1561", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.kbcrawl.net", "type": "ioc", "value": "mail.kbcrawl.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 51818 / UDP stream 673, frame 51819 / UDP stream 673, frame 51821 / UDP stream 673, frame 75109 / UDP stream 978, frame 75111 / UDP stream 978 +4 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.lecmg.fr", "type": "ioc", "value": "mail.lecmg.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 55847 / UDP stream 690, frame 55849 / UDP stream 690, frame 55850 / UDP stream 690, frame 76828 / UDP stream 1015, frame 76829 / UDP stream 1015 +3 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.loosefoot.com", "type": "ioc", "value": "mail.loosefoot.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 51635 / UDP stream 667, frame 51636 / UDP stream 667, frame 51639 / UDP stream 667", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.ma-communication.com", "type": "ioc", "value": "mail.ma-communication.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 83417 / UDP stream 1067, frame 83419 / UDP stream 1067, frame 83422 / UDP stream 1067, frame 83469 / TCP stream 1634, frame 83847 / TCP stream 1646", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.maclen.fr", "type": "ioc", "value": "mail.maclen.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 61176 / UDP stream 778, frame 61177 / UDP stream 778, frame 61182 / UDP stream 778, frame 61262 / TCP stream 1250, frame 61447 / TCP stream 1256 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.microvistatech.com", "type": "ioc", "value": "mail.microvistatech.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 64418 / UDP stream 823, frame 64420 / UDP stream 823, frame 64421 / UDP stream 823, frame 64451 / TCP stream 1273", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.monquartier.com.br", "type": "ioc", "value": "mail.monquartier.com.br", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 68533 / UDP stream 909, frame 68535 / UDP stream 909, frame 68538 / UDP stream 909", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.myfairpoint.net", "type": "ioc", "value": "mail.myfairpoint.net", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 43091 / UDP stream 553, frame 43093 / UDP stream 553, frame 43096 / UDP stream 553, frame 51409 / UDP stream 660, frame 51410 / UDP stream 660 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.nazarioconstruction.com", "type": "ioc", "value": "mail.nazarioconstruction.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 54177 / UDP stream 675, frame 54179 / UDP stream 675, frame 54181 / UDP stream 675, frame 54231 / TCP stream 976", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.otenet.gr", "type": "ioc", "value": "mail.otenet.gr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 84137 / UDP stream 1083, frame 84140 / UDP stream 1083, frame 84192 / TCP stream 1651", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.pangia.biz", "type": "ioc", "value": "mail.pangia.biz", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 68957 / UDP stream 919, frame 68959 / UDP stream 919, frame 69006 / TCP stream 1428", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.perpetualplaques.com", "type": "ioc", "value": "mail.perpetualplaques.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 68095 / UDP stream 892, frame 68097 / UDP stream 892, frame 68098 / UDP stream 892, frame 68131 / TCP stream 1379", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.ptolemee.com", "type": "ioc", "value": "mail.ptolemee.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 58938 / UDP stream 735, frame 58944 / UDP stream 735, frame 58946 / UDP stream 735, frame 59241 / TCP stream 1111", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.qualityms.com.mx", "type": "ioc", "value": "mail.qualityms.com.mx", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 51117 / UDP stream 658, frame 51118 / UDP stream 658, frame 51120 / UDP stream 658, frame 51375 / TCP stream 948", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.smtp2go.com", "type": "ioc", "value": "mail.smtp2go.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 44492 / UDP stream 563, frame 44494 / UDP stream 563, frame 44496 / UDP stream 563, frame 51513 / UDP stream 664, frame 51514 / UDP stream 664 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.songazine.fr", "type": "ioc", "value": "mail.songazine.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 60180 / UDP stream 759, frame 60182 / UDP stream 759, frame 60185 / UDP stream 759, frame 60266 / TCP stream 1166", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.tcgasociados.com", "type": "ioc", "value": "mail.tcgasociados.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 74552 / UDP stream 963, frame 74554 / UDP stream 963, frame 74555 / UDP stream 963, frame 74583 / TCP stream 1486", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.tecsindia.com", "type": "ioc", "value": "mail.tecsindia.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 65453 / UDP stream 830, frame 65454 / UDP stream 830, frame 65457 / UDP stream 830", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.tetranergy.com", "type": "ioc", "value": "mail.tetranergy.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 45308 / UDP stream 573, frame 45309 / UDP stream 573, frame 45316 / UDP stream 573, frame 45323 / UDP stream 573, frame 45328 / UDP stream 573 +1 more", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.tiretracksusa.com", "type": "ioc", "value": "mail.tiretracksusa.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 81369 / UDP stream 1049, frame 81371 / UDP stream 1049", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.verificalitas.es", "type": "ioc", "value": "mail.verificalitas.es", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 83016 / UDP stream 1062, frame 83018 / UDP stream 1062, frame 83021 / UDP stream 1062, frame 83089 / TCP stream 1630", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.verificalitasoca.es", "type": "ioc", "value": "mail.verificalitasoca.es", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 67618 / UDP stream 877, frame 67624 / UDP stream 877, frame 67626 / UDP stream 877, frame 67655 / TCP stream 1354", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.xenium-partners.fr", "type": "ioc", "value": "mail.xenium-partners.fr", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 56718 / UDP stream 707, frame 56720 / UDP stream 707, frame 56721 / UDP stream 707, frame 56777 / TCP stream 1045, frame 56834 / TCP stream 1047", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail.yourwebsitemail.com", "type": "ioc", "value": "mail.yourwebsitemail.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 79141 / UDP stream 1028, frame 79143 / UDP stream 1028, frame 79170 / TCP stream 1576", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:mail04.l4email.com", "type": "ioc", "value": "mail04.l4email.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 56145 / UDP stream 696, frame 56146 / UDP stream 696, frame 56147 / UDP stream 696, frame 56181 / TCP stream 1021", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:microsoft.com", "type": "ioc", "value": "microsoft.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query, tls-sni; frame 17273 / UDP stream 297, frame 17274 / UDP stream 297, frame 17278 / TCP stream 350", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "ioc:moiazureorigin.clo.footprintdns.com", "type": "ioc", "value": "moiazureorigin.clo.footprintdns.com", "source": "log-pcap-analysis", "ioc_type": "domain", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "description": "dns-query; frame 2972 / UDP stream 127, frame 3072 / UDP stream 127, frame 3200 / UDP stream 127, frame 3241 / UDP stream 127, frame 3242 / UDP stream 127", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "log-pcap-analysis" ] }, { "id": "finding-fe313fb4eb4f2c8c73a1f4f9", "type": "pcap-finding", "label": "Repeated unsuccessful DNS resolution", "source": "deterministic-pcap-analysis", "metrics": { "domain": "wpad.enemywatch.net", "source": "10.10.22.156", "response_count": 42 }, "rule_id": "repeated-nxdomain", "severity": "low", "confidence": 0.5, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "udp_stream": 43, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1634913113.850586000" }, { "udp_stream": 70, "frame_number": 1639, "display_filter": "frame.number == 1639", "timestamp_epoch": "1634913129.896164000" }, { "udp_stream": 123, "frame_number": 2954, "display_filter": "frame.number == 2954", "timestamp_epoch": "1634913189.897467000" }, { "udp_stream": 278, "frame_number": 15029, "display_filter": "frame.number == 15029", "timestamp_epoch": "1634913789.924426000" }, { "udp_stream": 302, "frame_number": 17432, "display_filter": "frame.number == 17432", "timestamp_epoch": "1634913920.085523000" }, { "udp_stream": 308, "frame_number": 17480, "display_filter": "frame.number == 17480", "timestamp_epoch": "1634913935.163297000" }, { "udp_stream": 319, "frame_number": 17756, "display_filter": "frame.number == 17756", "timestamp_epoch": "1634913995.164584000" }, { "udp_stream": 326, "frame_number": 17877, "display_filter": "frame.number == 17877", "timestamp_epoch": "1634914025.414938000" }, { "udp_stream": 328, "frame_number": 17929, "display_filter": "frame.number == 17929", "timestamp_epoch": "1634914040.416494000" }, { "udp_stream": 338, "frame_number": 20567, "display_filter": "frame.number == 20567", "timestamp_epoch": "1634914100.418112000" }, { "udp_stream": 340, "frame_number": 20642, "display_filter": "frame.number == 20642", "timestamp_epoch": "1634914120.770109000" }, { "udp_stream": 343, "frame_number": 20687, "display_filter": "frame.number == 20687", "timestamp_epoch": "1634914135.778712000" }, { "udp_stream": 347, "frame_number": 22341, "display_filter": "frame.number == 22341", "timestamp_epoch": "1634914195.797190000" }, { "udp_stream": 352, "frame_number": 22405, "display_filter": "frame.number == 22405", "timestamp_epoch": "1634914214.343673000" }, { "udp_stream": 357, "frame_number": 22488, "display_filter": "frame.number == 22488", "timestamp_epoch": "1634914229.359261000" }, { "udp_stream": 367, "frame_number": 22699, "display_filter": "frame.number == 22699", "timestamp_epoch": "1634914289.360718000" }, { "udp_stream": 374, "frame_number": 22828, "display_filter": "frame.number == 22828", "timestamp_epoch": "1634914329.874275000" }, { "udp_stream": 380, "frame_number": 22902, "display_filter": "frame.number == 22902", "timestamp_epoch": "1634914344.875954000" }, { "udp_stream": 390, "frame_number": 23074, "display_filter": "frame.number == 23074", "timestamp_epoch": "1634914404.879988000" }, { "udp_stream": 398, "frame_number": 23181, "display_filter": "frame.number == 23181", "timestamp_epoch": "1634914442.597449000" }, { "udp_stream": 400, "frame_number": 23224, "display_filter": "frame.number == 23224", "timestamp_epoch": "1634914457.599390000" }, { "udp_stream": 417, "frame_number": 23624, "display_filter": "frame.number == 23624", "timestamp_epoch": "1634914517.617138000" }, { "udp_stream": 424, "frame_number": 23725, "display_filter": "frame.number == 23725", "timestamp_epoch": "1634914550.884098000" }, { "udp_stream": 427, "frame_number": 23766, "display_filter": "frame.number == 23766", "timestamp_epoch": "1634914565.898876000" }, { "udp_stream": 437, "frame_number": 23922, "display_filter": "frame.number == 23922", "timestamp_epoch": "1634914625.900650000" }, { "udp_stream": 444, "frame_number": 24009, "display_filter": "frame.number == 24009", "timestamp_epoch": "1634914656.213481000" }, { "udp_stream": 446, "frame_number": 24039, "display_filter": "frame.number == 24039", "timestamp_epoch": "1634914671.229754000" }, { "udp_stream": 454, "frame_number": 24171, "display_filter": "frame.number == 24171", "timestamp_epoch": "1634914704.264229000" }, { "udp_stream": 457, "frame_number": 24215, "display_filter": "frame.number == 24215", "timestamp_epoch": "1634914719.262326000" }, { "udp_stream": 468, "frame_number": 24401, "display_filter": "frame.number == 24401", "timestamp_epoch": "1634914779.281281000" }, { "udp_stream": 471, "frame_number": 24419, "display_filter": "frame.number == 24419", "timestamp_epoch": "1634914784.233039000" }, { "udp_stream": 474, "frame_number": 24460, "display_filter": "frame.number == 24460", "timestamp_epoch": "1634914799.233036000" }, { "udp_stream": 484, "frame_number": 24630, "display_filter": "frame.number == 24630", "timestamp_epoch": "1634914859.224438000" }, { "udp_stream": 486, "frame_number": 24662, "display_filter": "frame.number == 24662", "timestamp_epoch": "1634914872.367876000" }, { "udp_stream": 488, "frame_number": 24714, "display_filter": "frame.number == 24714", "timestamp_epoch": "1634914887.359843000" }, { "udp_stream": 499, "frame_number": 25942, "display_filter": "frame.number == 25942", "timestamp_epoch": "1634914947.373433000" }, { "udp_stream": 662, "frame_number": 51487, "display_filter": "frame.number == 51487", "timestamp_epoch": "1634915547.391306000" }, { "udp_stream": 751, "frame_number": 59764, "display_filter": "frame.number == 59764", "timestamp_epoch": "1634916147.456162000" }, { "udp_stream": 860, "frame_number": 66440, "display_filter": "frame.number == 66440", "timestamp_epoch": "1634916747.482971000" }, { "udp_stream": 949, "frame_number": 71950, "display_filter": "frame.number == 71950", "timestamp_epoch": "1634917347.560843000" }, { "udp_stream": 1023, "frame_number": 78478, "display_filter": "frame.number == 78478", "timestamp_epoch": "1634917947.653388000" }, { "udp_stream": 1081, "frame_number": 84127, "display_filter": "frame.number == 84127", "timestamp_epoch": "1634918547.690116000" } ] }, { "id": "finding-7e6e3a47e0cbb5f8868ae1c6", "type": "pcap-finding", "label": "Repeated unsuccessful DNS resolution", "source": "deterministic-pcap-analysis", "metrics": { "domain": "wpad.localdomain", "source": "10.10.22.156", "response_count": 42 }, "rule_id": "repeated-nxdomain", "severity": "low", "confidence": 0.5, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "udp_stream": 44, "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1634913113.851046000" }, { "udp_stream": 71, "frame_number": 1641, "display_filter": "frame.number == 1641", "timestamp_epoch": "1634913129.896996000" }, { "udp_stream": 124, "frame_number": 2956, "display_filter": "frame.number == 2956", "timestamp_epoch": "1634913189.898363000" }, { "udp_stream": 279, "frame_number": 15031, "display_filter": "frame.number == 15031", "timestamp_epoch": "1634913789.926143000" }, { "udp_stream": 303, "frame_number": 17435, "display_filter": "frame.number == 17435", "timestamp_epoch": "1634913920.155227000" }, { "udp_stream": 309, "frame_number": 17482, "display_filter": "frame.number == 17482", "timestamp_epoch": "1634913935.164180000" }, { "udp_stream": 160, "frame_number": 17758, "display_filter": "frame.number == 17758", "timestamp_epoch": "1634913995.165577000" }, { "udp_stream": 327, "frame_number": 17880, "display_filter": "frame.number == 17880", "timestamp_epoch": "1634914025.415749000" }, { "udp_stream": 329, "frame_number": 17931, "display_filter": "frame.number == 17931", "timestamp_epoch": "1634914040.417565000" }, { "udp_stream": 339, "frame_number": 20569, "display_filter": "frame.number == 20569", "timestamp_epoch": "1634914100.418985000" }, { "udp_stream": 341, "frame_number": 20645, "display_filter": "frame.number == 20645", "timestamp_epoch": "1634914120.771013000" }, { "udp_stream": 344, "frame_number": 20689, "display_filter": "frame.number == 20689", "timestamp_epoch": "1634914135.779841000" }, { "udp_stream": 348, "frame_number": 22343, "display_filter": "frame.number == 22343", "timestamp_epoch": "1634914195.798004000" }, { "udp_stream": 353, "frame_number": 22408, "display_filter": "frame.number == 22408", "timestamp_epoch": "1634914214.344439000" }, { "udp_stream": 358, "frame_number": 22490, "display_filter": "frame.number == 22490", "timestamp_epoch": "1634914229.360861000" }, { "udp_stream": 368, "frame_number": 22701, "display_filter": "frame.number == 22701", "timestamp_epoch": "1634914289.361806000" }, { "udp_stream": 375, "frame_number": 22831, "display_filter": "frame.number == 22831", "timestamp_epoch": "1634914329.874791000" }, { "udp_stream": 381, "frame_number": 22904, "display_filter": "frame.number == 22904", "timestamp_epoch": "1634914344.876688000" }, { "udp_stream": 391, "frame_number": 23076, "display_filter": "frame.number == 23076", "timestamp_epoch": "1634914404.881718000" }, { "udp_stream": 399, "frame_number": 23184, "display_filter": "frame.number == 23184", "timestamp_epoch": "1634914442.598088000" }, { "udp_stream": 401, "frame_number": 23226, "display_filter": "frame.number == 23226", "timestamp_epoch": "1634914457.600047000" }, { "udp_stream": 418, "frame_number": 23626, "display_filter": "frame.number == 23626", "timestamp_epoch": "1634914517.618070000" }, { "udp_stream": 425, "frame_number": 23727, "display_filter": "frame.number == 23727", "timestamp_epoch": "1634914550.885082000" }, { "udp_stream": 428, "frame_number": 23768, "display_filter": "frame.number == 23768", "timestamp_epoch": "1634914565.899945000" }, { "udp_stream": 438, "frame_number": 23924, "display_filter": "frame.number == 23924", "timestamp_epoch": "1634914625.901471000" }, { "udp_stream": 445, "frame_number": 24012, "display_filter": "frame.number == 24012", "timestamp_epoch": "1634914656.214597000" }, { "udp_stream": 447, "frame_number": 24041, "display_filter": "frame.number == 24041", "timestamp_epoch": "1634914671.230734000" }, { "udp_stream": 455, "frame_number": 24174, "display_filter": "frame.number == 24174", "timestamp_epoch": "1634914704.265783000" }, { "udp_stream": 458, "frame_number": 24217, "display_filter": "frame.number == 24217", "timestamp_epoch": "1634914719.263165000" }, { "udp_stream": 469, "frame_number": 24403, "display_filter": "frame.number == 24403", "timestamp_epoch": "1634914779.282226000" }, { "udp_stream": 472, "frame_number": 24421, "display_filter": "frame.number == 24421", "timestamp_epoch": "1634914784.234191000" }, { "udp_stream": 475, "frame_number": 24462, "display_filter": "frame.number == 24462", "timestamp_epoch": "1634914799.234105000" }, { "udp_stream": 485, "frame_number": 24632, "display_filter": "frame.number == 24632", "timestamp_epoch": "1634914859.280742000" }, { "udp_stream": 487, "frame_number": 24664, "display_filter": "frame.number == 24664", "timestamp_epoch": "1634914872.368608000" }, { "udp_stream": 489, "frame_number": 24716, "display_filter": "frame.number == 24716", "timestamp_epoch": "1634914887.360763000" }, { "udp_stream": 500, "frame_number": 25944, "display_filter": "frame.number == 25944", "timestamp_epoch": "1634914947.374424000" }, { "udp_stream": 663, "frame_number": 51489, "display_filter": "frame.number == 51489", "timestamp_epoch": "1634915547.394619000" }, { "udp_stream": 752, "frame_number": 59766, "display_filter": "frame.number == 59766", "timestamp_epoch": "1634916147.457337000" }, { "udp_stream": 861, "frame_number": 66442, "display_filter": "frame.number == 66442", "timestamp_epoch": "1634916747.483707000" }, { "udp_stream": 950, "frame_number": 71952, "display_filter": "frame.number == 71952", "timestamp_epoch": "1634917347.561640000" }, { "udp_stream": 1024, "frame_number": 78480, "display_filter": "frame.number == 78480", "timestamp_epoch": "1634917947.654090000" }, { "udp_stream": 1082, "frame_number": 84129, "display_filter": "frame.number == 84129", "timestamp_epoch": "1634918547.690773000" } ] }, { "id": "finding-2ff5dff90c1bb4aa4e9288b4", "type": "pcap-finding", "label": "Repeated unsuccessful DNS resolution", "source": "deterministic-pcap-analysis", "metrics": { "domain": "wpad.enemywatch.net", "source": "10.10.22.157", "response_count": 12 }, "rule_id": "repeated-nxdomain", "severity": "low", "confidence": 0.5, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "udp_stream": 10, "frame_number": 39, "display_filter": "frame.number == 39", "timestamp_epoch": "1634913053.599183000" }, { "udp_stream": 32, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1634913070.790860000" }, { "udp_stream": 72, "frame_number": 1643, "display_filter": "frame.number == 1643", "timestamp_epoch": "1634913130.805321000" }, { "udp_stream": 264, "frame_number": 11964, "display_filter": "frame.number == 11964", "timestamp_epoch": "1634913730.845643000" }, { "udp_stream": 376, "frame_number": 22840, "display_filter": "frame.number == 22840", "timestamp_epoch": "1634914330.908117000" }, { "udp_stream": 494, "frame_number": 24862, "display_filter": "frame.number == 24862", "timestamp_epoch": "1634914930.937051000" }, { "udp_stream": 649, "frame_number": 50933, "display_filter": "frame.number == 50933", "timestamp_epoch": "1634915531.001414000" }, { "udp_stream": 746, "frame_number": 59676, "display_filter": "frame.number == 59676", "timestamp_epoch": "1634916131.048404000" }, { "udp_stream": 851, "frame_number": 66339, "display_filter": "frame.number == 66339", "timestamp_epoch": "1634916731.075094000" }, { "udp_stream": 946, "frame_number": 71492, "display_filter": "frame.number == 71492", "timestamp_epoch": "1634917331.152513000" }, { "udp_stream": 1021, "frame_number": 78404, "display_filter": "frame.number == 78404", "timestamp_epoch": "1634917931.214967000" }, { "udp_stream": 1076, "frame_number": 84052, "display_filter": "frame.number == 84052", "timestamp_epoch": "1634918531.253039000" } ] }, { "id": "finding-0abec936620387197a1c8ec9", "type": "pcap-finding", "label": "Repeated unsuccessful DNS resolution", "source": "deterministic-pcap-analysis", "metrics": { "domain": "wpad.localdomain", "source": "10.10.22.157", "response_count": 12 }, "rule_id": "repeated-nxdomain", "severity": "low", "confidence": 0.5, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "udp_stream": 11, "frame_number": 41, "display_filter": "frame.number == 41", "timestamp_epoch": "1634913053.600187000" }, { "udp_stream": 33, "frame_number": 754, "display_filter": "frame.number == 754", "timestamp_epoch": "1634913070.791562000" }, { "udp_stream": 73, "frame_number": 1645, "display_filter": "frame.number == 1645", "timestamp_epoch": "1634913130.805902000" }, { "udp_stream": 265, "frame_number": 11966, "display_filter": "frame.number == 11966", "timestamp_epoch": "1634913730.846316000" }, { "udp_stream": 377, "frame_number": 22842, "display_filter": "frame.number == 22842", "timestamp_epoch": "1634914330.908691000" }, { "udp_stream": 495, "frame_number": 24864, "display_filter": "frame.number == 24864", "timestamp_epoch": "1634914930.937711000" }, { "udp_stream": 650, "frame_number": 50935, "display_filter": "frame.number == 50935", "timestamp_epoch": "1634915531.002113000" }, { "udp_stream": 747, "frame_number": 59678, "display_filter": "frame.number == 59678", "timestamp_epoch": "1634916131.103842000" }, { "udp_stream": 852, "frame_number": 66341, "display_filter": "frame.number == 66341", "timestamp_epoch": "1634916731.075832000" }, { "udp_stream": 947, "frame_number": 71495, "display_filter": "frame.number == 71495", "timestamp_epoch": "1634917331.202920000" }, { "udp_stream": 1022, "frame_number": 78406, "display_filter": "frame.number == 78406", "timestamp_epoch": "1634917931.215639000" }, { "udp_stream": 1077, "frame_number": 84054, "display_filter": "frame.number == 84054", "timestamp_epoch": "1634918531.328141000" } ] }, { "id": "finding-75bebaab99ac531b47499d85", "type": "pcap-finding", "label": "Repeated unsuccessful DNS resolution", "source": "deterministic-pcap-analysis", "metrics": { "domain": "wpad.enemywatch.net", "source": "10.10.22.158", "response_count": 16 }, "rule_id": "repeated-nxdomain", "severity": "low", "confidence": 0.5, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "udp_stream": 83, "frame_number": 1719, "display_filter": "frame.number == 1719", "timestamp_epoch": "1634913144.722420000" }, { "udp_stream": 110, "frame_number": 2522, "display_filter": "frame.number == 2522", "timestamp_epoch": "1634913161.020747000" }, { "udp_stream": 142, "frame_number": 3813, "display_filter": "frame.number == 3813", "timestamp_epoch": "1634913221.035309000" }, { "udp_stream": 185, "frame_number": 6217, "display_filter": "frame.number == 6217", "timestamp_epoch": "1634913345.771390000" }, { "udp_stream": 200, "frame_number": 6501, "display_filter": "frame.number == 6501", "timestamp_epoch": "1634913353.813711000" }, { "udp_stream": 244, "frame_number": 11440, "display_filter": "frame.number == 11440", "timestamp_epoch": "1634913673.841064000" }, { "udp_stream": 249, "frame_number": 11530, "display_filter": "frame.number == 11530", "timestamp_epoch": "1634913688.838516000" }, { "udp_stream": 268, "frame_number": 12935, "display_filter": "frame.number == 12935", "timestamp_epoch": "1634913748.853338000" }, { "udp_stream": 383, "frame_number": 22919, "display_filter": "frame.number == 22919", "timestamp_epoch": "1634914348.871719000" }, { "udp_stream": 501, "frame_number": 25951, "display_filter": "frame.number == 25951", "timestamp_epoch": "1634914948.901928000" }, { "udp_stream": 665, "frame_number": 51541, "display_filter": "frame.number == 51541", "timestamp_epoch": "1634915548.962889000" }, { "udp_stream": 754, "frame_number": 59826, "display_filter": "frame.number == 59826", "timestamp_epoch": "1634916149.027760000" }, { "udp_stream": 862, "frame_number": 66451, "display_filter": "frame.number == 66451", "timestamp_epoch": "1634916749.071493000" }, { "udp_stream": 951, "frame_number": 71969, "display_filter": "frame.number == 71969", "timestamp_epoch": "1634917349.148818000" }, { "udp_stream": 1025, "frame_number": 78482, "display_filter": "frame.number == 78482", "timestamp_epoch": "1634917949.226193000" }, { "udp_stream": 1084, "frame_number": 84148, "display_filter": "frame.number == 84148", "timestamp_epoch": "1634918549.277947000" } ] }, { "id": "finding-a8a40ac1e77eb39085827c4e", "type": "pcap-finding", "label": "Repeated unsuccessful DNS resolution", "source": "deterministic-pcap-analysis", "metrics": { "domain": "wpad.localdomain", "source": "10.10.22.158", "response_count": 16 }, "rule_id": "repeated-nxdomain", "severity": "low", "confidence": 0.5, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "udp_stream": 84, "frame_number": 1721, "display_filter": "frame.number == 1721", "timestamp_epoch": "1634913144.722778000" }, { "udp_stream": 111, "frame_number": 2524, "display_filter": "frame.number == 2524", "timestamp_epoch": "1634913161.021420000" }, { "udp_stream": 143, "frame_number": 3815, "display_filter": "frame.number == 3815", "timestamp_epoch": "1634913221.035924000" }, { "udp_stream": 186, "frame_number": 6219, "display_filter": "frame.number == 6219", "timestamp_epoch": "1634913345.806553000" }, { "udp_stream": 201, "frame_number": 6503, "display_filter": "frame.number == 6503", "timestamp_epoch": "1634913353.814338000" }, { "udp_stream": 245, "frame_number": 11442, "display_filter": "frame.number == 11442", "timestamp_epoch": "1634913673.842037000" }, { "udp_stream": 250, "frame_number": 11532, "display_filter": "frame.number == 11532", "timestamp_epoch": "1634913688.839222000" }, { "udp_stream": 269, "frame_number": 12937, "display_filter": "frame.number == 12937", "timestamp_epoch": "1634913748.854012000" }, { "udp_stream": 384, "frame_number": 22921, "display_filter": "frame.number == 22921", "timestamp_epoch": "1634914348.872293000" }, { "udp_stream": 502, "frame_number": 25953, "display_filter": "frame.number == 25953", "timestamp_epoch": "1634914948.902740000" }, { "udp_stream": 666, "frame_number": 51543, "display_filter": "frame.number == 51543", "timestamp_epoch": "1634915548.963577000" }, { "udp_stream": 755, "frame_number": 59828, "display_filter": "frame.number == 59828", "timestamp_epoch": "1634916149.028590000" }, { "udp_stream": 863, "frame_number": 66453, "display_filter": "frame.number == 66453", "timestamp_epoch": "1634916749.072134000" }, { "udp_stream": 952, "frame_number": 71971, "display_filter": "frame.number == 71971", "timestamp_epoch": "1634917349.149599000" }, { "udp_stream": 863, "frame_number": 78484, "display_filter": "frame.number == 78484", "timestamp_epoch": "1634917949.226998000" }, { "udp_stream": 1085, "frame_number": 84150, "display_filter": "frame.number == 84150", "timestamp_epoch": "1634918549.278737000" } ] }, { "id": "finding-e8013e820af70780e24d35d0", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.156", "protocol": "drsuapi", "destination": "10.10.22.22", "event_count": 59, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 46, "frame_number": 999, "display_filter": "frame.number == 999", "timestamp_epoch": "1634913114.921083000" }, { "tcp_stream": 46, "frame_number": 1001, "display_filter": "frame.number == 1001", "timestamp_epoch": "1634913114.921628000" }, { "tcp_stream": 46, "frame_number": 1003, "display_filter": "frame.number == 1003", "timestamp_epoch": "1634913114.922192000" }, { "tcp_stream": 46, "frame_number": 1013, "display_filter": "frame.number == 1013", "timestamp_epoch": "1634913114.924663000" }, { "tcp_stream": 46, "frame_number": 1015, "display_filter": "frame.number == 1015", "timestamp_epoch": "1634913114.925328000" }, { "tcp_stream": 46, "frame_number": 1017, "display_filter": "frame.number == 1017", "timestamp_epoch": "1634913114.926157000" }, { "tcp_stream": 53, "frame_number": 1030, "display_filter": "frame.number == 1030", "timestamp_epoch": "1634913114.935406000" }, { "tcp_stream": 53, "frame_number": 1032, "display_filter": "frame.number == 1032", "timestamp_epoch": "1634913114.935762000" }, { "tcp_stream": 53, "frame_number": 1034, "display_filter": "frame.number == 1034", "timestamp_epoch": "1634913114.936127000" }, { "tcp_stream": 53, "frame_number": 1036, "display_filter": "frame.number == 1036", "timestamp_epoch": "1634913114.936426000" }, { "tcp_stream": 57, "frame_number": 1120, "display_filter": "frame.number == 1120", "timestamp_epoch": "1634913115.055683000" }, { "tcp_stream": 57, "frame_number": 1122, "display_filter": "frame.number == 1122", "timestamp_epoch": "1634913115.056140000" }, { "tcp_stream": 57, "frame_number": 1124, "display_filter": "frame.number == 1124", "timestamp_epoch": "1634913115.056842000" }, { "tcp_stream": 57, "frame_number": 1126, "display_filter": "frame.number == 1126", "timestamp_epoch": "1634913115.057553000" }, { "tcp_stream": 70, "frame_number": 1448, "display_filter": "frame.number == 1448", "timestamp_epoch": "1634913118.519956000" }, { "tcp_stream": 70, "frame_number": 1450, "display_filter": "frame.number == 1450", "timestamp_epoch": "1634913118.520775000" }, { "tcp_stream": 70, "frame_number": 1452, "display_filter": "frame.number == 1452", "timestamp_epoch": "1634913118.522497000" }, { "tcp_stream": 70, "frame_number": 1456, "display_filter": "frame.number == 1456", "timestamp_epoch": "1634913118.524022000" }, { "tcp_stream": 70, "frame_number": 1458, "display_filter": "frame.number == 1458", "timestamp_epoch": "1634913118.525173000" }, { "tcp_stream": 70, "frame_number": 1460, "display_filter": "frame.number == 1460", "timestamp_epoch": "1634913118.525749000" }, { "tcp_stream": 183, "frame_number": 4223, "display_filter": "frame.number == 4223", "timestamp_epoch": "1634913239.064236000" }, { "tcp_stream": 183, "frame_number": 4225, "display_filter": "frame.number == 4225", "timestamp_epoch": "1634913239.064690000" }, { "tcp_stream": 183, "frame_number": 4227, "display_filter": "frame.number == 4227", "timestamp_epoch": "1634913239.065185000" }, { "tcp_stream": 183, "frame_number": 4229, "display_filter": "frame.number == 4229", "timestamp_epoch": "1634913239.065618000" }, { "tcp_stream": 234, "frame_number": 5686, "display_filter": "frame.number == 5686", "timestamp_epoch": "1634913300.070960000" }, { "tcp_stream": 234, "frame_number": 5688, "display_filter": "frame.number == 5688", "timestamp_epoch": "1634913300.071629000" }, { "tcp_stream": 234, "frame_number": 5690, "display_filter": "frame.number == 5690", "timestamp_epoch": "1634913300.072217000" }, { "tcp_stream": 234, "frame_number": 5694, "display_filter": "frame.number == 5694", "timestamp_epoch": "1634913300.073778000" }, { "tcp_stream": 234, "frame_number": 5696, "display_filter": "frame.number == 5696", "timestamp_epoch": "1634913300.074293000" }, { "tcp_stream": 234, "frame_number": 5698, "display_filter": "frame.number == 5698", "timestamp_epoch": "1634913300.074948000" }, { "tcp_stream": 250, "frame_number": 7157, "display_filter": "frame.number == 7157", "timestamp_epoch": "1634913412.852396000" }, { "tcp_stream": 250, "frame_number": 7159, "display_filter": "frame.number == 7159", "timestamp_epoch": "1634913412.852881000" }, { "tcp_stream": 250, "frame_number": 7161, "display_filter": "frame.number == 7161", "timestamp_epoch": "1634913412.853417000" }, { "tcp_stream": 250, "frame_number": 7165, "display_filter": "frame.number == 7165", "timestamp_epoch": "1634913412.858261000" }, { "tcp_stream": 250, "frame_number": 7167, "display_filter": "frame.number == 7167", "timestamp_epoch": "1634913412.858713000" }, { "tcp_stream": 250, "frame_number": 7169, "display_filter": "frame.number == 7169", "timestamp_epoch": "1634913412.859241000" }, { "tcp_stream": 763, "frame_number": 29254, "display_filter": "frame.number == 29254", "timestamp_epoch": "1634915040.434513000" }, { "tcp_stream": 763, "frame_number": 29256, "display_filter": "frame.number == 29256", "timestamp_epoch": "1634915040.435017000" }, { "tcp_stream": 763, "frame_number": 29258, "display_filter": "frame.number == 29258", "timestamp_epoch": "1634915040.435432000" }, { "tcp_stream": 763, "frame_number": 29260, "display_filter": "frame.number == 29260", "timestamp_epoch": "1634915040.435814000" }, { "tcp_stream": 763, "frame_number": 29262, "display_filter": "frame.number == 29262", "timestamp_epoch": "1634915040.436251000" }, { "tcp_stream": 765, "frame_number": 29280, "display_filter": "frame.number == 29280", "timestamp_epoch": "1634915040.451299000" }, { "tcp_stream": 765, "frame_number": 29282, "display_filter": "frame.number == 29282", "timestamp_epoch": "1634915040.452022000" }, { "tcp_stream": 765, "frame_number": 29286, "display_filter": "frame.number == 29286", "timestamp_epoch": "1634915040.452617000" }, { "tcp_stream": 765, "frame_number": 29290, "display_filter": "frame.number == 29290", "timestamp_epoch": "1634915040.454554000" }, { "tcp_stream": 765, "frame_number": 29292, "display_filter": "frame.number == 29292", "timestamp_epoch": "1634915040.454951000" }, { "tcp_stream": 765, "frame_number": 29294, "display_filter": "frame.number == 29294", "timestamp_epoch": "1634915040.455474000" }, { "tcp_stream": 909, "frame_number": 48337, "display_filter": "frame.number == 48337", "timestamp_epoch": "1634915472.186645000" }, { "tcp_stream": 909, "frame_number": 48339, "display_filter": "frame.number == 48339", "timestamp_epoch": "1634915472.187321000" }, { "tcp_stream": 909, "frame_number": 48341, "display_filter": "frame.number == 48341", "timestamp_epoch": "1634915472.188030000" }, { "tcp_stream": 909, "frame_number": 48345, "display_filter": "frame.number == 48345", "timestamp_epoch": "1634915472.190234000" }, { "tcp_stream": 909, "frame_number": 48347, "display_filter": "frame.number == 48347", "timestamp_epoch": "1634915472.190779000" }, { "tcp_stream": 909, "frame_number": 48349, "display_filter": "frame.number == 48349", "timestamp_epoch": "1634915472.191359000" }, { "tcp_stream": 1265, "frame_number": 62105, "display_filter": "frame.number == 62105", "timestamp_epoch": "1634916360.366828000" }, { "tcp_stream": 1265, "frame_number": 62107, "display_filter": "frame.number == 62107", "timestamp_epoch": "1634916360.367545000" }, { "tcp_stream": 1265, "frame_number": 62109, "display_filter": "frame.number == 62109", "timestamp_epoch": "1634916360.368192000" }, { "tcp_stream": 1265, "frame_number": 62113, "display_filter": "frame.number == 62113", "timestamp_epoch": "1634916360.369813000" }, { "tcp_stream": 1265, "frame_number": 62115, "display_filter": "frame.number == 62115", "timestamp_epoch": "1634916360.370332000" }, { "tcp_stream": 1265, "frame_number": 62117, "display_filter": "frame.number == 62117", "timestamp_epoch": "1634916360.370883000" } ] }, { "id": "finding-1c78d0c86dc22ff8dbc9f82c", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.156", "protocol": "ldap", "destination": "10.10.22.22", "event_count": 102, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 37, "frame_number": 804, "display_filter": "frame.number == 804", "timestamp_epoch": "1634913113.472119000" }, { "tcp_stream": 37, "frame_number": 965, "display_filter": "frame.number == 965", "timestamp_epoch": "1634913114.914826000" }, { "tcp_stream": 37, "frame_number": 994, "display_filter": "frame.number == 994", "timestamp_epoch": "1634913114.920432000" }, { "tcp_stream": 55, "frame_number": 1062, "display_filter": "frame.number == 1062", "timestamp_epoch": "1634913114.964831000" }, { "tcp_stream": 55, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1634913114.967383000" }, { "tcp_stream": 55, "frame_number": 1072, "display_filter": "frame.number == 1072", "timestamp_epoch": "1634913114.969303000" }, { "tcp_stream": 55, "frame_number": 1074, "display_filter": "frame.number == 1074", "timestamp_epoch": "1634913114.969846000" }, { "tcp_stream": 55, "frame_number": 1137, "display_filter": "frame.number == 1137", "timestamp_epoch": "1634913115.095837000" }, { "tcp_stream": 55, "frame_number": 1151, "display_filter": "frame.number == 1151", "timestamp_epoch": "1634913115.457790000" }, { "tcp_stream": 55, "frame_number": 1167, "display_filter": "frame.number == 1167", "timestamp_epoch": "1634913115.627062000" }, { "tcp_stream": 55, "frame_number": 1175, "display_filter": "frame.number == 1175", "timestamp_epoch": "1634913115.628605000" }, { "tcp_stream": 55, "frame_number": 1178, "display_filter": "frame.number == 1178", "timestamp_epoch": "1634913115.629342000" }, { "tcp_stream": 55, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1634913115.630418000" }, { "tcp_stream": 63, "frame_number": 1187, "display_filter": "frame.number == 1187", "timestamp_epoch": "1634913116.332697000" }, { "tcp_stream": 63, "frame_number": 1192, "display_filter": "frame.number == 1192", "timestamp_epoch": "1634913116.335888000" }, { "tcp_stream": 63, "frame_number": 1211, "display_filter": "frame.number == 1211", "timestamp_epoch": "1634913116.516648000" }, { "tcp_stream": 65, "frame_number": 1219, "display_filter": "frame.number == 1219", "timestamp_epoch": "1634913116.559484000" }, { "tcp_stream": 65, "frame_number": 1222, "display_filter": "frame.number == 1222", "timestamp_epoch": "1634913116.564207000" }, { "tcp_stream": 65, "frame_number": 1224, "display_filter": "frame.number == 1224", "timestamp_epoch": "1634913116.566356000" }, { "tcp_stream": 63, "frame_number": 1226, "display_filter": "frame.number == 1226", "timestamp_epoch": "1634913116.567720000" }, { "tcp_stream": 65, "frame_number": 1410, "display_filter": "frame.number == 1410", "timestamp_epoch": "1634913117.486633000" }, { "tcp_stream": 63, "frame_number": 1414, "display_filter": "frame.number == 1414", "timestamp_epoch": "1634913117.493705000" }, { "tcp_stream": 71, "frame_number": 1465, "display_filter": "frame.number == 1465", "timestamp_epoch": "1634913118.528340000" }, { "tcp_stream": 71, "frame_number": 1470, "display_filter": "frame.number == 1470", "timestamp_epoch": "1634913118.529289000" }, { "tcp_stream": 71, "frame_number": 1473, "display_filter": "frame.number == 1473", "timestamp_epoch": "1634913118.530231000" }, { "tcp_stream": 71, "frame_number": 1475, "display_filter": "frame.number == 1475", "timestamp_epoch": "1634913118.531727000" }, { "tcp_stream": 71, "frame_number": 1477, "display_filter": "frame.number == 1477", "timestamp_epoch": "1634913118.532327000" }, { "tcp_stream": 72, "frame_number": 1483, "display_filter": "frame.number == 1483", "timestamp_epoch": "1634913118.537038000" }, { "tcp_stream": 72, "frame_number": 1486, "display_filter": "frame.number == 1486", "timestamp_epoch": "1634913118.538808000" }, { "tcp_stream": 72, "frame_number": 1491, "display_filter": "frame.number == 1491", "timestamp_epoch": "1634913118.539698000" }, { "tcp_stream": 72, "frame_number": 1493, "display_filter": "frame.number == 1493", "timestamp_epoch": "1634913118.540226000" }, { "tcp_stream": 71, "frame_number": 1497, "display_filter": "frame.number == 1497", "timestamp_epoch": "1634913118.540617000" }, { "tcp_stream": 73, "frame_number": 1530, "display_filter": "frame.number == 1530", "timestamp_epoch": "1634913123.730206000" }, { "tcp_stream": 73, "frame_number": 1535, "display_filter": "frame.number == 1535", "timestamp_epoch": "1634913123.733110000" }, { "tcp_stream": 73, "frame_number": 1538, "display_filter": "frame.number == 1538", "timestamp_epoch": "1634913123.736712000" }, { "tcp_stream": 73, "frame_number": 1542, "display_filter": "frame.number == 1542", "timestamp_epoch": "1634913124.126522000" }, { "tcp_stream": 73, "frame_number": 1544, "display_filter": "frame.number == 1544", "timestamp_epoch": "1634913124.127428000" }, { "tcp_stream": 73, "frame_number": 1546, "display_filter": "frame.number == 1546", "timestamp_epoch": "1634913124.134455000" }, { "tcp_stream": 73, "frame_number": 1548, "display_filter": "frame.number == 1548", "timestamp_epoch": "1634913124.135382000" }, { "tcp_stream": 74, "frame_number": 1556, "display_filter": "frame.number == 1556", "timestamp_epoch": "1634913124.232331000" }, { "tcp_stream": 74, "frame_number": 1559, "display_filter": "frame.number == 1559", "timestamp_epoch": "1634913124.234232000" }, { "tcp_stream": 74, "frame_number": 1591, "display_filter": "frame.number == 1591", "timestamp_epoch": "1634913124.241152000" }, { "tcp_stream": 74, "frame_number": 1593, "display_filter": "frame.number == 1593", "timestamp_epoch": "1634913124.242098000" }, { "tcp_stream": 73, "frame_number": 1595, "display_filter": "frame.number == 1595", "timestamp_epoch": "1634913124.242736000" }, { "tcp_stream": 193, "frame_number": 4329, "display_filter": "frame.number == 4329", "timestamp_epoch": "1634913239.402534000" }, { "tcp_stream": 193, "frame_number": 4332, "display_filter": "frame.number == 4332", "timestamp_epoch": "1634913239.409691000" }, { "tcp_stream": 194, "frame_number": 4338, "display_filter": "frame.number == 4338", "timestamp_epoch": "1634913239.430496000" }, { "tcp_stream": 194, "frame_number": 4341, "display_filter": "frame.number == 4341", "timestamp_epoch": "1634913239.432229000" }, { "tcp_stream": 194, "frame_number": 4343, "display_filter": "frame.number == 4343", "timestamp_epoch": "1634913239.432663000" }, { "tcp_stream": 193, "frame_number": 4345, "display_filter": "frame.number == 4345", "timestamp_epoch": "1634913239.433280000" }, { "tcp_stream": 194, "frame_number": 4351, "display_filter": "frame.number == 4351", "timestamp_epoch": "1634913239.768650000" }, { "tcp_stream": 193, "frame_number": 4353, "display_filter": "frame.number == 4353", "timestamp_epoch": "1634913239.774672000" }, { "tcp_stream": 235, "frame_number": 5703, "display_filter": "frame.number == 5703", "timestamp_epoch": "1634913300.078910000" }, { "tcp_stream": 235, "frame_number": 5708, "display_filter": "frame.number == 5708", "timestamp_epoch": "1634913300.081216000" }, { "tcp_stream": 235, "frame_number": 5711, "display_filter": "frame.number == 5711", "timestamp_epoch": "1634913300.082854000" }, { "tcp_stream": 235, "frame_number": 5713, "display_filter": "frame.number == 5713", "timestamp_epoch": "1634913300.083555000" }, { "tcp_stream": 235, "frame_number": 5715, "display_filter": "frame.number == 5715", "timestamp_epoch": "1634913300.084086000" }, { "tcp_stream": 236, "frame_number": 5721, "display_filter": "frame.number == 5721", "timestamp_epoch": "1634913300.088553000" }, { "tcp_stream": 236, "frame_number": 5724, "display_filter": "frame.number == 5724", "timestamp_epoch": "1634913300.089814000" }, { "tcp_stream": 236, "frame_number": 5729, "display_filter": "frame.number == 5729", "timestamp_epoch": "1634913300.090591000" }, { "tcp_stream": 236, "frame_number": 5731, "display_filter": "frame.number == 5731", "timestamp_epoch": "1634913300.091151000" }, { "tcp_stream": 235, "frame_number": 5735, "display_filter": "frame.number == 5735", "timestamp_epoch": "1634913300.091474000" }, { "tcp_stream": 251, "frame_number": 7174, "display_filter": "frame.number == 7174", "timestamp_epoch": "1634913412.867478000" }, { "tcp_stream": 251, "frame_number": 7179, "display_filter": "frame.number == 7179", "timestamp_epoch": "1634913412.869539000" }, { "tcp_stream": 251, "frame_number": 7182, "display_filter": "frame.number == 7182", "timestamp_epoch": "1634913412.870855000" }, { "tcp_stream": 251, "frame_number": 7184, "display_filter": "frame.number == 7184", "timestamp_epoch": "1634913412.871373000" }, { "tcp_stream": 251, "frame_number": 7186, "display_filter": "frame.number == 7186", "timestamp_epoch": "1634913412.871882000" }, { "tcp_stream": 252, "frame_number": 7192, "display_filter": "frame.number == 7192", "timestamp_epoch": "1634913412.878781000" }, { "tcp_stream": 252, "frame_number": 7197, "display_filter": "frame.number == 7197", "timestamp_epoch": "1634913412.880397000" }, { "tcp_stream": 252, "frame_number": 7202, "display_filter": "frame.number == 7202", "timestamp_epoch": "1634913412.881123000" }, { "tcp_stream": 252, "frame_number": 7204, "display_filter": "frame.number == 7204", "timestamp_epoch": "1634913412.881770000" }, { "tcp_stream": 251, "frame_number": 7208, "display_filter": "frame.number == 7208", "timestamp_epoch": "1634913412.882540000" }, { "tcp_stream": 766, "frame_number": 29306, "display_filter": "frame.number == 29306", "timestamp_epoch": "1634915040.562287000" }, { "tcp_stream": 766, "frame_number": 29311, "display_filter": "frame.number == 29311", "timestamp_epoch": "1634915040.564548000" }, { "tcp_stream": 766, "frame_number": 29314, "display_filter": "frame.number == 29314", "timestamp_epoch": "1634915040.565729000" }, { "tcp_stream": 766, "frame_number": 29316, "display_filter": "frame.number == 29316", "timestamp_epoch": "1634915040.566324000" }, { "tcp_stream": 766, "frame_number": 29318, "display_filter": "frame.number == 29318", "timestamp_epoch": "1634915040.566769000" }, { "tcp_stream": 767, "frame_number": 29324, "display_filter": "frame.number == 29324", "timestamp_epoch": "1634915040.572515000" }, { "tcp_stream": 767, "frame_number": 29327, "display_filter": "frame.number == 29327", "timestamp_epoch": "1634915040.573861000" }, { "tcp_stream": 767, "frame_number": 29332, "display_filter": "frame.number == 29332", "timestamp_epoch": "1634915040.574486000" }, { "tcp_stream": 767, "frame_number": 29334, "display_filter": "frame.number == 29334", "timestamp_epoch": "1634915040.574917000" }, { "tcp_stream": 766, "frame_number": 29338, "display_filter": "frame.number == 29338", "timestamp_epoch": "1634915040.575385000" }, { "tcp_stream": 910, "frame_number": 48354, "display_filter": "frame.number == 48354", "timestamp_epoch": "1634915472.195327000" }, { "tcp_stream": 910, "frame_number": 48359, "display_filter": "frame.number == 48359", "timestamp_epoch": "1634915472.196979000" }, { "tcp_stream": 910, "frame_number": 48362, "display_filter": "frame.number == 48362", "timestamp_epoch": "1634915472.198357000" }, { "tcp_stream": 910, "frame_number": 48364, "display_filter": "frame.number == 48364", "timestamp_epoch": "1634915472.198972000" }, { "tcp_stream": 910, "frame_number": 48366, "display_filter": "frame.number == 48366", "timestamp_epoch": "1634915472.199539000" }, { "tcp_stream": 911, "frame_number": 48372, "display_filter": "frame.number == 48372", "timestamp_epoch": "1634915472.204135000" }, { "tcp_stream": 911, "frame_number": 48375, "display_filter": "frame.number == 48375", "timestamp_epoch": "1634915472.205378000" }, { "tcp_stream": 911, "frame_number": 48380, "display_filter": "frame.number == 48380", "timestamp_epoch": "1634915472.206180000" }, { "tcp_stream": 911, "frame_number": 48382, "display_filter": "frame.number == 48382", "timestamp_epoch": "1634915472.206790000" }, { "tcp_stream": 910, "frame_number": 48386, "display_filter": "frame.number == 48386", "timestamp_epoch": "1634915472.207492000" }, { "tcp_stream": 1266, "frame_number": 62122, "display_filter": "frame.number == 62122", "timestamp_epoch": "1634916360.373444000" }, { "tcp_stream": 1266, "frame_number": 62127, "display_filter": "frame.number == 62127", "timestamp_epoch": "1634916360.374681000" }, { "tcp_stream": 1266, "frame_number": 62130, "display_filter": "frame.number == 62130", "timestamp_epoch": "1634916360.375856000" }, { "tcp_stream": 1266, "frame_number": 62132, "display_filter": "frame.number == 62132", "timestamp_epoch": "1634916360.376421000" }, { "tcp_stream": 1266, "frame_number": 62134, "display_filter": "frame.number == 62134", "timestamp_epoch": "1634916360.377005000" }, { "tcp_stream": 1267, "frame_number": 62140, "display_filter": "frame.number == 62140", "timestamp_epoch": "1634916360.380677000" }, { "tcp_stream": 1267, "frame_number": 62143, "display_filter": "frame.number == 62143", "timestamp_epoch": "1634916360.381939000" }, { "tcp_stream": 1267, "frame_number": 62148, "display_filter": "frame.number == 62148", "timestamp_epoch": "1634916360.382574000" } ] }, { "id": "finding-0238a7ca2229bad0f6d62053", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.156", "protocol": "samr", "destination": "10.10.22.22", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 187, "frame_number": 4249, "display_filter": "frame.number == 4249", "timestamp_epoch": "1634913239.083080000" }, { "tcp_stream": 187, "frame_number": 4251, "display_filter": "frame.number == 4251", "timestamp_epoch": "1634913239.083680000" }, { "tcp_stream": 187, "frame_number": 4253, "display_filter": "frame.number == 4253", "timestamp_epoch": "1634913239.084963000" }, { "tcp_stream": 187, "frame_number": 4255, "display_filter": "frame.number == 4255", "timestamp_epoch": "1634913239.085566000" }, { "tcp_stream": 187, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1634913239.086347000" }, { "tcp_stream": 187, "frame_number": 4259, "display_filter": "frame.number == 4259", "timestamp_epoch": "1634913239.086855000" }, { "tcp_stream": 187, "frame_number": 4261, "display_filter": "frame.number == 4261", "timestamp_epoch": "1634913239.087672000" }, { "tcp_stream": 187, "frame_number": 4263, "display_filter": "frame.number == 4263", "timestamp_epoch": "1634913239.088314000" }, { "tcp_stream": 187, "frame_number": 4265, "display_filter": "frame.number == 4265", "timestamp_epoch": "1634913239.089905000" }, { "tcp_stream": 187, "frame_number": 4267, "display_filter": "frame.number == 4267", "timestamp_epoch": "1634913239.090589000" }, { "tcp_stream": 187, "frame_number": 4269, "display_filter": "frame.number == 4269", "timestamp_epoch": "1634913239.091915000" }, { "tcp_stream": 187, "frame_number": 4271, "display_filter": "frame.number == 4271", "timestamp_epoch": "1634913239.092435000" }, { "tcp_stream": 187, "frame_number": 4273, "display_filter": "frame.number == 4273", "timestamp_epoch": "1634913239.093342000" }, { "tcp_stream": 187, "frame_number": 4277, "display_filter": "frame.number == 4277", "timestamp_epoch": "1634913239.093845000" }, { "tcp_stream": 187, "frame_number": 4279, "display_filter": "frame.number == 4279", "timestamp_epoch": "1634913239.095806000" } ] }, { "id": "finding-70ba8618efa297ab380e5ee7", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "protocol": "drsuapi", "destination": "10.10.22.22", "event_count": 49, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 3, "frame_number": 127, "display_filter": "frame.number == 127", "timestamp_epoch": "1634913054.084018000" }, { "tcp_stream": 3, "frame_number": 131, "display_filter": "frame.number == 131", "timestamp_epoch": "1634913054.084736000" }, { "tcp_stream": 3, "frame_number": 134, "display_filter": "frame.number == 134", "timestamp_epoch": "1634913054.085176000" }, { "tcp_stream": 3, "frame_number": 145, "display_filter": "frame.number == 145", "timestamp_epoch": "1634913054.087853000" }, { "tcp_stream": 3, "frame_number": 147, "display_filter": "frame.number == 147", "timestamp_epoch": "1634913054.088446000" }, { "tcp_stream": 3, "frame_number": 151, "display_filter": "frame.number == 151", "timestamp_epoch": "1634913054.089677000" }, { "tcp_stream": 3, "frame_number": 323, "display_filter": "frame.number == 323", "timestamp_epoch": "1634913054.921877000" }, { "tcp_stream": 3, "frame_number": 325, "display_filter": "frame.number == 325", "timestamp_epoch": "1634913054.922433000" }, { "tcp_stream": 3, "frame_number": 327, "display_filter": "frame.number == 327", "timestamp_epoch": "1634913054.923029000" }, { "tcp_stream": 3, "frame_number": 329, "display_filter": "frame.number == 329", "timestamp_epoch": "1634913054.924134000" }, { "tcp_stream": 26, "frame_number": 568, "display_filter": "frame.number == 568", "timestamp_epoch": "1634913057.668444000" }, { "tcp_stream": 26, "frame_number": 570, "display_filter": "frame.number == 570", "timestamp_epoch": "1634913057.669175000" }, { "tcp_stream": 26, "frame_number": 572, "display_filter": "frame.number == 572", "timestamp_epoch": "1634913057.669667000" }, { "tcp_stream": 26, "frame_number": 576, "display_filter": "frame.number == 576", "timestamp_epoch": "1634913057.670928000" }, { "tcp_stream": 26, "frame_number": 578, "display_filter": "frame.number == 578", "timestamp_epoch": "1634913057.671434000" }, { "tcp_stream": 26, "frame_number": 580, "display_filter": "frame.number == 580", "timestamp_epoch": "1634913057.671927000" }, { "tcp_stream": 156, "frame_number": 3444, "display_filter": "frame.number == 3444", "timestamp_epoch": "1634913211.572439000" }, { "tcp_stream": 156, "frame_number": 3446, "display_filter": "frame.number == 3446", "timestamp_epoch": "1634913211.572870000" }, { "tcp_stream": 156, "frame_number": 3448, "display_filter": "frame.number == 3448", "timestamp_epoch": "1634913211.573417000" }, { "tcp_stream": 156, "frame_number": 3450, "display_filter": "frame.number == 3450", "timestamp_epoch": "1634913211.573881000" }, { "tcp_stream": 223, "frame_number": 5320, "display_filter": "frame.number == 5320", "timestamp_epoch": "1634913272.477472000" }, { "tcp_stream": 223, "frame_number": 5322, "display_filter": "frame.number == 5322", "timestamp_epoch": "1634913272.478218000" }, { "tcp_stream": 223, "frame_number": 5324, "display_filter": "frame.number == 5324", "timestamp_epoch": "1634913272.478857000" }, { "tcp_stream": 223, "frame_number": 5328, "display_filter": "frame.number == 5328", "timestamp_epoch": "1634913272.480494000" }, { "tcp_stream": 223, "frame_number": 5330, "display_filter": "frame.number == 5330", "timestamp_epoch": "1634913272.480892000" }, { "tcp_stream": 223, "frame_number": 5332, "display_filter": "frame.number == 5332", "timestamp_epoch": "1634913272.481443000" }, { "tcp_stream": 756, "frame_number": 29090, "display_filter": "frame.number == 29090", "timestamp_epoch": "1634915012.970639000" }, { "tcp_stream": 756, "frame_number": 29095, "display_filter": "frame.number == 29095", "timestamp_epoch": "1634915012.974070000" }, { "tcp_stream": 756, "frame_number": 29097, "display_filter": "frame.number == 29097", "timestamp_epoch": "1634915012.975287000" }, { "tcp_stream": 756, "frame_number": 29099, "display_filter": "frame.number == 29099", "timestamp_epoch": "1634915012.979423000" }, { "tcp_stream": 756, "frame_number": 29101, "display_filter": "frame.number == 29101", "timestamp_epoch": "1634915012.982054000" }, { "tcp_stream": 758, "frame_number": 29118, "display_filter": "frame.number == 29118", "timestamp_epoch": "1634915012.991501000" }, { "tcp_stream": 758, "frame_number": 29120, "display_filter": "frame.number == 29120", "timestamp_epoch": "1634915012.992008000" }, { "tcp_stream": 758, "frame_number": 29122, "display_filter": "frame.number == 29122", "timestamp_epoch": "1634915012.992453000" }, { "tcp_stream": 758, "frame_number": 29126, "display_filter": "frame.number == 29126", "timestamp_epoch": "1634915012.996002000" }, { "tcp_stream": 758, "frame_number": 29128, "display_filter": "frame.number == 29128", "timestamp_epoch": "1634915012.996422000" }, { "tcp_stream": 758, "frame_number": 29130, "display_filter": "frame.number == 29130", "timestamp_epoch": "1634915012.996917000" }, { "tcp_stream": 862, "frame_number": 45075, "display_filter": "frame.number == 45075", "timestamp_epoch": "1634915359.667888000" }, { "tcp_stream": 862, "frame_number": 45077, "display_filter": "frame.number == 45077", "timestamp_epoch": "1634915359.668466000" }, { "tcp_stream": 862, "frame_number": 45079, "display_filter": "frame.number == 45079", "timestamp_epoch": "1634915359.669061000" }, { "tcp_stream": 862, "frame_number": 45083, "display_filter": "frame.number == 45083", "timestamp_epoch": "1634915359.671164000" }, { "tcp_stream": 862, "frame_number": 45085, "display_filter": "frame.number == 45085", "timestamp_epoch": "1634915359.671648000" }, { "tcp_stream": 862, "frame_number": 45087, "display_filter": "frame.number == 45087", "timestamp_epoch": "1634915359.672183000" }, { "tcp_stream": 990, "frame_number": 55100, "display_filter": "frame.number == 55100", "timestamp_epoch": "1634915700.850594000" }, { "tcp_stream": 990, "frame_number": 55102, "display_filter": "frame.number == 55102", "timestamp_epoch": "1634915700.851306000" }, { "tcp_stream": 990, "frame_number": 55104, "display_filter": "frame.number == 55104", "timestamp_epoch": "1634915700.851958000" }, { "tcp_stream": 990, "frame_number": 55108, "display_filter": "frame.number == 55108", "timestamp_epoch": "1634915700.853497000" }, { "tcp_stream": 990, "frame_number": 55110, "display_filter": "frame.number == 55110", "timestamp_epoch": "1634915700.853973000" }, { "tcp_stream": 990, "frame_number": 55112, "display_filter": "frame.number == 55112", "timestamp_epoch": "1634915700.854529000" } ] }, { "id": "finding-d64eb7d358d71721ed0e01e7", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "protocol": "ldap", "destination": "10.10.22.22", "event_count": 92, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 27, "display_filter": "frame.number == 27", "timestamp_epoch": "1634913052.670921000" }, { "tcp_stream": 5, "frame_number": 91, "display_filter": "frame.number == 91", "timestamp_epoch": "1634913054.066859000" }, { "tcp_stream": 5, "frame_number": 120, "display_filter": "frame.number == 120", "timestamp_epoch": "1634913054.081960000" }, { "tcp_stream": 5, "frame_number": 129, "display_filter": "frame.number == 129", "timestamp_epoch": "1634913054.084345000" }, { "tcp_stream": 5, "frame_number": 133, "display_filter": "frame.number == 133", "timestamp_epoch": "1634913054.085147000" }, { "tcp_stream": 5, "frame_number": 168, "display_filter": "frame.number == 168", "timestamp_epoch": "1634913054.223262000" }, { "tcp_stream": 5, "frame_number": 191, "display_filter": "frame.number == 191", "timestamp_epoch": "1634913054.351302000" }, { "tcp_stream": 5, "frame_number": 262, "display_filter": "frame.number == 262", "timestamp_epoch": "1634913054.582704000" }, { "tcp_stream": 5, "frame_number": 271, "display_filter": "frame.number == 271", "timestamp_epoch": "1634913054.584445000" }, { "tcp_stream": 5, "frame_number": 273, "display_filter": "frame.number == 273", "timestamp_epoch": "1634913054.585135000" }, { "tcp_stream": 5, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1634913054.585572000" }, { "tcp_stream": 0, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1634913054.713809000" }, { "tcp_stream": 0, "frame_number": 311, "display_filter": "frame.number == 311", "timestamp_epoch": "1634913054.716993000" }, { "tcp_stream": 20, "frame_number": 347, "display_filter": "frame.number == 347", "timestamp_epoch": "1634913055.632160000" }, { "tcp_stream": 20, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1634913055.634492000" }, { "tcp_stream": 20, "frame_number": 369, "display_filter": "frame.number == 369", "timestamp_epoch": "1634913055.680652000" }, { "tcp_stream": 22, "frame_number": 375, "display_filter": "frame.number == 375", "timestamp_epoch": "1634913055.691325000" }, { "tcp_stream": 22, "frame_number": 378, "display_filter": "frame.number == 378", "timestamp_epoch": "1634913055.692919000" }, { "tcp_stream": 22, "frame_number": 380, "display_filter": "frame.number == 380", "timestamp_epoch": "1634913055.693669000" }, { "tcp_stream": 20, "frame_number": 382, "display_filter": "frame.number == 382", "timestamp_epoch": "1634913055.695343000" }, { "tcp_stream": 22, "frame_number": 535, "display_filter": "frame.number == 535", "timestamp_epoch": "1634913055.808845000" }, { "tcp_stream": 20, "frame_number": 539, "display_filter": "frame.number == 539", "timestamp_epoch": "1634913055.819684000" }, { "tcp_stream": 27, "frame_number": 585, "display_filter": "frame.number == 585", "timestamp_epoch": "1634913057.674583000" }, { "tcp_stream": 27, "frame_number": 590, "display_filter": "frame.number == 590", "timestamp_epoch": "1634913057.675607000" }, { "tcp_stream": 27, "frame_number": 593, "display_filter": "frame.number == 593", "timestamp_epoch": "1634913057.676658000" }, { "tcp_stream": 27, "frame_number": 595, "display_filter": "frame.number == 595", "timestamp_epoch": "1634913057.677216000" }, { "tcp_stream": 27, "frame_number": 597, "display_filter": "frame.number == 597", "timestamp_epoch": "1634913057.677540000" }, { "tcp_stream": 28, "frame_number": 603, "display_filter": "frame.number == 603", "timestamp_epoch": "1634913057.679882000" }, { "tcp_stream": 28, "frame_number": 606, "display_filter": "frame.number == 606", "timestamp_epoch": "1634913057.680832000" }, { "tcp_stream": 28, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1634913057.681429000" }, { "tcp_stream": 28, "frame_number": 613, "display_filter": "frame.number == 613", "timestamp_epoch": "1634913057.681706000" }, { "tcp_stream": 27, "frame_number": 617, "display_filter": "frame.number == 617", "timestamp_epoch": "1634913057.681996000" }, { "tcp_stream": 29, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1634913063.055459000" }, { "tcp_stream": 29, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1634913063.057256000" }, { "tcp_stream": 29, "frame_number": 652, "display_filter": "frame.number == 652", "timestamp_epoch": "1634913063.060362000" }, { "tcp_stream": 29, "frame_number": 654, "display_filter": "frame.number == 654", "timestamp_epoch": "1634913063.060892000" }, { "tcp_stream": 29, "frame_number": 656, "display_filter": "frame.number == 656", "timestamp_epoch": "1634913063.061369000" }, { "tcp_stream": 29, "frame_number": 658, "display_filter": "frame.number == 658", "timestamp_epoch": "1634913063.061889000" }, { "tcp_stream": 29, "frame_number": 660, "display_filter": "frame.number == 660", "timestamp_epoch": "1634913063.062484000" }, { "tcp_stream": 30, "frame_number": 666, "display_filter": "frame.number == 666", "timestamp_epoch": "1634913063.080613000" }, { "tcp_stream": 30, "frame_number": 669, "display_filter": "frame.number == 669", "timestamp_epoch": "1634913063.082465000" }, { "tcp_stream": 30, "frame_number": 703, "display_filter": "frame.number == 703", "timestamp_epoch": "1634913063.089281000" }, { "tcp_stream": 30, "frame_number": 705, "display_filter": "frame.number == 705", "timestamp_epoch": "1634913063.090427000" }, { "tcp_stream": 29, "frame_number": 709, "display_filter": "frame.number == 709", "timestamp_epoch": "1634913063.095392000" }, { "tcp_stream": 163, "frame_number": 3545, "display_filter": "frame.number == 3545", "timestamp_epoch": "1634913211.915528000" }, { "tcp_stream": 163, "frame_number": 3548, "display_filter": "frame.number == 3548", "timestamp_epoch": "1634913211.922015000" }, { "tcp_stream": 164, "frame_number": 3554, "display_filter": "frame.number == 3554", "timestamp_epoch": "1634913211.927868000" }, { "tcp_stream": 164, "frame_number": 3557, "display_filter": "frame.number == 3557", "timestamp_epoch": "1634913211.929270000" }, { "tcp_stream": 164, "frame_number": 3559, "display_filter": "frame.number == 3559", "timestamp_epoch": "1634913211.929660000" }, { "tcp_stream": 163, "frame_number": 3561, "display_filter": "frame.number == 3561", "timestamp_epoch": "1634913211.930238000" }, { "tcp_stream": 164, "frame_number": 3566, "display_filter": "frame.number == 3566", "timestamp_epoch": "1634913212.254621000" }, { "tcp_stream": 163, "frame_number": 3570, "display_filter": "frame.number == 3570", "timestamp_epoch": "1634913212.260252000" }, { "tcp_stream": 224, "frame_number": 5337, "display_filter": "frame.number == 5337", "timestamp_epoch": "1634913272.484081000" }, { "tcp_stream": 224, "frame_number": 5342, "display_filter": "frame.number == 5342", "timestamp_epoch": "1634913272.485732000" }, { "tcp_stream": 224, "frame_number": 5345, "display_filter": "frame.number == 5345", "timestamp_epoch": "1634913272.487225000" }, { "tcp_stream": 224, "frame_number": 5347, "display_filter": "frame.number == 5347", "timestamp_epoch": "1634913272.487850000" }, { "tcp_stream": 224, "frame_number": 5349, "display_filter": "frame.number == 5349", "timestamp_epoch": "1634913272.488351000" }, { "tcp_stream": 225, "frame_number": 5355, "display_filter": "frame.number == 5355", "timestamp_epoch": "1634913272.492155000" }, { "tcp_stream": 225, "frame_number": 5358, "display_filter": "frame.number == 5358", "timestamp_epoch": "1634913272.493575000" }, { "tcp_stream": 225, "frame_number": 5363, "display_filter": "frame.number == 5363", "timestamp_epoch": "1634913272.494266000" }, { "tcp_stream": 225, "frame_number": 5365, "display_filter": "frame.number == 5365", "timestamp_epoch": "1634913272.494952000" }, { "tcp_stream": 224, "frame_number": 5368, "display_filter": "frame.number == 5368", "timestamp_epoch": "1634913272.495327000" }, { "tcp_stream": 759, "frame_number": 29143, "display_filter": "frame.number == 29143", "timestamp_epoch": "1634915013.108820000" }, { "tcp_stream": 759, "frame_number": 29148, "display_filter": "frame.number == 29148", "timestamp_epoch": "1634915013.110781000" }, { "tcp_stream": 759, "frame_number": 29151, "display_filter": "frame.number == 29151", "timestamp_epoch": "1634915013.111735000" }, { "tcp_stream": 759, "frame_number": 29153, "display_filter": "frame.number == 29153", "timestamp_epoch": "1634915013.112377000" }, { "tcp_stream": 759, "frame_number": 29155, "display_filter": "frame.number == 29155", "timestamp_epoch": "1634915013.112853000" }, { "tcp_stream": 760, "frame_number": 29161, "display_filter": "frame.number == 29161", "timestamp_epoch": "1634915013.116822000" }, { "tcp_stream": 760, "frame_number": 29164, "display_filter": "frame.number == 29164", "timestamp_epoch": "1634915013.117922000" }, { "tcp_stream": 760, "frame_number": 29169, "display_filter": "frame.number == 29169", "timestamp_epoch": "1634915013.118551000" }, { "tcp_stream": 760, "frame_number": 29171, "display_filter": "frame.number == 29171", "timestamp_epoch": "1634915013.118981000" }, { "tcp_stream": 759, "frame_number": 29175, "display_filter": "frame.number == 29175", "timestamp_epoch": "1634915013.119500000" }, { "tcp_stream": 863, "frame_number": 45092, "display_filter": "frame.number == 45092", "timestamp_epoch": "1634915359.675946000" }, { "tcp_stream": 863, "frame_number": 45097, "display_filter": "frame.number == 45097", "timestamp_epoch": "1634915359.677394000" }, { "tcp_stream": 863, "frame_number": 45100, "display_filter": "frame.number == 45100", "timestamp_epoch": "1634915359.678787000" }, { "tcp_stream": 863, "frame_number": 45102, "display_filter": "frame.number == 45102", "timestamp_epoch": "1634915359.679410000" }, { "tcp_stream": 863, "frame_number": 45104, "display_filter": "frame.number == 45104", "timestamp_epoch": "1634915359.679885000" }, { "tcp_stream": 864, "frame_number": 45110, "display_filter": "frame.number == 45110", "timestamp_epoch": "1634915359.684024000" }, { "tcp_stream": 864, "frame_number": 45113, "display_filter": "frame.number == 45113", "timestamp_epoch": "1634915359.685220000" }, { "tcp_stream": 864, "frame_number": 45118, "display_filter": "frame.number == 45118", "timestamp_epoch": "1634915359.685912000" }, { "tcp_stream": 864, "frame_number": 45120, "display_filter": "frame.number == 45120", "timestamp_epoch": "1634915359.686433000" }, { "tcp_stream": 863, "frame_number": 45124, "display_filter": "frame.number == 45124", "timestamp_epoch": "1634915359.686853000" }, { "tcp_stream": 991, "frame_number": 55117, "display_filter": "frame.number == 55117", "timestamp_epoch": "1634915700.856930000" }, { "tcp_stream": 991, "frame_number": 55122, "display_filter": "frame.number == 55122", "timestamp_epoch": "1634915700.858087000" }, { "tcp_stream": 991, "frame_number": 55125, "display_filter": "frame.number == 55125", "timestamp_epoch": "1634915700.859233000" }, { "tcp_stream": 991, "frame_number": 55127, "display_filter": "frame.number == 55127", "timestamp_epoch": "1634915700.859774000" }, { "tcp_stream": 991, "frame_number": 55129, "display_filter": "frame.number == 55129", "timestamp_epoch": "1634915700.860401000" }, { "tcp_stream": 992, "frame_number": 55135, "display_filter": "frame.number == 55135", "timestamp_epoch": "1634915700.864029000" }, { "tcp_stream": 992, "frame_number": 55138, "display_filter": "frame.number == 55138", "timestamp_epoch": "1634915700.865256000" }, { "tcp_stream": 992, "frame_number": 55143, "display_filter": "frame.number == 55143", "timestamp_epoch": "1634915700.865987000" }, { "tcp_stream": 992, "frame_number": 55145, "display_filter": "frame.number == 55145", "timestamp_epoch": "1634915700.866535000" }, { "tcp_stream": 991, "frame_number": 55149, "display_filter": "frame.number == 55149", "timestamp_epoch": "1634915700.866844000" } ] }, { "id": "finding-0c69b9a710fe80d354f719f7", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "protocol": "samr", "destination": "10.10.22.22", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 157, "frame_number": 3468, "display_filter": "frame.number == 3468", "timestamp_epoch": "1634913211.594018000" }, { "tcp_stream": 157, "frame_number": 3470, "display_filter": "frame.number == 3470", "timestamp_epoch": "1634913211.594705000" }, { "tcp_stream": 157, "frame_number": 3472, "display_filter": "frame.number == 3472", "timestamp_epoch": "1634913211.595209000" }, { "tcp_stream": 157, "frame_number": 3474, "display_filter": "frame.number == 3474", "timestamp_epoch": "1634913211.595948000" }, { "tcp_stream": 157, "frame_number": 3476, "display_filter": "frame.number == 3476", "timestamp_epoch": "1634913211.596983000" }, { "tcp_stream": 157, "frame_number": 3478, "display_filter": "frame.number == 3478", "timestamp_epoch": "1634913211.597622000" }, { "tcp_stream": 157, "frame_number": 3480, "display_filter": "frame.number == 3480", "timestamp_epoch": "1634913211.598687000" }, { "tcp_stream": 157, "frame_number": 3482, "display_filter": "frame.number == 3482", "timestamp_epoch": "1634913211.599526000" }, { "tcp_stream": 157, "frame_number": 3484, "display_filter": "frame.number == 3484", "timestamp_epoch": "1634913211.600051000" }, { "tcp_stream": 157, "frame_number": 3486, "display_filter": "frame.number == 3486", "timestamp_epoch": "1634913211.600749000" }, { "tcp_stream": 157, "frame_number": 3488, "display_filter": "frame.number == 3488", "timestamp_epoch": "1634913211.601372000" }, { "tcp_stream": 157, "frame_number": 3490, "display_filter": "frame.number == 3490", "timestamp_epoch": "1634913211.602813000" }, { "tcp_stream": 157, "frame_number": 3492, "display_filter": "frame.number == 3492", "timestamp_epoch": "1634913211.605607000" }, { "tcp_stream": 157, "frame_number": 3494, "display_filter": "frame.number == 3494", "timestamp_epoch": "1634913211.606071000" }, { "tcp_stream": 157, "frame_number": 3496, "display_filter": "frame.number == 3496", "timestamp_epoch": "1634913211.606648000" } ] }, { "id": "finding-12e846d5d543dcccccf58dd9", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.158", "protocol": "drsuapi", "destination": "10.10.22.22", "event_count": 53, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 93, "frame_number": 1951, "display_filter": "frame.number == 1951", "timestamp_epoch": "1634913145.884937000" }, { "tcp_stream": 93, "frame_number": 1959, "display_filter": "frame.number == 1959", "timestamp_epoch": "1634913145.885966000" }, { "tcp_stream": 93, "frame_number": 1963, "display_filter": "frame.number == 1963", "timestamp_epoch": "1634913145.886407000" }, { "tcp_stream": 86, "frame_number": 1964, "display_filter": "frame.number == 1964", "timestamp_epoch": "1634913145.886550000" }, { "tcp_stream": 86, "frame_number": 1968, "display_filter": "frame.number == 1968", "timestamp_epoch": "1634913145.886979000" }, { "tcp_stream": 86, "frame_number": 1973, "display_filter": "frame.number == 1973", "timestamp_epoch": "1634913145.887731000" }, { "tcp_stream": 86, "frame_number": 1977, "display_filter": "frame.number == 1977", "timestamp_epoch": "1634913145.888303000" }, { "tcp_stream": 93, "frame_number": 1987, "display_filter": "frame.number == 1987", "timestamp_epoch": "1634913145.890289000" }, { "tcp_stream": 93, "frame_number": 1989, "display_filter": "frame.number == 1989", "timestamp_epoch": "1634913145.891203000" }, { "tcp_stream": 93, "frame_number": 1991, "display_filter": "frame.number == 1991", "timestamp_epoch": "1634913145.892049000" }, { "tcp_stream": 101, "frame_number": 2039, "display_filter": "frame.number == 2039", "timestamp_epoch": "1634913145.971877000" }, { "tcp_stream": 101, "frame_number": 2041, "display_filter": "frame.number == 2041", "timestamp_epoch": "1634913145.972435000" }, { "tcp_stream": 101, "frame_number": 2043, "display_filter": "frame.number == 2043", "timestamp_epoch": "1634913145.973199000" }, { "tcp_stream": 101, "frame_number": 2045, "display_filter": "frame.number == 2045", "timestamp_epoch": "1634913145.973688000" }, { "tcp_stream": 113, "frame_number": 2339, "display_filter": "frame.number == 2339", "timestamp_epoch": "1634913149.377451000" }, { "tcp_stream": 113, "frame_number": 2341, "display_filter": "frame.number == 2341", "timestamp_epoch": "1634913149.378030000" }, { "tcp_stream": 113, "frame_number": 2343, "display_filter": "frame.number == 2343", "timestamp_epoch": "1634913149.379052000" }, { "tcp_stream": 113, "frame_number": 2347, "display_filter": "frame.number == 2347", "timestamp_epoch": "1634913149.380709000" }, { "tcp_stream": 113, "frame_number": 2349, "display_filter": "frame.number == 2349", "timestamp_epoch": "1634913149.381301000" }, { "tcp_stream": 113, "frame_number": 2351, "display_filter": "frame.number == 2351", "timestamp_epoch": "1634913149.381705000" }, { "tcp_stream": 93, "frame_number": 2670, "display_filter": "frame.number == 2670", "timestamp_epoch": "1634913184.597167000" }, { "tcp_stream": 93, "frame_number": 2672, "display_filter": "frame.number == 2672", "timestamp_epoch": "1634913184.597928000" }, { "tcp_stream": 93, "frame_number": 2674, "display_filter": "frame.number == 2674", "timestamp_epoch": "1634913184.598446000" }, { "tcp_stream": 93, "frame_number": 2676, "display_filter": "frame.number == 2676", "timestamp_epoch": "1634913184.599283000" }, { "tcp_stream": 215, "frame_number": 5052, "display_filter": "frame.number == 5052", "timestamp_epoch": "1634913245.551905000" }, { "tcp_stream": 215, "frame_number": 5054, "display_filter": "frame.number == 5054", "timestamp_epoch": "1634913245.552668000" }, { "tcp_stream": 215, "frame_number": 5056, "display_filter": "frame.number == 5056", "timestamp_epoch": "1634913245.553271000" }, { "tcp_stream": 215, "frame_number": 5060, "display_filter": "frame.number == 5060", "timestamp_epoch": "1634913245.554901000" }, { "tcp_stream": 215, "frame_number": 5062, "display_filter": "frame.number == 5062", "timestamp_epoch": "1634913245.555415000" }, { "tcp_stream": 215, "frame_number": 5064, "display_filter": "frame.number == 5064", "timestamp_epoch": "1634913245.555988000" }, { "tcp_stream": 746, "frame_number": 26063, "display_filter": "frame.number == 26063", "timestamp_epoch": "1634914985.976706000" }, { "tcp_stream": 746, "frame_number": 26065, "display_filter": "frame.number == 26065", "timestamp_epoch": "1634914985.977191000" }, { "tcp_stream": 746, "frame_number": 26067, "display_filter": "frame.number == 26067", "timestamp_epoch": "1634914985.977698000" }, { "tcp_stream": 746, "frame_number": 26069, "display_filter": "frame.number == 26069", "timestamp_epoch": "1634914985.979046000" }, { "tcp_stream": 746, "frame_number": 26071, "display_filter": "frame.number == 26071", "timestamp_epoch": "1634914985.979397000" }, { "tcp_stream": 748, "frame_number": 26091, "display_filter": "frame.number == 26091", "timestamp_epoch": "1634914985.998788000" }, { "tcp_stream": 748, "frame_number": 26093, "display_filter": "frame.number == 26093", "timestamp_epoch": "1634914985.999315000" }, { "tcp_stream": 748, "frame_number": 26097, "display_filter": "frame.number == 26097", "timestamp_epoch": "1634914986.000194000" }, { "tcp_stream": 748, "frame_number": 26101, "display_filter": "frame.number == 26101", "timestamp_epoch": "1634914986.002228000" }, { "tcp_stream": 748, "frame_number": 26103, "display_filter": "frame.number == 26103", "timestamp_epoch": "1634914986.002603000" }, { "tcp_stream": 748, "frame_number": 26105, "display_filter": "frame.number == 26105", "timestamp_epoch": "1634914986.003084000" }, { "tcp_stream": 857, "frame_number": 44961, "display_filter": "frame.number == 44961", "timestamp_epoch": "1634915357.648080000" }, { "tcp_stream": 857, "frame_number": 44963, "display_filter": "frame.number == 44963", "timestamp_epoch": "1634915357.648718000" }, { "tcp_stream": 857, "frame_number": 44965, "display_filter": "frame.number == 44965", "timestamp_epoch": "1634915357.649430000" }, { "tcp_stream": 857, "frame_number": 44969, "display_filter": "frame.number == 44969", "timestamp_epoch": "1634915357.652016000" }, { "tcp_stream": 857, "frame_number": 44971, "display_filter": "frame.number == 44971", "timestamp_epoch": "1634915357.652566000" }, { "tcp_stream": 857, "frame_number": 44973, "display_filter": "frame.number == 44973", "timestamp_epoch": "1634915357.653210000" }, { "tcp_stream": 1156, "frame_number": 59918, "display_filter": "frame.number == 59918", "timestamp_epoch": "1634916153.388006000" }, { "tcp_stream": 1156, "frame_number": 59920, "display_filter": "frame.number == 59920", "timestamp_epoch": "1634916153.388785000" }, { "tcp_stream": 1156, "frame_number": 59922, "display_filter": "frame.number == 59922", "timestamp_epoch": "1634916153.389426000" }, { "tcp_stream": 1156, "frame_number": 59926, "display_filter": "frame.number == 59926", "timestamp_epoch": "1634916153.391052000" }, { "tcp_stream": 1156, "frame_number": 59928, "display_filter": "frame.number == 59928", "timestamp_epoch": "1634916153.391617000" }, { "tcp_stream": 1156, "frame_number": 59930, "display_filter": "frame.number == 59930", "timestamp_epoch": "1634916153.392143000" } ] }, { "id": "finding-d8531db588d532f4ff3105ad", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.158", "protocol": "ldap", "destination": "10.10.22.22", "event_count": 88, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 79, "frame_number": 1696, "display_filter": "frame.number == 1696", "timestamp_epoch": "1634913144.099614000" }, { "tcp_stream": 84, "frame_number": 1776, "display_filter": "frame.number == 1776", "timestamp_epoch": "1634913145.845281000" }, { "tcp_stream": 79, "frame_number": 1907, "display_filter": "frame.number == 1907", "timestamp_epoch": "1634913145.880301000" }, { "tcp_stream": 84, "frame_number": 1938, "display_filter": "frame.number == 1938", "timestamp_epoch": "1634913145.883226000" }, { "tcp_stream": 84, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1634913145.886189000" }, { "tcp_stream": 84, "frame_number": 1969, "display_filter": "frame.number == 1969", "timestamp_epoch": "1634913145.887055000" }, { "tcp_stream": 79, "frame_number": 1980, "display_filter": "frame.number == 1980", "timestamp_epoch": "1634913145.888620000" }, { "tcp_stream": 84, "frame_number": 2057, "display_filter": "frame.number == 2057", "timestamp_epoch": "1634913146.035188000" }, { "tcp_stream": 84, "frame_number": 2073, "display_filter": "frame.number == 2073", "timestamp_epoch": "1634913146.159783000" }, { "tcp_stream": 84, "frame_number": 2086, "display_filter": "frame.number == 2086", "timestamp_epoch": "1634913146.347236000" }, { "tcp_stream": 84, "frame_number": 2094, "display_filter": "frame.number == 2094", "timestamp_epoch": "1634913146.349035000" }, { "tcp_stream": 84, "frame_number": 2097, "display_filter": "frame.number == 2097", "timestamp_epoch": "1634913146.349962000" }, { "tcp_stream": 84, "frame_number": 2099, "display_filter": "frame.number == 2099", "timestamp_epoch": "1634913146.350837000" }, { "tcp_stream": 107, "frame_number": 2112, "display_filter": "frame.number == 2112", "timestamp_epoch": "1634913147.179999000" }, { "tcp_stream": 107, "frame_number": 2117, "display_filter": "frame.number == 2117", "timestamp_epoch": "1634913147.183229000" }, { "tcp_stream": 107, "frame_number": 2134, "display_filter": "frame.number == 2134", "timestamp_epoch": "1634913147.409943000" }, { "tcp_stream": 109, "frame_number": 2140, "display_filter": "frame.number == 2140", "timestamp_epoch": "1634913147.420786000" }, { "tcp_stream": 109, "frame_number": 2143, "display_filter": "frame.number == 2143", "timestamp_epoch": "1634913147.422215000" }, { "tcp_stream": 109, "frame_number": 2145, "display_filter": "frame.number == 2145", "timestamp_epoch": "1634913147.422751000" }, { "tcp_stream": 107, "frame_number": 2147, "display_filter": "frame.number == 2147", "timestamp_epoch": "1634913147.423843000" }, { "tcp_stream": 109, "frame_number": 2300, "display_filter": "frame.number == 2300", "timestamp_epoch": "1634913147.711144000" }, { "tcp_stream": 107, "frame_number": 2304, "display_filter": "frame.number == 2304", "timestamp_epoch": "1634913147.737004000" }, { "tcp_stream": 114, "frame_number": 2356, "display_filter": "frame.number == 2356", "timestamp_epoch": "1634913149.399513000" }, { "tcp_stream": 114, "frame_number": 2361, "display_filter": "frame.number == 2361", "timestamp_epoch": "1634913149.400779000" }, { "tcp_stream": 114, "frame_number": 2364, "display_filter": "frame.number == 2364", "timestamp_epoch": "1634913149.402236000" }, { "tcp_stream": 114, "frame_number": 2366, "display_filter": "frame.number == 2366", "timestamp_epoch": "1634913149.403090000" }, { "tcp_stream": 114, "frame_number": 2368, "display_filter": "frame.number == 2368", "timestamp_epoch": "1634913149.403866000" }, { "tcp_stream": 115, "frame_number": 2374, "display_filter": "frame.number == 2374", "timestamp_epoch": "1634913149.410923000" }, { "tcp_stream": 115, "frame_number": 2377, "display_filter": "frame.number == 2377", "timestamp_epoch": "1634913149.412324000" }, { "tcp_stream": 115, "frame_number": 2382, "display_filter": "frame.number == 2382", "timestamp_epoch": "1634913149.413016000" }, { "tcp_stream": 115, "frame_number": 2384, "display_filter": "frame.number == 2384", "timestamp_epoch": "1634913149.414592000" }, { "tcp_stream": 114, "frame_number": 2388, "display_filter": "frame.number == 2388", "timestamp_epoch": "1634913149.414913000" }, { "tcp_stream": 116, "frame_number": 2414, "display_filter": "frame.number == 2414", "timestamp_epoch": "1634913154.532143000" }, { "tcp_stream": 116, "frame_number": 2419, "display_filter": "frame.number == 2419", "timestamp_epoch": "1634913154.534184000" }, { "tcp_stream": 116, "frame_number": 2423, "display_filter": "frame.number == 2423", "timestamp_epoch": "1634913154.546386000" }, { "tcp_stream": 116, "frame_number": 2425, "display_filter": "frame.number == 2425", "timestamp_epoch": "1634913154.546948000" }, { "tcp_stream": 116, "frame_number": 2427, "display_filter": "frame.number == 2427", "timestamp_epoch": "1634913154.547360000" }, { "tcp_stream": 116, "frame_number": 2429, "display_filter": "frame.number == 2429", "timestamp_epoch": "1634913154.547791000" }, { "tcp_stream": 116, "frame_number": 2431, "display_filter": "frame.number == 2431", "timestamp_epoch": "1634913154.548304000" }, { "tcp_stream": 116, "frame_number": 2463, "display_filter": "frame.number == 2463", "timestamp_epoch": "1634913154.574982000" }, { "tcp_stream": 133, "frame_number": 2799, "display_filter": "frame.number == 2799", "timestamp_epoch": "1634913184.961165000" }, { "tcp_stream": 133, "frame_number": 2802, "display_filter": "frame.number == 2802", "timestamp_epoch": "1634913184.966629000" }, { "tcp_stream": 134, "frame_number": 2808, "display_filter": "frame.number == 2808", "timestamp_epoch": "1634913184.972998000" }, { "tcp_stream": 134, "frame_number": 2811, "display_filter": "frame.number == 2811", "timestamp_epoch": "1634913184.974676000" }, { "tcp_stream": 134, "frame_number": 2813, "display_filter": "frame.number == 2813", "timestamp_epoch": "1634913184.975209000" }, { "tcp_stream": 133, "frame_number": 2815, "display_filter": "frame.number == 2815", "timestamp_epoch": "1634913184.975867000" }, { "tcp_stream": 134, "frame_number": 2832, "display_filter": "frame.number == 2832", "timestamp_epoch": "1634913185.296883000" }, { "tcp_stream": 133, "frame_number": 2841, "display_filter": "frame.number == 2841", "timestamp_epoch": "1634913185.486261000" }, { "tcp_stream": 216, "frame_number": 5069, "display_filter": "frame.number == 5069", "timestamp_epoch": "1634913245.558681000" }, { "tcp_stream": 216, "frame_number": 5074, "display_filter": "frame.number == 5074", "timestamp_epoch": "1634913245.559977000" }, { "tcp_stream": 216, "frame_number": 5077, "display_filter": "frame.number == 5077", "timestamp_epoch": "1634913245.561177000" }, { "tcp_stream": 216, "frame_number": 5079, "display_filter": "frame.number == 5079", "timestamp_epoch": "1634913245.561713000" }, { "tcp_stream": 216, "frame_number": 5081, "display_filter": "frame.number == 5081", "timestamp_epoch": "1634913245.562183000" }, { "tcp_stream": 217, "frame_number": 5087, "display_filter": "frame.number == 5087", "timestamp_epoch": "1634913245.565701000" }, { "tcp_stream": 217, "frame_number": 5090, "display_filter": "frame.number == 5090", "timestamp_epoch": "1634913245.567065000" }, { "tcp_stream": 217, "frame_number": 5095, "display_filter": "frame.number == 5095", "timestamp_epoch": "1634913245.567751000" }, { "tcp_stream": 217, "frame_number": 5097, "display_filter": "frame.number == 5097", "timestamp_epoch": "1634913245.568251000" }, { "tcp_stream": 216, "frame_number": 5101, "display_filter": "frame.number == 5101", "timestamp_epoch": "1634913245.568666000" }, { "tcp_stream": 749, "frame_number": 26116, "display_filter": "frame.number == 26116", "timestamp_epoch": "1634914986.117846000" }, { "tcp_stream": 749, "frame_number": 26121, "display_filter": "frame.number == 26121", "timestamp_epoch": "1634914986.119336000" }, { "tcp_stream": 749, "frame_number": 26124, "display_filter": "frame.number == 26124", "timestamp_epoch": "1634914986.120789000" }, { "tcp_stream": 749, "frame_number": 26126, "display_filter": "frame.number == 26126", "timestamp_epoch": "1634914986.121313000" }, { "tcp_stream": 749, "frame_number": 26128, "display_filter": "frame.number == 26128", "timestamp_epoch": "1634914986.121787000" }, { "tcp_stream": 750, "frame_number": 26134, "display_filter": "frame.number == 26134", "timestamp_epoch": "1634914986.126481000" }, { "tcp_stream": 750, "frame_number": 26137, "display_filter": "frame.number == 26137", "timestamp_epoch": "1634914986.127848000" }, { "tcp_stream": 750, "frame_number": 26142, "display_filter": "frame.number == 26142", "timestamp_epoch": "1634914986.128479000" }, { "tcp_stream": 750, "frame_number": 26144, "display_filter": "frame.number == 26144", "timestamp_epoch": "1634914986.129046000" }, { "tcp_stream": 749, "frame_number": 26146, "display_filter": "frame.number == 26146", "timestamp_epoch": "1634914986.129421000" }, { "tcp_stream": 858, "frame_number": 44978, "display_filter": "frame.number == 44978", "timestamp_epoch": "1634915357.656910000" }, { "tcp_stream": 858, "frame_number": 44983, "display_filter": "frame.number == 44983", "timestamp_epoch": "1634915357.658347000" }, { "tcp_stream": 858, "frame_number": 44986, "display_filter": "frame.number == 44986", "timestamp_epoch": "1634915357.659605000" }, { "tcp_stream": 858, "frame_number": 44988, "display_filter": "frame.number == 44988", "timestamp_epoch": "1634915357.660189000" }, { "tcp_stream": 858, "frame_number": 44990, "display_filter": "frame.number == 44990", "timestamp_epoch": "1634915357.660713000" }, { "tcp_stream": 859, "frame_number": 44996, "display_filter": "frame.number == 44996", "timestamp_epoch": "1634915357.665313000" }, { "tcp_stream": 859, "frame_number": 44999, "display_filter": "frame.number == 44999", "timestamp_epoch": "1634915357.666563000" }, { "tcp_stream": 859, "frame_number": 45004, "display_filter": "frame.number == 45004", "timestamp_epoch": "1634915357.667258000" }, { "tcp_stream": 859, "frame_number": 45006, "display_filter": "frame.number == 45006", "timestamp_epoch": "1634915357.667871000" }, { "tcp_stream": 858, "frame_number": 45010, "display_filter": "frame.number == 45010", "timestamp_epoch": "1634915357.668326000" }, { "tcp_stream": 1157, "frame_number": 59935, "display_filter": "frame.number == 59935", "timestamp_epoch": "1634916153.394721000" }, { "tcp_stream": 1157, "frame_number": 59940, "display_filter": "frame.number == 59940", "timestamp_epoch": "1634916153.396019000" }, { "tcp_stream": 1157, "frame_number": 59943, "display_filter": "frame.number == 59943", "timestamp_epoch": "1634916153.397277000" }, { "tcp_stream": 1157, "frame_number": 59945, "display_filter": "frame.number == 59945", "timestamp_epoch": "1634916153.397897000" }, { "tcp_stream": 1157, "frame_number": 59947, "display_filter": "frame.number == 59947", "timestamp_epoch": "1634916153.398442000" }, { "tcp_stream": 1158, "frame_number": 59953, "display_filter": "frame.number == 59953", "timestamp_epoch": "1634916153.402217000" }, { "tcp_stream": 1158, "frame_number": 59956, "display_filter": "frame.number == 59956", "timestamp_epoch": "1634916153.403549000" }, { "tcp_stream": 1158, "frame_number": 59961, "display_filter": "frame.number == 59961", "timestamp_epoch": "1634916153.404179000" }, { "tcp_stream": 1158, "frame_number": 59963, "display_filter": "frame.number == 59963", "timestamp_epoch": "1634916153.404767000" }, { "tcp_stream": 1157, "frame_number": 59967, "display_filter": "frame.number == 59967", "timestamp_epoch": "1634916153.405139000" } ] }, { "id": "finding-5d8e3537282af3047f14e7ce", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.158", "protocol": "samr", "destination": "10.10.22.22", "event_count": 43, "operation_numbers": [ "1", "16", "17", "18", "19", "20", "25", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 126, "frame_number": 2699, "display_filter": "frame.number == 2699", "timestamp_epoch": "1634913184.621674000" }, { "tcp_stream": 126, "frame_number": 2701, "display_filter": "frame.number == 2701", "timestamp_epoch": "1634913184.622475000" }, { "tcp_stream": 126, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1634913184.623727000" }, { "tcp_stream": 126, "frame_number": 2705, "display_filter": "frame.number == 2705", "timestamp_epoch": "1634913184.624481000" }, { "tcp_stream": 126, "frame_number": 2708, "display_filter": "frame.number == 2708", "timestamp_epoch": "1634913184.625209000" }, { "tcp_stream": 126, "frame_number": 2710, "display_filter": "frame.number == 2710", "timestamp_epoch": "1634913184.626066000" }, { "tcp_stream": 126, "frame_number": 2712, "display_filter": "frame.number == 2712", "timestamp_epoch": "1634913184.628349000" }, { "tcp_stream": 126, "frame_number": 2714, "display_filter": "frame.number == 2714", "timestamp_epoch": "1634913184.629308000" }, { "tcp_stream": 126, "frame_number": 2716, "display_filter": "frame.number == 2716", "timestamp_epoch": "1634913184.630349000" }, { "tcp_stream": 126, "frame_number": 2718, "display_filter": "frame.number == 2718", "timestamp_epoch": "1634913184.630974000" }, { "tcp_stream": 126, "frame_number": 2720, "display_filter": "frame.number == 2720", "timestamp_epoch": "1634913184.633648000" }, { "tcp_stream": 126, "frame_number": 2722, "display_filter": "frame.number == 2722", "timestamp_epoch": "1634913184.634314000" }, { "tcp_stream": 126, "frame_number": 2726, "display_filter": "frame.number == 2726", "timestamp_epoch": "1634913184.640159000" }, { "tcp_stream": 126, "frame_number": 2728, "display_filter": "frame.number == 2728", "timestamp_epoch": "1634913184.640873000" }, { "tcp_stream": 126, "frame_number": 2730, "display_filter": "frame.number == 2730", "timestamp_epoch": "1634913184.641959000" }, { "tcp_stream": 550, "frame_number": 23457, "display_filter": "frame.number == 23457", "timestamp_epoch": "1634914507.247789000" }, { "tcp_stream": 550, "frame_number": 23459, "display_filter": "frame.number == 23459", "timestamp_epoch": "1634914507.248606000" }, { "tcp_stream": 550, "frame_number": 23461, "display_filter": "frame.number == 23461", "timestamp_epoch": "1634914507.249274000" }, { "tcp_stream": 550, "frame_number": 23463, "display_filter": "frame.number == 23463", "timestamp_epoch": "1634914507.249859000" }, { "tcp_stream": 550, "frame_number": 23465, "display_filter": "frame.number == 23465", "timestamp_epoch": "1634914507.250590000" }, { "tcp_stream": 550, "frame_number": 23467, "display_filter": "frame.number == 23467", "timestamp_epoch": "1634914507.252283000" }, { "tcp_stream": 550, "frame_number": 23469, "display_filter": "frame.number == 23469", "timestamp_epoch": "1634914507.253047000" }, { "tcp_stream": 550, "frame_number": 23471, "display_filter": "frame.number == 23471", "timestamp_epoch": "1634914507.254456000" }, { "tcp_stream": 550, "frame_number": 23473, "display_filter": "frame.number == 23473", "timestamp_epoch": "1634914507.254999000" }, { "tcp_stream": 550, "frame_number": 23475, "display_filter": "frame.number == 23475", "timestamp_epoch": "1634914507.255512000" }, { "tcp_stream": 550, "frame_number": 23487, "display_filter": "frame.number == 23487", "timestamp_epoch": "1634914507.261197000" }, { "tcp_stream": 550, "frame_number": 23489, "display_filter": "frame.number == 23489", "timestamp_epoch": "1634914507.261818000" }, { "tcp_stream": 550, "frame_number": 23491, "display_filter": "frame.number == 23491", "timestamp_epoch": "1634914507.262453000" }, { "tcp_stream": 550, "frame_number": 23493, "display_filter": "frame.number == 23493", "timestamp_epoch": "1634914507.263186000" }, { "tcp_stream": 550, "frame_number": 23495, "display_filter": "frame.number == 23495", "timestamp_epoch": "1634914507.263891000" }, { "tcp_stream": 550, "frame_number": 23497, "display_filter": "frame.number == 23497", "timestamp_epoch": "1634914507.264619000" }, { "tcp_stream": 550, "frame_number": 23499, "display_filter": "frame.number == 23499", "timestamp_epoch": "1634914507.265229000" }, { "tcp_stream": 550, "frame_number": 23501, "display_filter": "frame.number == 23501", "timestamp_epoch": "1634914507.265925000" }, { "tcp_stream": 550, "frame_number": 23503, "display_filter": "frame.number == 23503", "timestamp_epoch": "1634914507.266521000" }, { "tcp_stream": 550, "frame_number": 23505, "display_filter": "frame.number == 23505", "timestamp_epoch": "1634914507.267052000" }, { "tcp_stream": 550, "frame_number": 23507, "display_filter": "frame.number == 23507", "timestamp_epoch": "1634914507.267509000" }, { "tcp_stream": 550, "frame_number": 23538, "display_filter": "frame.number == 23538", "timestamp_epoch": "1634914507.432902000" }, { "tcp_stream": 550, "frame_number": 23540, "display_filter": "frame.number == 23540", "timestamp_epoch": "1634914507.433690000" }, { "tcp_stream": 550, "frame_number": 23542, "display_filter": "frame.number == 23542", "timestamp_epoch": "1634914507.434454000" }, { "tcp_stream": 550, "frame_number": 23544, "display_filter": "frame.number == 23544", "timestamp_epoch": "1634914507.435097000" }, { "tcp_stream": 550, "frame_number": 23546, "display_filter": "frame.number == 23546", "timestamp_epoch": "1634914507.435755000" }, { "tcp_stream": 550, "frame_number": 23548, "display_filter": "frame.number == 23548", "timestamp_epoch": "1634914507.436463000" }, { "tcp_stream": 550, "frame_number": 23550, "display_filter": "frame.number == 23550", "timestamp_epoch": "1634914507.437063000" } ] }, { "id": "finding-56efbcbd1fd55dee2ebde040", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.22", "protocol": "drsuapi", "destination": "10.10.22.156", "event_count": 59, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 46, "frame_number": 1000, "display_filter": "frame.number == 1000", "timestamp_epoch": "1634913114.921280000" }, { "tcp_stream": 46, "frame_number": 1002, "display_filter": "frame.number == 1002", "timestamp_epoch": "1634913114.921892000" }, { "tcp_stream": 46, "frame_number": 1004, "display_filter": "frame.number == 1004", "timestamp_epoch": "1634913114.922326000" }, { "tcp_stream": 46, "frame_number": 1014, "display_filter": "frame.number == 1014", "timestamp_epoch": "1634913114.924857000" }, { "tcp_stream": 46, "frame_number": 1016, "display_filter": "frame.number == 1016", "timestamp_epoch": "1634913114.925592000" }, { "tcp_stream": 46, "frame_number": 1018, "display_filter": "frame.number == 1018", "timestamp_epoch": "1634913114.926303000" }, { "tcp_stream": 53, "frame_number": 1031, "display_filter": "frame.number == 1031", "timestamp_epoch": "1634913114.935544000" }, { "tcp_stream": 53, "frame_number": 1033, "display_filter": "frame.number == 1033", "timestamp_epoch": "1634913114.936040000" }, { "tcp_stream": 53, "frame_number": 1035, "display_filter": "frame.number == 1035", "timestamp_epoch": "1634913114.936321000" }, { "tcp_stream": 53, "frame_number": 1037, "display_filter": "frame.number == 1037", "timestamp_epoch": "1634913114.936560000" }, { "tcp_stream": 57, "frame_number": 1121, "display_filter": "frame.number == 1121", "timestamp_epoch": "1634913115.055859000" }, { "tcp_stream": 57, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1634913115.056664000" }, { "tcp_stream": 57, "frame_number": 1125, "display_filter": "frame.number == 1125", "timestamp_epoch": "1634913115.057392000" }, { "tcp_stream": 57, "frame_number": 1127, "display_filter": "frame.number == 1127", "timestamp_epoch": "1634913115.057699000" }, { "tcp_stream": 70, "frame_number": 1449, "display_filter": "frame.number == 1449", "timestamp_epoch": "1634913118.520149000" }, { "tcp_stream": 70, "frame_number": 1451, "display_filter": "frame.number == 1451", "timestamp_epoch": "1634913118.520996000" }, { "tcp_stream": 70, "frame_number": 1453, "display_filter": "frame.number == 1453", "timestamp_epoch": "1634913118.522657000" }, { "tcp_stream": 70, "frame_number": 1457, "display_filter": "frame.number == 1457", "timestamp_epoch": "1634913118.524259000" }, { "tcp_stream": 70, "frame_number": 1459, "display_filter": "frame.number == 1459", "timestamp_epoch": "1634913118.525441000" }, { "tcp_stream": 70, "frame_number": 1461, "display_filter": "frame.number == 1461", "timestamp_epoch": "1634913118.525893000" }, { "tcp_stream": 183, "frame_number": 4224, "display_filter": "frame.number == 4224", "timestamp_epoch": "1634913239.064431000" }, { "tcp_stream": 183, "frame_number": 4226, "display_filter": "frame.number == 4226", "timestamp_epoch": "1634913239.065004000" }, { "tcp_stream": 183, "frame_number": 4228, "display_filter": "frame.number == 4228", "timestamp_epoch": "1634913239.065459000" }, { "tcp_stream": 183, "frame_number": 4230, "display_filter": "frame.number == 4230", "timestamp_epoch": "1634913239.065774000" }, { "tcp_stream": 234, "frame_number": 5687, "display_filter": "frame.number == 5687", "timestamp_epoch": "1634913300.071212000" }, { "tcp_stream": 234, "frame_number": 5689, "display_filter": "frame.number == 5689", "timestamp_epoch": "1634913300.071960000" }, { "tcp_stream": 234, "frame_number": 5691, "display_filter": "frame.number == 5691", "timestamp_epoch": "1634913300.072402000" }, { "tcp_stream": 234, "frame_number": 5695, "display_filter": "frame.number == 5695", "timestamp_epoch": "1634913300.074003000" }, { "tcp_stream": 234, "frame_number": 5697, "display_filter": "frame.number == 5697", "timestamp_epoch": "1634913300.074639000" }, { "tcp_stream": 234, "frame_number": 5699, "display_filter": "frame.number == 5699", "timestamp_epoch": "1634913300.075212000" }, { "tcp_stream": 250, "frame_number": 7158, "display_filter": "frame.number == 7158", "timestamp_epoch": "1634913412.852651000" }, { "tcp_stream": 250, "frame_number": 7160, "display_filter": "frame.number == 7160", "timestamp_epoch": "1634913412.853239000" }, { "tcp_stream": 250, "frame_number": 7162, "display_filter": "frame.number == 7162", "timestamp_epoch": "1634913412.853595000" }, { "tcp_stream": 250, "frame_number": 7166, "display_filter": "frame.number == 7166", "timestamp_epoch": "1634913412.858512000" }, { "tcp_stream": 250, "frame_number": 7168, "display_filter": "frame.number == 7168", "timestamp_epoch": "1634913412.859040000" }, { "tcp_stream": 250, "frame_number": 7170, "display_filter": "frame.number == 7170", "timestamp_epoch": "1634913412.859400000" }, { "tcp_stream": 763, "frame_number": 29255, "display_filter": "frame.number == 29255", "timestamp_epoch": "1634915040.434726000" }, { "tcp_stream": 763, "frame_number": 29257, "display_filter": "frame.number == 29257", "timestamp_epoch": "1634915040.435298000" }, { "tcp_stream": 763, "frame_number": 29259, "display_filter": "frame.number == 29259", "timestamp_epoch": "1634915040.435667000" }, { "tcp_stream": 763, "frame_number": 29261, "display_filter": "frame.number == 29261", "timestamp_epoch": "1634915040.436007000" }, { "tcp_stream": 763, "frame_number": 29263, "display_filter": "frame.number == 29263", "timestamp_epoch": "1634915040.436447000" }, { "tcp_stream": 765, "frame_number": 29281, "display_filter": "frame.number == 29281", "timestamp_epoch": "1634915040.451582000" }, { "tcp_stream": 765, "frame_number": 29285, "display_filter": "frame.number == 29285", "timestamp_epoch": "1634915040.452359000" }, { "tcp_stream": 765, "frame_number": 29287, "display_filter": "frame.number == 29287", "timestamp_epoch": "1634915040.452800000" }, { "tcp_stream": 765, "frame_number": 29291, "display_filter": "frame.number == 29291", "timestamp_epoch": "1634915040.454741000" }, { "tcp_stream": 765, "frame_number": 29293, "display_filter": "frame.number == 29293", "timestamp_epoch": "1634915040.455260000" }, { "tcp_stream": 765, "frame_number": 29295, "display_filter": "frame.number == 29295", "timestamp_epoch": "1634915040.455644000" }, { "tcp_stream": 909, "frame_number": 48338, "display_filter": "frame.number == 48338", "timestamp_epoch": "1634915472.186917000" }, { "tcp_stream": 909, "frame_number": 48340, "display_filter": "frame.number == 48340", "timestamp_epoch": "1634915472.187661000" }, { "tcp_stream": 909, "frame_number": 48342, "display_filter": "frame.number == 48342", "timestamp_epoch": "1634915472.188212000" }, { "tcp_stream": 909, "frame_number": 48346, "display_filter": "frame.number == 48346", "timestamp_epoch": "1634915472.190443000" }, { "tcp_stream": 909, "frame_number": 48348, "display_filter": "frame.number == 48348", "timestamp_epoch": "1634915472.191047000" }, { "tcp_stream": 909, "frame_number": 48350, "display_filter": "frame.number == 48350", "timestamp_epoch": "1634915472.191546000" }, { "tcp_stream": 1265, "frame_number": 62106, "display_filter": "frame.number == 62106", "timestamp_epoch": "1634916360.367093000" }, { "tcp_stream": 1265, "frame_number": 62108, "display_filter": "frame.number == 62108", "timestamp_epoch": "1634916360.367886000" }, { "tcp_stream": 1265, "frame_number": 62110, "display_filter": "frame.number == 62110", "timestamp_epoch": "1634916360.368380000" }, { "tcp_stream": 1265, "frame_number": 62114, "display_filter": "frame.number == 62114", "timestamp_epoch": "1634916360.370024000" }, { "tcp_stream": 1265, "frame_number": 62116, "display_filter": "frame.number == 62116", "timestamp_epoch": "1634916360.370617000" }, { "tcp_stream": 1265, "frame_number": 62118, "display_filter": "frame.number == 62118", "timestamp_epoch": "1634916360.371063000" } ] }, { "id": "finding-a53538b4758975d3c5fc8281", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.22", "protocol": "ldap", "destination": "10.10.22.156", "event_count": 82, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 37, "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1634913113.472337000" }, { "tcp_stream": 37, "frame_number": 968, "display_filter": "frame.number == 968", "timestamp_epoch": "1634913114.915527000" }, { "tcp_stream": 55, "frame_number": 1064, "display_filter": "frame.number == 1064", "timestamp_epoch": "1634913114.965120000" }, { "tcp_stream": 55, "frame_number": 1071, "display_filter": "frame.number == 1071", "timestamp_epoch": "1634913114.968094000" }, { "tcp_stream": 55, "frame_number": 1073, "display_filter": "frame.number == 1073", "timestamp_epoch": "1634913114.969450000" }, { "tcp_stream": 55, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1634913114.970067000" }, { "tcp_stream": 55, "frame_number": 1139, "display_filter": "frame.number == 1139", "timestamp_epoch": "1634913115.096164000" }, { "tcp_stream": 55, "frame_number": 1153, "display_filter": "frame.number == 1153", "timestamp_epoch": "1634913115.458113000" }, { "tcp_stream": 55, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1634913115.627419000" }, { "tcp_stream": 55, "frame_number": 1177, "display_filter": "frame.number == 1177", "timestamp_epoch": "1634913115.628826000" }, { "tcp_stream": 55, "frame_number": 1179, "display_filter": "frame.number == 1179", "timestamp_epoch": "1634913115.629502000" }, { "tcp_stream": 63, "frame_number": 1189, "display_filter": "frame.number == 1189", "timestamp_epoch": "1634913116.332984000" }, { "tcp_stream": 63, "frame_number": 1194, "display_filter": "frame.number == 1194", "timestamp_epoch": "1634913116.336673000" }, { "tcp_stream": 63, "frame_number": 1212, "display_filter": "frame.number == 1212", "timestamp_epoch": "1634913116.517099000" }, { "tcp_stream": 65, "frame_number": 1221, "display_filter": "frame.number == 1221", "timestamp_epoch": "1634913116.560239000" }, { "tcp_stream": 65, "frame_number": 1223, "display_filter": "frame.number == 1223", "timestamp_epoch": "1634913116.564405000" }, { "tcp_stream": 65, "frame_number": 1225, "display_filter": "frame.number == 1225", "timestamp_epoch": "1634913116.566558000" }, { "tcp_stream": 63, "frame_number": 1227, "display_filter": "frame.number == 1227", "timestamp_epoch": "1634913116.568081000" }, { "tcp_stream": 71, "frame_number": 1467, "display_filter": "frame.number == 1467", "timestamp_epoch": "1634913118.528665000" }, { "tcp_stream": 71, "frame_number": 1472, "display_filter": "frame.number == 1472", "timestamp_epoch": "1634913118.529887000" }, { "tcp_stream": 71, "frame_number": 1474, "display_filter": "frame.number == 1474", "timestamp_epoch": "1634913118.530417000" }, { "tcp_stream": 71, "frame_number": 1476, "display_filter": "frame.number == 1476", "timestamp_epoch": "1634913118.531892000" }, { "tcp_stream": 71, "frame_number": 1478, "display_filter": "frame.number == 1478", "timestamp_epoch": "1634913118.532479000" }, { "tcp_stream": 72, "frame_number": 1485, "display_filter": "frame.number == 1485", "timestamp_epoch": "1634913118.537755000" }, { "tcp_stream": 72, "frame_number": 1489, "display_filter": "frame.number == 1489", "timestamp_epoch": "1634913118.539054000" }, { "tcp_stream": 72, "frame_number": 1492, "display_filter": "frame.number == 1492", "timestamp_epoch": "1634913118.539946000" }, { "tcp_stream": 73, "frame_number": 1532, "display_filter": "frame.number == 1532", "timestamp_epoch": "1634913123.730594000" }, { "tcp_stream": 73, "frame_number": 1537, "display_filter": "frame.number == 1537", "timestamp_epoch": "1634913123.733914000" }, { "tcp_stream": 73, "frame_number": 1539, "display_filter": "frame.number == 1539", "timestamp_epoch": "1634913123.736975000" }, { "tcp_stream": 73, "frame_number": 1543, "display_filter": "frame.number == 1543", "timestamp_epoch": "1634913124.126813000" }, { "tcp_stream": 73, "frame_number": 1545, "display_filter": "frame.number == 1545", "timestamp_epoch": "1634913124.127633000" }, { "tcp_stream": 73, "frame_number": 1547, "display_filter": "frame.number == 1547", "timestamp_epoch": "1634913124.134785000" }, { "tcp_stream": 73, "frame_number": 1549, "display_filter": "frame.number == 1549", "timestamp_epoch": "1634913124.135575000" }, { "tcp_stream": 74, "frame_number": 1558, "display_filter": "frame.number == 1558", "timestamp_epoch": "1634913124.233540000" }, { "tcp_stream": 74, "frame_number": 1560, "display_filter": "frame.number == 1560", "timestamp_epoch": "1634913124.234469000" }, { "tcp_stream": 74, "frame_number": 1592, "display_filter": "frame.number == 1592", "timestamp_epoch": "1634913124.241524000" }, { "tcp_stream": 193, "frame_number": 4331, "display_filter": "frame.number == 4331", "timestamp_epoch": "1634913239.403407000" }, { "tcp_stream": 193, "frame_number": 4333, "display_filter": "frame.number == 4333", "timestamp_epoch": "1634913239.410118000" }, { "tcp_stream": 194, "frame_number": 4340, "display_filter": "frame.number == 4340", "timestamp_epoch": "1634913239.431701000" }, { "tcp_stream": 194, "frame_number": 4342, "display_filter": "frame.number == 4342", "timestamp_epoch": "1634913239.432464000" }, { "tcp_stream": 194, "frame_number": 4344, "display_filter": "frame.number == 4344", "timestamp_epoch": "1634913239.432909000" }, { "tcp_stream": 193, "frame_number": 4346, "display_filter": "frame.number == 4346", "timestamp_epoch": "1634913239.433653000" }, { "tcp_stream": 235, "frame_number": 5705, "display_filter": "frame.number == 5705", "timestamp_epoch": "1634913300.079277000" }, { "tcp_stream": 235, "frame_number": 5710, "display_filter": "frame.number == 5710", "timestamp_epoch": "1634913300.082247000" }, { "tcp_stream": 235, "frame_number": 5712, "display_filter": "frame.number == 5712", "timestamp_epoch": "1634913300.083102000" }, { "tcp_stream": 235, "frame_number": 5714, "display_filter": "frame.number == 5714", "timestamp_epoch": "1634913300.083788000" }, { "tcp_stream": 235, "frame_number": 5716, "display_filter": "frame.number == 5716", "timestamp_epoch": "1634913300.084303000" }, { "tcp_stream": 236, "frame_number": 5723, "display_filter": "frame.number == 5723", "timestamp_epoch": "1634913300.089369000" }, { "tcp_stream": 236, "frame_number": 5727, "display_filter": "frame.number == 5727", "timestamp_epoch": "1634913300.090115000" }, { "tcp_stream": 236, "frame_number": 5730, "display_filter": "frame.number == 5730", "timestamp_epoch": "1634913300.090838000" }, { "tcp_stream": 251, "frame_number": 7176, "display_filter": "frame.number == 7176", "timestamp_epoch": "1634913412.867826000" }, { "tcp_stream": 251, "frame_number": 7181, "display_filter": "frame.number == 7181", "timestamp_epoch": "1634913412.870438000" }, { "tcp_stream": 251, "frame_number": 7183, "display_filter": "frame.number == 7183", "timestamp_epoch": "1634913412.871127000" }, { "tcp_stream": 251, "frame_number": 7185, "display_filter": "frame.number == 7185", "timestamp_epoch": "1634913412.871596000" }, { "tcp_stream": 251, "frame_number": 7187, "display_filter": "frame.number == 7187", "timestamp_epoch": "1634913412.872124000" }, { "tcp_stream": 252, "frame_number": 7196, "display_filter": "frame.number == 7196", "timestamp_epoch": "1634913412.879738000" }, { "tcp_stream": 252, "frame_number": 7200, "display_filter": "frame.number == 7200", "timestamp_epoch": "1634913412.880717000" }, { "tcp_stream": 252, "frame_number": 7203, "display_filter": "frame.number == 7203", "timestamp_epoch": "1634913412.881439000" }, { "tcp_stream": 766, "frame_number": 29308, "display_filter": "frame.number == 29308", "timestamp_epoch": "1634915040.562558000" }, { "tcp_stream": 766, "frame_number": 29313, "display_filter": "frame.number == 29313", "timestamp_epoch": "1634915040.565244000" }, { "tcp_stream": 766, "frame_number": 29315, "display_filter": "frame.number == 29315", "timestamp_epoch": "1634915040.565981000" }, { "tcp_stream": 766, "frame_number": 29317, "display_filter": "frame.number == 29317", "timestamp_epoch": "1634915040.566512000" }, { "tcp_stream": 766, "frame_number": 29319, "display_filter": "frame.number == 29319", "timestamp_epoch": "1634915040.567079000" }, { "tcp_stream": 767, "frame_number": 29326, "display_filter": "frame.number == 29326", "timestamp_epoch": "1634915040.573345000" }, { "tcp_stream": 767, "frame_number": 29330, "display_filter": "frame.number == 29330", "timestamp_epoch": "1634915040.574080000" }, { "tcp_stream": 767, "frame_number": 29333, "display_filter": "frame.number == 29333", "timestamp_epoch": "1634915040.574655000" }, { "tcp_stream": 910, "frame_number": 48356, "display_filter": "frame.number == 48356", "timestamp_epoch": "1634915472.195635000" }, { "tcp_stream": 910, "frame_number": 48361, "display_filter": "frame.number == 48361", "timestamp_epoch": "1634915472.197846000" }, { "tcp_stream": 910, "frame_number": 48363, "display_filter": "frame.number == 48363", "timestamp_epoch": "1634915472.198627000" }, { "tcp_stream": 910, "frame_number": 48365, "display_filter": "frame.number == 48365", "timestamp_epoch": "1634915472.199192000" }, { "tcp_stream": 910, "frame_number": 48367, "display_filter": "frame.number == 48367", "timestamp_epoch": "1634915472.199765000" }, { "tcp_stream": 911, "frame_number": 48374, "display_filter": "frame.number == 48374", "timestamp_epoch": "1634915472.204857000" }, { "tcp_stream": 911, "frame_number": 48378, "display_filter": "frame.number == 48378", "timestamp_epoch": "1634915472.205681000" }, { "tcp_stream": 911, "frame_number": 48381, "display_filter": "frame.number == 48381", "timestamp_epoch": "1634915472.206437000" }, { "tcp_stream": 1266, "frame_number": 62124, "display_filter": "frame.number == 62124", "timestamp_epoch": "1634916360.373782000" }, { "tcp_stream": 1266, "frame_number": 62129, "display_filter": "frame.number == 62129", "timestamp_epoch": "1634916360.375421000" }, { "tcp_stream": 1266, "frame_number": 62131, "display_filter": "frame.number == 62131", "timestamp_epoch": "1634916360.376123000" }, { "tcp_stream": 1266, "frame_number": 62133, "display_filter": "frame.number == 62133", "timestamp_epoch": "1634916360.376641000" }, { "tcp_stream": 1266, "frame_number": 62135, "display_filter": "frame.number == 62135", "timestamp_epoch": "1634916360.377284000" }, { "tcp_stream": 1267, "frame_number": 62142, "display_filter": "frame.number == 62142", "timestamp_epoch": "1634916360.381440000" }, { "tcp_stream": 1267, "frame_number": 62146, "display_filter": "frame.number == 62146", "timestamp_epoch": "1634916360.382233000" }, { "tcp_stream": 1267, "frame_number": 62149, "display_filter": "frame.number == 62149", "timestamp_epoch": "1634916360.382848000" } ] }, { "id": "finding-7fd9ea33e0431e0676a05ca7", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.22", "protocol": "samr", "destination": "10.10.22.156", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 187, "frame_number": 4250, "display_filter": "frame.number == 4250", "timestamp_epoch": "1634913239.083436000" }, { "tcp_stream": 187, "frame_number": 4252, "display_filter": "frame.number == 4252", "timestamp_epoch": "1634913239.083946000" }, { "tcp_stream": 187, "frame_number": 4254, "display_filter": "frame.number == 4254", "timestamp_epoch": "1634913239.085353000" }, { "tcp_stream": 187, "frame_number": 4256, "display_filter": "frame.number == 4256", "timestamp_epoch": "1634913239.085914000" }, { "tcp_stream": 187, "frame_number": 4258, "display_filter": "frame.number == 4258", "timestamp_epoch": "1634913239.086645000" }, { "tcp_stream": 187, "frame_number": 4260, "display_filter": "frame.number == 4260", "timestamp_epoch": "1634913239.087200000" }, { "tcp_stream": 187, "frame_number": 4262, "display_filter": "frame.number == 4262", "timestamp_epoch": "1634913239.088103000" }, { "tcp_stream": 187, "frame_number": 4264, "display_filter": "frame.number == 4264", "timestamp_epoch": "1634913239.088685000" }, { "tcp_stream": 187, "frame_number": 4266, "display_filter": "frame.number == 4266", "timestamp_epoch": "1634913239.090347000" }, { "tcp_stream": 187, "frame_number": 4268, "display_filter": "frame.number == 4268", "timestamp_epoch": "1634913239.090898000" }, { "tcp_stream": 187, "frame_number": 4270, "display_filter": "frame.number == 4270", "timestamp_epoch": "1634913239.092201000" }, { "tcp_stream": 187, "frame_number": 4272, "display_filter": "frame.number == 4272", "timestamp_epoch": "1634913239.092808000" }, { "tcp_stream": 187, "frame_number": 4275, "display_filter": "frame.number == 4275", "timestamp_epoch": "1634913239.093588000" }, { "tcp_stream": 187, "frame_number": 4278, "display_filter": "frame.number == 4278", "timestamp_epoch": "1634913239.094151000" }, { "tcp_stream": 187, "frame_number": 4280, "display_filter": "frame.number == 4280", "timestamp_epoch": "1634913239.096150000" } ] }, { "id": "finding-35271fc2b1fc6bb0ca24a944", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.22", "protocol": "drsuapi", "destination": "10.10.22.157", "event_count": 49, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 3, "frame_number": 128, "display_filter": "frame.number == 128", "timestamp_epoch": "1634913054.084239000" }, { "tcp_stream": 3, "frame_number": 132, "display_filter": "frame.number == 132", "timestamp_epoch": "1634913054.085000000" }, { "tcp_stream": 3, "frame_number": 135, "display_filter": "frame.number == 135", "timestamp_epoch": "1634913054.085332000" }, { "tcp_stream": 3, "frame_number": 146, "display_filter": "frame.number == 146", "timestamp_epoch": "1634913054.087993000" }, { "tcp_stream": 3, "frame_number": 150, "display_filter": "frame.number == 150", "timestamp_epoch": "1634913054.088894000" }, { "tcp_stream": 3, "frame_number": 152, "display_filter": "frame.number == 152", "timestamp_epoch": "1634913054.089831000" }, { "tcp_stream": 3, "frame_number": 324, "display_filter": "frame.number == 324", "timestamp_epoch": "1634913054.922109000" }, { "tcp_stream": 3, "frame_number": 326, "display_filter": "frame.number == 326", "timestamp_epoch": "1634913054.922727000" }, { "tcp_stream": 3, "frame_number": 328, "display_filter": "frame.number == 328", "timestamp_epoch": "1634913054.923275000" }, { "tcp_stream": 3, "frame_number": 330, "display_filter": "frame.number == 330", "timestamp_epoch": "1634913054.924440000" }, { "tcp_stream": 26, "frame_number": 569, "display_filter": "frame.number == 569", "timestamp_epoch": "1634913057.668670000" }, { "tcp_stream": 26, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1634913057.669456000" }, { "tcp_stream": 26, "frame_number": 573, "display_filter": "frame.number == 573", "timestamp_epoch": "1634913057.669830000" }, { "tcp_stream": 26, "frame_number": 577, "display_filter": "frame.number == 577", "timestamp_epoch": "1634913057.671074000" }, { "tcp_stream": 26, "frame_number": 579, "display_filter": "frame.number == 579", "timestamp_epoch": "1634913057.671697000" }, { "tcp_stream": 26, "frame_number": 581, "display_filter": "frame.number == 581", "timestamp_epoch": "1634913057.672068000" }, { "tcp_stream": 156, "frame_number": 3445, "display_filter": "frame.number == 3445", "timestamp_epoch": "1634913211.572602000" }, { "tcp_stream": 156, "frame_number": 3447, "display_filter": "frame.number == 3447", "timestamp_epoch": "1634913211.573090000" }, { "tcp_stream": 156, "frame_number": 3449, "display_filter": "frame.number == 3449", "timestamp_epoch": "1634913211.573589000" }, { "tcp_stream": 156, "frame_number": 3451, "display_filter": "frame.number == 3451", "timestamp_epoch": "1634913211.573973000" }, { "tcp_stream": 223, "frame_number": 5321, "display_filter": "frame.number == 5321", "timestamp_epoch": "1634913272.477765000" }, { "tcp_stream": 223, "frame_number": 5323, "display_filter": "frame.number == 5323", "timestamp_epoch": "1634913272.478579000" }, { "tcp_stream": 223, "frame_number": 5325, "display_filter": "frame.number == 5325", "timestamp_epoch": "1634913272.479009000" }, { "tcp_stream": 223, "frame_number": 5329, "display_filter": "frame.number == 5329", "timestamp_epoch": "1634913272.480681000" }, { "tcp_stream": 223, "frame_number": 5331, "display_filter": "frame.number == 5331", "timestamp_epoch": "1634913272.481225000" }, { "tcp_stream": 223, "frame_number": 5333, "display_filter": "frame.number == 5333", "timestamp_epoch": "1634913272.481582000" }, { "tcp_stream": 756, "frame_number": 29091, "display_filter": "frame.number == 29091", "timestamp_epoch": "1634915012.970980000" }, { "tcp_stream": 756, "frame_number": 29096, "display_filter": "frame.number == 29096", "timestamp_epoch": "1634915012.975106000" }, { "tcp_stream": 756, "frame_number": 29098, "display_filter": "frame.number == 29098", "timestamp_epoch": "1634915012.975994000" }, { "tcp_stream": 756, "frame_number": 29100, "display_filter": "frame.number == 29100", "timestamp_epoch": "1634915012.979798000" }, { "tcp_stream": 756, "frame_number": 29104, "display_filter": "frame.number == 29104", "timestamp_epoch": "1634915012.982562000" }, { "tcp_stream": 758, "frame_number": 29119, "display_filter": "frame.number == 29119", "timestamp_epoch": "1634915012.991767000" }, { "tcp_stream": 758, "frame_number": 29121, "display_filter": "frame.number == 29121", "timestamp_epoch": "1634915012.992293000" }, { "tcp_stream": 758, "frame_number": 29123, "display_filter": "frame.number == 29123", "timestamp_epoch": "1634915012.992578000" }, { "tcp_stream": 758, "frame_number": 29127, "display_filter": "frame.number == 29127", "timestamp_epoch": "1634915012.996201000" }, { "tcp_stream": 758, "frame_number": 29129, "display_filter": "frame.number == 29129", "timestamp_epoch": "1634915012.996720000" }, { "tcp_stream": 758, "frame_number": 29131, "display_filter": "frame.number == 29131", "timestamp_epoch": "1634915012.997101000" }, { "tcp_stream": 862, "frame_number": 45076, "display_filter": "frame.number == 45076", "timestamp_epoch": "1634915359.668177000" }, { "tcp_stream": 862, "frame_number": 45078, "display_filter": "frame.number == 45078", "timestamp_epoch": "1634915359.668819000" }, { "tcp_stream": 862, "frame_number": 45080, "display_filter": "frame.number == 45080", "timestamp_epoch": "1634915359.669214000" }, { "tcp_stream": 862, "frame_number": 45084, "display_filter": "frame.number == 45084", "timestamp_epoch": "1634915359.671409000" }, { "tcp_stream": 862, "frame_number": 45086, "display_filter": "frame.number == 45086", "timestamp_epoch": "1634915359.671944000" }, { "tcp_stream": 862, "frame_number": 45088, "display_filter": "frame.number == 45088", "timestamp_epoch": "1634915359.672337000" }, { "tcp_stream": 990, "frame_number": 55101, "display_filter": "frame.number == 55101", "timestamp_epoch": "1634915700.850851000" }, { "tcp_stream": 990, "frame_number": 55103, "display_filter": "frame.number == 55103", "timestamp_epoch": "1634915700.851652000" }, { "tcp_stream": 990, "frame_number": 55105, "display_filter": "frame.number == 55105", "timestamp_epoch": "1634915700.852105000" }, { "tcp_stream": 990, "frame_number": 55109, "display_filter": "frame.number == 55109", "timestamp_epoch": "1634915700.853715000" }, { "tcp_stream": 990, "frame_number": 55111, "display_filter": "frame.number == 55111", "timestamp_epoch": "1634915700.854241000" }, { "tcp_stream": 990, "frame_number": 55113, "display_filter": "frame.number == 55113", "timestamp_epoch": "1634915700.854707000" } ] }, { "id": "finding-98dab4e390f6fa0668358a33", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.22", "protocol": "ldap", "destination": "10.10.22.157", "event_count": 74, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 0, "frame_number": 29, "display_filter": "frame.number == 29", "timestamp_epoch": "1634913052.671148000" }, { "tcp_stream": 5, "frame_number": 93, "display_filter": "frame.number == 93", "timestamp_epoch": "1634913054.067128000" }, { "tcp_stream": 5, "frame_number": 124, "display_filter": "frame.number == 124", "timestamp_epoch": "1634913054.082974000" }, { "tcp_stream": 5, "frame_number": 130, "display_filter": "frame.number == 130", "timestamp_epoch": "1634913054.084557000" }, { "tcp_stream": 5, "frame_number": 136, "display_filter": "frame.number == 136", "timestamp_epoch": "1634913054.085442000" }, { "tcp_stream": 5, "frame_number": 170, "display_filter": "frame.number == 170", "timestamp_epoch": "1634913054.223626000" }, { "tcp_stream": 5, "frame_number": 193, "display_filter": "frame.number == 193", "timestamp_epoch": "1634913054.351684000" }, { "tcp_stream": 5, "frame_number": 264, "display_filter": "frame.number == 264", "timestamp_epoch": "1634913054.583058000" }, { "tcp_stream": 5, "frame_number": 272, "display_filter": "frame.number == 272", "timestamp_epoch": "1634913054.584610000" }, { "tcp_stream": 5, "frame_number": 274, "display_filter": "frame.number == 274", "timestamp_epoch": "1634913054.585300000" }, { "tcp_stream": 0, "frame_number": 310, "display_filter": "frame.number == 310", "timestamp_epoch": "1634913054.714640000" }, { "tcp_stream": 20, "frame_number": 349, "display_filter": "frame.number == 349", "timestamp_epoch": "1634913055.632442000" }, { "tcp_stream": 20, "frame_number": 354, "display_filter": "frame.number == 354", "timestamp_epoch": "1634913055.635128000" }, { "tcp_stream": 20, "frame_number": 370, "display_filter": "frame.number == 370", "timestamp_epoch": "1634913055.680966000" }, { "tcp_stream": 22, "frame_number": 377, "display_filter": "frame.number == 377", "timestamp_epoch": "1634913055.692172000" }, { "tcp_stream": 22, "frame_number": 379, "display_filter": "frame.number == 379", "timestamp_epoch": "1634913055.693129000" }, { "tcp_stream": 22, "frame_number": 381, "display_filter": "frame.number == 381", "timestamp_epoch": "1634913055.693885000" }, { "tcp_stream": 20, "frame_number": 383, "display_filter": "frame.number == 383", "timestamp_epoch": "1634913055.695725000" }, { "tcp_stream": 27, "frame_number": 587, "display_filter": "frame.number == 587", "timestamp_epoch": "1634913057.674886000" }, { "tcp_stream": 27, "frame_number": 592, "display_filter": "frame.number == 592", "timestamp_epoch": "1634913057.676331000" }, { "tcp_stream": 27, "frame_number": 594, "display_filter": "frame.number == 594", "timestamp_epoch": "1634913057.676933000" }, { "tcp_stream": 27, "frame_number": 596, "display_filter": "frame.number == 596", "timestamp_epoch": "1634913057.677404000" }, { "tcp_stream": 27, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1634913057.677691000" }, { "tcp_stream": 28, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1634913057.680537000" }, { "tcp_stream": 28, "frame_number": 609, "display_filter": "frame.number == 609", "timestamp_epoch": "1634913057.681064000" }, { "tcp_stream": 28, "frame_number": 612, "display_filter": "frame.number == 612", "timestamp_epoch": "1634913057.681579000" }, { "tcp_stream": 29, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1634913063.055968000" }, { "tcp_stream": 29, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1634913063.058151000" }, { "tcp_stream": 29, "frame_number": 653, "display_filter": "frame.number == 653", "timestamp_epoch": "1634913063.060626000" }, { "tcp_stream": 29, "frame_number": 655, "display_filter": "frame.number == 655", "timestamp_epoch": "1634913063.061117000" }, { "tcp_stream": 29, "frame_number": 657, "display_filter": "frame.number == 657", "timestamp_epoch": "1634913063.061633000" }, { "tcp_stream": 29, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1634913063.062165000" }, { "tcp_stream": 29, "frame_number": 661, "display_filter": "frame.number == 661", "timestamp_epoch": "1634913063.062737000" }, { "tcp_stream": 30, "frame_number": 668, "display_filter": "frame.number == 668", "timestamp_epoch": "1634913063.081501000" }, { "tcp_stream": 30, "frame_number": 670, "display_filter": "frame.number == 670", "timestamp_epoch": "1634913063.082671000" }, { "tcp_stream": 30, "frame_number": 704, "display_filter": "frame.number == 704", "timestamp_epoch": "1634913063.089658000" }, { "tcp_stream": 163, "frame_number": 3547, "display_filter": "frame.number == 3547", "timestamp_epoch": "1634913211.916395000" }, { "tcp_stream": 163, "frame_number": 3549, "display_filter": "frame.number == 3549", "timestamp_epoch": "1634913211.922376000" }, { "tcp_stream": 164, "frame_number": 3556, "display_filter": "frame.number == 3556", "timestamp_epoch": "1634913211.928846000" }, { "tcp_stream": 164, "frame_number": 3558, "display_filter": "frame.number == 3558", "timestamp_epoch": "1634913211.929484000" }, { "tcp_stream": 164, "frame_number": 3560, "display_filter": "frame.number == 3560", "timestamp_epoch": "1634913211.929878000" }, { "tcp_stream": 163, "frame_number": 3562, "display_filter": "frame.number == 3562", "timestamp_epoch": "1634913211.930603000" }, { "tcp_stream": 224, "frame_number": 5339, "display_filter": "frame.number == 5339", "timestamp_epoch": "1634913272.484393000" }, { "tcp_stream": 224, "frame_number": 5344, "display_filter": "frame.number == 5344", "timestamp_epoch": "1634913272.486629000" }, { "tcp_stream": 224, "frame_number": 5346, "display_filter": "frame.number == 5346", "timestamp_epoch": "1634913272.487518000" }, { "tcp_stream": 224, "frame_number": 5348, "display_filter": "frame.number == 5348", "timestamp_epoch": "1634913272.488043000" }, { "tcp_stream": 224, "frame_number": 5350, "display_filter": "frame.number == 5350", "timestamp_epoch": "1634913272.488596000" }, { "tcp_stream": 225, "frame_number": 5357, "display_filter": "frame.number == 5357", "timestamp_epoch": "1634913272.492997000" }, { "tcp_stream": 225, "frame_number": 5361, "display_filter": "frame.number == 5361", "timestamp_epoch": "1634913272.493853000" }, { "tcp_stream": 225, "frame_number": 5364, "display_filter": "frame.number == 5364", "timestamp_epoch": "1634913272.494557000" }, { "tcp_stream": 759, "frame_number": 29145, "display_filter": "frame.number == 29145", "timestamp_epoch": "1634915013.109110000" }, { "tcp_stream": 759, "frame_number": 29150, "display_filter": "frame.number == 29150", "timestamp_epoch": "1634915013.111398000" }, { "tcp_stream": 759, "frame_number": 29152, "display_filter": "frame.number == 29152", "timestamp_epoch": "1634915013.112019000" }, { "tcp_stream": 759, "frame_number": 29154, "display_filter": "frame.number == 29154", "timestamp_epoch": "1634915013.112541000" }, { "tcp_stream": 759, "frame_number": 29156, "display_filter": "frame.number == 29156", "timestamp_epoch": "1634915013.113011000" }, { "tcp_stream": 760, "frame_number": 29163, "display_filter": "frame.number == 29163", "timestamp_epoch": "1634915013.117501000" }, { "tcp_stream": 760, "frame_number": 29167, "display_filter": "frame.number == 29167", "timestamp_epoch": "1634915013.118180000" }, { "tcp_stream": 760, "frame_number": 29170, "display_filter": "frame.number == 29170", "timestamp_epoch": "1634915013.118706000" }, { "tcp_stream": 863, "frame_number": 45094, "display_filter": "frame.number == 45094", "timestamp_epoch": "1634915359.676278000" }, { "tcp_stream": 863, "frame_number": 45099, "display_filter": "frame.number == 45099", "timestamp_epoch": "1634915359.678157000" }, { "tcp_stream": 863, "frame_number": 45101, "display_filter": "frame.number == 45101", "timestamp_epoch": "1634915359.679135000" }, { "tcp_stream": 863, "frame_number": 45103, "display_filter": "frame.number == 45103", "timestamp_epoch": "1634915359.679634000" }, { "tcp_stream": 863, "frame_number": 45105, "display_filter": "frame.number == 45105", "timestamp_epoch": "1634915359.680110000" }, { "tcp_stream": 864, "frame_number": 45112, "display_filter": "frame.number == 45112", "timestamp_epoch": "1634915359.684779000" }, { "tcp_stream": 864, "frame_number": 45116, "display_filter": "frame.number == 45116", "timestamp_epoch": "1634915359.685530000" }, { "tcp_stream": 864, "frame_number": 45119, "display_filter": "frame.number == 45119", "timestamp_epoch": "1634915359.686159000" }, { "tcp_stream": 991, "frame_number": 55119, "display_filter": "frame.number == 55119", "timestamp_epoch": "1634915700.857238000" }, { "tcp_stream": 991, "frame_number": 55124, "display_filter": "frame.number == 55124", "timestamp_epoch": "1634915700.858794000" }, { "tcp_stream": 991, "frame_number": 55126, "display_filter": "frame.number == 55126", "timestamp_epoch": "1634915700.859510000" }, { "tcp_stream": 991, "frame_number": 55128, "display_filter": "frame.number == 55128", "timestamp_epoch": "1634915700.860103000" }, { "tcp_stream": 991, "frame_number": 55130, "display_filter": "frame.number == 55130", "timestamp_epoch": "1634915700.860629000" }, { "tcp_stream": 992, "frame_number": 55137, "display_filter": "frame.number == 55137", "timestamp_epoch": "1634915700.864788000" }, { "tcp_stream": 992, "frame_number": 55141, "display_filter": "frame.number == 55141", "timestamp_epoch": "1634915700.865587000" }, { "tcp_stream": 992, "frame_number": 55144, "display_filter": "frame.number == 55144", "timestamp_epoch": "1634915700.866246000" } ] }, { "id": "finding-f9e585b3cfff0e4244f76a46", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.22", "protocol": "samr", "destination": "10.10.22.157", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 157, "frame_number": 3469, "display_filter": "frame.number == 3469", "timestamp_epoch": "1634913211.594418000" }, { "tcp_stream": 157, "frame_number": 3471, "display_filter": "frame.number == 3471", "timestamp_epoch": "1634913211.595010000" }, { "tcp_stream": 157, "frame_number": 3473, "display_filter": "frame.number == 3473", "timestamp_epoch": "1634913211.595531000" }, { "tcp_stream": 157, "frame_number": 3475, "display_filter": "frame.number == 3475", "timestamp_epoch": "1634913211.596471000" }, { "tcp_stream": 157, "frame_number": 3477, "display_filter": "frame.number == 3477", "timestamp_epoch": "1634913211.597346000" }, { "tcp_stream": 157, "frame_number": 3479, "display_filter": "frame.number == 3479", "timestamp_epoch": "1634913211.598045000" }, { "tcp_stream": 157, "frame_number": 3481, "display_filter": "frame.number == 3481", "timestamp_epoch": "1634913211.599136000" }, { "tcp_stream": 157, "frame_number": 3483, "display_filter": "frame.number == 3483", "timestamp_epoch": "1634913211.599905000" }, { "tcp_stream": 157, "frame_number": 3485, "display_filter": "frame.number == 3485", "timestamp_epoch": "1634913211.600415000" }, { "tcp_stream": 157, "frame_number": 3487, "display_filter": "frame.number == 3487", "timestamp_epoch": "1634913211.601102000" }, { "tcp_stream": 157, "frame_number": 3489, "display_filter": "frame.number == 3489", "timestamp_epoch": "1634913211.601660000" }, { "tcp_stream": 157, "frame_number": 3491, "display_filter": "frame.number == 3491", "timestamp_epoch": "1634913211.603062000" }, { "tcp_stream": 157, "frame_number": 3493, "display_filter": "frame.number == 3493", "timestamp_epoch": "1634913211.605881000" }, { "tcp_stream": 157, "frame_number": 3495, "display_filter": "frame.number == 3495", "timestamp_epoch": "1634913211.606408000" }, { "tcp_stream": 157, "frame_number": 3497, "display_filter": "frame.number == 3497", "timestamp_epoch": "1634913211.607068000" } ] }, { "id": "finding-b43fdaa9a7871e5e0055890c", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.22", "protocol": "drsuapi", "destination": "10.10.22.158", "event_count": 53, "operation_numbers": [ "0", "1", "12", "13", "30" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 93, "frame_number": 1954, "display_filter": "frame.number == 1954", "timestamp_epoch": "1634913145.885247000" }, { "tcp_stream": 93, "frame_number": 1961, "display_filter": "frame.number == 1961", "timestamp_epoch": "1634913145.886204000" }, { "tcp_stream": 93, "frame_number": 1965, "display_filter": "frame.number == 1965", "timestamp_epoch": "1634913145.886672000" }, { "tcp_stream": 86, "frame_number": 1966, "display_filter": "frame.number == 1966", "timestamp_epoch": "1634913145.886730000" }, { "tcp_stream": 86, "frame_number": 1972, "display_filter": "frame.number == 1972", "timestamp_epoch": "1634913145.887379000" }, { "tcp_stream": 86, "frame_number": 1974, "display_filter": "frame.number == 1974", "timestamp_epoch": "1634913145.887959000" }, { "tcp_stream": 86, "frame_number": 1979, "display_filter": "frame.number == 1979", "timestamp_epoch": "1634913145.888442000" }, { "tcp_stream": 93, "frame_number": 1988, "display_filter": "frame.number == 1988", "timestamp_epoch": "1634913145.890430000" }, { "tcp_stream": 93, "frame_number": 1990, "display_filter": "frame.number == 1990", "timestamp_epoch": "1634913145.891495000" }, { "tcp_stream": 93, "frame_number": 1992, "display_filter": "frame.number == 1992", "timestamp_epoch": "1634913145.892153000" }, { "tcp_stream": 101, "frame_number": 2040, "display_filter": "frame.number == 2040", "timestamp_epoch": "1634913145.972093000" }, { "tcp_stream": 101, "frame_number": 2042, "display_filter": "frame.number == 2042", "timestamp_epoch": "1634913145.972877000" }, { "tcp_stream": 101, "frame_number": 2044, "display_filter": "frame.number == 2044", "timestamp_epoch": "1634913145.973549000" }, { "tcp_stream": 101, "frame_number": 2046, "display_filter": "frame.number == 2046", "timestamp_epoch": "1634913145.973827000" }, { "tcp_stream": 113, "frame_number": 2340, "display_filter": "frame.number == 2340", "timestamp_epoch": "1634913149.377688000" }, { "tcp_stream": 113, "frame_number": 2342, "display_filter": "frame.number == 2342", "timestamp_epoch": "1634913149.378307000" }, { "tcp_stream": 113, "frame_number": 2344, "display_filter": "frame.number == 2344", "timestamp_epoch": "1634913149.379201000" }, { "tcp_stream": 113, "frame_number": 2348, "display_filter": "frame.number == 2348", "timestamp_epoch": "1634913149.380888000" }, { "tcp_stream": 113, "frame_number": 2350, "display_filter": "frame.number == 2350", "timestamp_epoch": "1634913149.381528000" }, { "tcp_stream": 113, "frame_number": 2352, "display_filter": "frame.number == 2352", "timestamp_epoch": "1634913149.381850000" }, { "tcp_stream": 93, "frame_number": 2671, "display_filter": "frame.number == 2671", "timestamp_epoch": "1634913184.597442000" }, { "tcp_stream": 93, "frame_number": 2673, "display_filter": "frame.number == 2673", "timestamp_epoch": "1634913184.598253000" }, { "tcp_stream": 93, "frame_number": 2675, "display_filter": "frame.number == 2675", "timestamp_epoch": "1634913184.598708000" }, { "tcp_stream": 93, "frame_number": 2677, "display_filter": "frame.number == 2677", "timestamp_epoch": "1634913184.599449000" }, { "tcp_stream": 215, "frame_number": 5053, "display_filter": "frame.number == 5053", "timestamp_epoch": "1634913245.552194000" }, { "tcp_stream": 215, "frame_number": 5055, "display_filter": "frame.number == 5055", "timestamp_epoch": "1634913245.552993000" }, { "tcp_stream": 215, "frame_number": 5057, "display_filter": "frame.number == 5057", "timestamp_epoch": "1634913245.553438000" }, { "tcp_stream": 215, "frame_number": 5061, "display_filter": "frame.number == 5061", "timestamp_epoch": "1634913245.555131000" }, { "tcp_stream": 215, "frame_number": 5063, "display_filter": "frame.number == 5063", "timestamp_epoch": "1634913245.555719000" }, { "tcp_stream": 215, "frame_number": 5065, "display_filter": "frame.number == 5065", "timestamp_epoch": "1634913245.556147000" }, { "tcp_stream": 746, "frame_number": 26064, "display_filter": "frame.number == 26064", "timestamp_epoch": "1634914985.976942000" }, { "tcp_stream": 746, "frame_number": 26066, "display_filter": "frame.number == 26066", "timestamp_epoch": "1634914985.977473000" }, { "tcp_stream": 746, "frame_number": 26068, "display_filter": "frame.number == 26068", "timestamp_epoch": "1634914985.978666000" }, { "tcp_stream": 746, "frame_number": 26070, "display_filter": "frame.number == 26070", "timestamp_epoch": "1634914985.979273000" }, { "tcp_stream": 746, "frame_number": 26072, "display_filter": "frame.number == 26072", "timestamp_epoch": "1634914985.979543000" }, { "tcp_stream": 748, "frame_number": 26092, "display_filter": "frame.number == 26092", "timestamp_epoch": "1634914985.999036000" }, { "tcp_stream": 748, "frame_number": 26096, "display_filter": "frame.number == 26096", "timestamp_epoch": "1634914985.999770000" }, { "tcp_stream": 748, "frame_number": 26098, "display_filter": "frame.number == 26098", "timestamp_epoch": "1634914986.000319000" }, { "tcp_stream": 748, "frame_number": 26102, "display_filter": "frame.number == 26102", "timestamp_epoch": "1634914986.002384000" }, { "tcp_stream": 748, "frame_number": 26104, "display_filter": "frame.number == 26104", "timestamp_epoch": "1634914986.002838000" }, { "tcp_stream": 748, "frame_number": 26106, "display_filter": "frame.number == 26106", "timestamp_epoch": "1634914986.003243000" }, { "tcp_stream": 857, "frame_number": 44962, "display_filter": "frame.number == 44962", "timestamp_epoch": "1634915357.648368000" }, { "tcp_stream": 857, "frame_number": 44964, "display_filter": "frame.number == 44964", "timestamp_epoch": "1634915357.649101000" }, { "tcp_stream": 857, "frame_number": 44966, "display_filter": "frame.number == 44966", "timestamp_epoch": "1634915357.649636000" }, { "tcp_stream": 857, "frame_number": 44970, "display_filter": "frame.number == 44970", "timestamp_epoch": "1634915357.652262000" }, { "tcp_stream": 857, "frame_number": 44972, "display_filter": "frame.number == 44972", "timestamp_epoch": "1634915357.652892000" }, { "tcp_stream": 857, "frame_number": 44974, "display_filter": "frame.number == 44974", "timestamp_epoch": "1634915357.653394000" }, { "tcp_stream": 1156, "frame_number": 59919, "display_filter": "frame.number == 59919", "timestamp_epoch": "1634916153.388278000" }, { "tcp_stream": 1156, "frame_number": 59921, "display_filter": "frame.number == 59921", "timestamp_epoch": "1634916153.389134000" }, { "tcp_stream": 1156, "frame_number": 59923, "display_filter": "frame.number == 59923", "timestamp_epoch": "1634916153.389603000" }, { "tcp_stream": 1156, "frame_number": 59927, "display_filter": "frame.number == 59927", "timestamp_epoch": "1634916153.391303000" }, { "tcp_stream": 1156, "frame_number": 59929, "display_filter": "frame.number == 59929", "timestamp_epoch": "1634916153.391885000" }, { "tcp_stream": 1156, "frame_number": 59931, "display_filter": "frame.number == 59931", "timestamp_epoch": "1634916153.392336000" } ] }, { "id": "finding-c3b8102ca765ff62405d7567", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.22", "protocol": "ldap", "destination": "10.10.22.158", "event_count": 71, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 79, "frame_number": 1698, "display_filter": "frame.number == 1698", "timestamp_epoch": "1634913144.099936000" }, { "tcp_stream": 84, "frame_number": 1779, "display_filter": "frame.number == 1779", "timestamp_epoch": "1634913145.845746000" }, { "tcp_stream": 79, "frame_number": 1925, "display_filter": "frame.number == 1925", "timestamp_epoch": "1634913145.881932000" }, { "tcp_stream": 84, "frame_number": 1947, "display_filter": "frame.number == 1947", "timestamp_epoch": "1634913145.884085000" }, { "tcp_stream": 84, "frame_number": 1962, "display_filter": "frame.number == 1962", "timestamp_epoch": "1634913145.886405000" }, { "tcp_stream": 84, "frame_number": 1971, "display_filter": "frame.number == 1971", "timestamp_epoch": "1634913145.887320000" }, { "tcp_stream": 84, "frame_number": 2060, "display_filter": "frame.number == 2060", "timestamp_epoch": "1634913146.035616000" }, { "tcp_stream": 84, "frame_number": 2074, "display_filter": "frame.number == 2074", "timestamp_epoch": "1634913146.160001000" }, { "tcp_stream": 84, "frame_number": 2088, "display_filter": "frame.number == 2088", "timestamp_epoch": "1634913146.347551000" }, { "tcp_stream": 84, "frame_number": 2096, "display_filter": "frame.number == 2096", "timestamp_epoch": "1634913146.349491000" }, { "tcp_stream": 84, "frame_number": 2098, "display_filter": "frame.number == 2098", "timestamp_epoch": "1634913146.350163000" }, { "tcp_stream": 107, "frame_number": 2114, "display_filter": "frame.number == 2114", "timestamp_epoch": "1634913147.180284000" }, { "tcp_stream": 107, "frame_number": 2119, "display_filter": "frame.number == 2119", "timestamp_epoch": "1634913147.183906000" }, { "tcp_stream": 107, "frame_number": 2135, "display_filter": "frame.number == 2135", "timestamp_epoch": "1634913147.410332000" }, { "tcp_stream": 109, "frame_number": 2142, "display_filter": "frame.number == 2142", "timestamp_epoch": "1634913147.421577000" }, { "tcp_stream": 109, "frame_number": 2144, "display_filter": "frame.number == 2144", "timestamp_epoch": "1634913147.422426000" }, { "tcp_stream": 109, "frame_number": 2146, "display_filter": "frame.number == 2146", "timestamp_epoch": "1634913147.422969000" }, { "tcp_stream": 107, "frame_number": 2148, "display_filter": "frame.number == 2148", "timestamp_epoch": "1634913147.424204000" }, { "tcp_stream": 114, "frame_number": 2358, "display_filter": "frame.number == 2358", "timestamp_epoch": "1634913149.399936000" }, { "tcp_stream": 114, "frame_number": 2363, "display_filter": "frame.number == 2363", "timestamp_epoch": "1634913149.401647000" }, { "tcp_stream": 114, "frame_number": 2365, "display_filter": "frame.number == 2365", "timestamp_epoch": "1634913149.402732000" }, { "tcp_stream": 114, "frame_number": 2367, "display_filter": "frame.number == 2367", "timestamp_epoch": "1634913149.403300000" }, { "tcp_stream": 114, "frame_number": 2369, "display_filter": "frame.number == 2369", "timestamp_epoch": "1634913149.404031000" }, { "tcp_stream": 115, "frame_number": 2376, "display_filter": "frame.number == 2376", "timestamp_epoch": "1634913149.411898000" }, { "tcp_stream": 115, "frame_number": 2380, "display_filter": "frame.number == 2380", "timestamp_epoch": "1634913149.412748000" }, { "tcp_stream": 115, "frame_number": 2383, "display_filter": "frame.number == 2383", "timestamp_epoch": "1634913149.413357000" }, { "tcp_stream": 116, "frame_number": 2416, "display_filter": "frame.number == 2416", "timestamp_epoch": "1634913154.532511000" }, { "tcp_stream": 116, "frame_number": 2421, "display_filter": "frame.number == 2421", "timestamp_epoch": "1634913154.535212000" }, { "tcp_stream": 116, "frame_number": 2424, "display_filter": "frame.number == 2424", "timestamp_epoch": "1634913154.546643000" }, { "tcp_stream": 116, "frame_number": 2426, "display_filter": "frame.number == 2426", "timestamp_epoch": "1634913154.547164000" }, { "tcp_stream": 116, "frame_number": 2428, "display_filter": "frame.number == 2428", "timestamp_epoch": "1634913154.547599000" }, { "tcp_stream": 116, "frame_number": 2430, "display_filter": "frame.number == 2430", "timestamp_epoch": "1634913154.548055000" }, { "tcp_stream": 116, "frame_number": 2432, "display_filter": "frame.number == 2432", "timestamp_epoch": "1634913154.548509000" }, { "tcp_stream": 133, "frame_number": 2801, "display_filter": "frame.number == 2801", "timestamp_epoch": "1634913184.961996000" }, { "tcp_stream": 133, "frame_number": 2803, "display_filter": "frame.number == 2803", "timestamp_epoch": "1634913184.967094000" }, { "tcp_stream": 134, "frame_number": 2810, "display_filter": "frame.number == 2810", "timestamp_epoch": "1634913184.974053000" }, { "tcp_stream": 134, "frame_number": 2812, "display_filter": "frame.number == 2812", "timestamp_epoch": "1634913184.974912000" }, { "tcp_stream": 134, "frame_number": 2814, "display_filter": "frame.number == 2814", "timestamp_epoch": "1634913184.975475000" }, { "tcp_stream": 133, "frame_number": 2816, "display_filter": "frame.number == 2816", "timestamp_epoch": "1634913184.976318000" }, { "tcp_stream": 216, "frame_number": 5071, "display_filter": "frame.number == 5071", "timestamp_epoch": "1634913245.559023000" }, { "tcp_stream": 216, "frame_number": 5076, "display_filter": "frame.number == 5076", "timestamp_epoch": "1634913245.560736000" }, { "tcp_stream": 216, "frame_number": 5078, "display_filter": "frame.number == 5078", "timestamp_epoch": "1634913245.561423000" }, { "tcp_stream": 216, "frame_number": 5080, "display_filter": "frame.number == 5080", "timestamp_epoch": "1634913245.561918000" }, { "tcp_stream": 216, "frame_number": 5082, "display_filter": "frame.number == 5082", "timestamp_epoch": "1634913245.562421000" }, { "tcp_stream": 217, "frame_number": 5089, "display_filter": "frame.number == 5089", "timestamp_epoch": "1634913245.566568000" }, { "tcp_stream": 217, "frame_number": 5093, "display_filter": "frame.number == 5093", "timestamp_epoch": "1634913245.567365000" }, { "tcp_stream": 217, "frame_number": 5096, "display_filter": "frame.number == 5096", "timestamp_epoch": "1634913245.567984000" }, { "tcp_stream": 749, "frame_number": 26118, "display_filter": "frame.number == 26118", "timestamp_epoch": "1634914986.118182000" }, { "tcp_stream": 749, "frame_number": 26123, "display_filter": "frame.number == 26123", "timestamp_epoch": "1634914986.120044000" }, { "tcp_stream": 749, "frame_number": 26125, "display_filter": "frame.number == 26125", "timestamp_epoch": "1634914986.121010000" }, { "tcp_stream": 749, "frame_number": 26127, "display_filter": "frame.number == 26127", "timestamp_epoch": "1634914986.121507000" }, { "tcp_stream": 749, "frame_number": 26129, "display_filter": "frame.number == 26129", "timestamp_epoch": "1634914986.122048000" }, { "tcp_stream": 750, "frame_number": 26136, "display_filter": "frame.number == 26136", "timestamp_epoch": "1634914986.127271000" }, { "tcp_stream": 750, "frame_number": 26140, "display_filter": "frame.number == 26140", "timestamp_epoch": "1634914986.128094000" }, { "tcp_stream": 750, "frame_number": 26143, "display_filter": "frame.number == 26143", "timestamp_epoch": "1634914986.128672000" }, { "tcp_stream": 858, "frame_number": 44980, "display_filter": "frame.number == 44980", "timestamp_epoch": "1634915357.657244000" }, { "tcp_stream": 858, "frame_number": 44985, "display_filter": "frame.number == 44985", "timestamp_epoch": "1634915357.659095000" }, { "tcp_stream": 858, "frame_number": 44987, "display_filter": "frame.number == 44987", "timestamp_epoch": "1634915357.659863000" }, { "tcp_stream": 858, "frame_number": 44989, "display_filter": "frame.number == 44989", "timestamp_epoch": "1634915357.660451000" }, { "tcp_stream": 858, "frame_number": 44991, "display_filter": "frame.number == 44991", "timestamp_epoch": "1634915357.660942000" }, { "tcp_stream": 859, "frame_number": 44998, "display_filter": "frame.number == 44998", "timestamp_epoch": "1634915357.666066000" }, { "tcp_stream": 859, "frame_number": 45002, "display_filter": "frame.number == 45002", "timestamp_epoch": "1634915357.666907000" }, { "tcp_stream": 859, "frame_number": 45005, "display_filter": "frame.number == 45005", "timestamp_epoch": "1634915357.667565000" }, { "tcp_stream": 1157, "frame_number": 59937, "display_filter": "frame.number == 59937", "timestamp_epoch": "1634916153.395074000" }, { "tcp_stream": 1157, "frame_number": 59942, "display_filter": "frame.number == 59942", "timestamp_epoch": "1634916153.396771000" }, { "tcp_stream": 1157, "frame_number": 59944, "display_filter": "frame.number == 59944", "timestamp_epoch": "1634916153.397562000" }, { "tcp_stream": 1157, "frame_number": 59946, "display_filter": "frame.number == 59946", "timestamp_epoch": "1634916153.398107000" }, { "tcp_stream": 1157, "frame_number": 59948, "display_filter": "frame.number == 59948", "timestamp_epoch": "1634916153.398691000" }, { "tcp_stream": 1158, "frame_number": 59955, "display_filter": "frame.number == 59955", "timestamp_epoch": "1634916153.403064000" }, { "tcp_stream": 1158, "frame_number": 59959, "display_filter": "frame.number == 59959", "timestamp_epoch": "1634916153.403852000" }, { "tcp_stream": 1158, "frame_number": 59962, "display_filter": "frame.number == 59962", "timestamp_epoch": "1634916153.404439000" } ] }, { "id": "finding-61c1e5ca920c1f938250b779", "type": "pcap-finding", "label": "Directory-service protocol activity", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.22", "protocol": "samr", "destination": "10.10.22.158", "event_count": 43, "operation_numbers": [ "1", "16", "17", "18", "19", "20", "25", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "severity": "low", "confidence": 0.95, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 126, "frame_number": 2700, "display_filter": "frame.number == 2700", "timestamp_epoch": "1634913184.622184000" }, { "tcp_stream": 126, "frame_number": 2702, "display_filter": "frame.number == 2702", "timestamp_epoch": "1634913184.622793000" }, { "tcp_stream": 126, "frame_number": 2704, "display_filter": "frame.number == 2704", "timestamp_epoch": "1634913184.624214000" }, { "tcp_stream": 126, "frame_number": 2706, "display_filter": "frame.number == 2706", "timestamp_epoch": "1634913184.624880000" }, { "tcp_stream": 126, "frame_number": 2709, "display_filter": "frame.number == 2709", "timestamp_epoch": "1634913184.625793000" }, { "tcp_stream": 126, "frame_number": 2711, "display_filter": "frame.number == 2711", "timestamp_epoch": "1634913184.626530000" }, { "tcp_stream": 126, "frame_number": 2713, "display_filter": "frame.number == 2713", "timestamp_epoch": "1634913184.629077000" }, { "tcp_stream": 126, "frame_number": 2715, "display_filter": "frame.number == 2715", "timestamp_epoch": "1634913184.629836000" }, { "tcp_stream": 126, "frame_number": 2717, "display_filter": "frame.number == 2717", "timestamp_epoch": "1634913184.630761000" }, { "tcp_stream": 126, "frame_number": 2719, "display_filter": "frame.number == 2719", "timestamp_epoch": "1634913184.631320000" }, { "tcp_stream": 126, "frame_number": 2721, "display_filter": "frame.number == 2721", "timestamp_epoch": "1634913184.634069000" }, { "tcp_stream": 126, "frame_number": 2723, "display_filter": "frame.number == 2723", "timestamp_epoch": "1634913184.634622000" }, { "tcp_stream": 126, "frame_number": 2727, "display_filter": "frame.number == 2727", "timestamp_epoch": "1634913184.640596000" }, { "tcp_stream": 126, "frame_number": 2729, "display_filter": "frame.number == 2729", "timestamp_epoch": "1634913184.641392000" }, { "tcp_stream": 126, "frame_number": 2731, "display_filter": "frame.number == 2731", "timestamp_epoch": "1634913184.642336000" }, { "tcp_stream": 550, "frame_number": 23458, "display_filter": "frame.number == 23458", "timestamp_epoch": "1634914507.248180000" }, { "tcp_stream": 550, "frame_number": 23460, "display_filter": "frame.number == 23460", "timestamp_epoch": "1634914507.248927000" }, { "tcp_stream": 550, "frame_number": 23462, "display_filter": "frame.number == 23462", "timestamp_epoch": "1634914507.249569000" }, { "tcp_stream": 550, "frame_number": 23464, "display_filter": "frame.number == 23464", "timestamp_epoch": "1634914507.250289000" }, { "tcp_stream": 550, "frame_number": 23466, "display_filter": "frame.number == 23466", "timestamp_epoch": "1634914507.250966000" }, { "tcp_stream": 550, "frame_number": 23468, "display_filter": "frame.number == 23468", "timestamp_epoch": "1634914507.252690000" }, { "tcp_stream": 550, "frame_number": 23470, "display_filter": "frame.number == 23470", "timestamp_epoch": "1634914507.254035000" }, { "tcp_stream": 550, "frame_number": 23472, "display_filter": "frame.number == 23472", "timestamp_epoch": "1634914507.254744000" }, { "tcp_stream": 550, "frame_number": 23474, "display_filter": "frame.number == 23474", "timestamp_epoch": "1634914507.255232000" }, { "tcp_stream": 550, "frame_number": 23476, "display_filter": "frame.number == 23476", "timestamp_epoch": "1634914507.255737000" }, { "tcp_stream": 550, "frame_number": 23488, "display_filter": "frame.number == 23488", "timestamp_epoch": "1634914507.261559000" }, { "tcp_stream": 550, "frame_number": 23490, "display_filter": "frame.number == 23490", "timestamp_epoch": "1634914507.262113000" }, { "tcp_stream": 550, "frame_number": 23492, "display_filter": "frame.number == 23492", "timestamp_epoch": "1634914507.262843000" }, { "tcp_stream": 550, "frame_number": 23494, "display_filter": "frame.number == 23494", "timestamp_epoch": "1634914507.263570000" }, { "tcp_stream": 550, "frame_number": 23496, "display_filter": "frame.number == 23496", "timestamp_epoch": "1634914507.264351000" }, { "tcp_stream": 550, "frame_number": 23498, "display_filter": "frame.number == 23498", "timestamp_epoch": "1634914507.264954000" }, { "tcp_stream": 550, "frame_number": 23500, "display_filter": "frame.number == 23500", "timestamp_epoch": "1634914507.265674000" }, { "tcp_stream": 550, "frame_number": 23502, "display_filter": "frame.number == 23502", "timestamp_epoch": "1634914507.266247000" }, { "tcp_stream": 550, "frame_number": 23504, "display_filter": "frame.number == 23504", "timestamp_epoch": "1634914507.266808000" }, { "tcp_stream": 550, "frame_number": 23506, "display_filter": "frame.number == 23506", "timestamp_epoch": "1634914507.267272000" }, { "tcp_stream": 550, "frame_number": 23508, "display_filter": "frame.number == 23508", "timestamp_epoch": "1634914507.267760000" }, { "tcp_stream": 550, "frame_number": 23539, "display_filter": "frame.number == 23539", "timestamp_epoch": "1634914507.433399000" }, { "tcp_stream": 550, "frame_number": 23541, "display_filter": "frame.number == 23541", "timestamp_epoch": "1634914507.434112000" }, { "tcp_stream": 550, "frame_number": 23543, "display_filter": "frame.number == 23543", "timestamp_epoch": "1634914507.434778000" }, { "tcp_stream": 550, "frame_number": 23545, "display_filter": "frame.number == 23545", "timestamp_epoch": "1634914507.435436000" }, { "tcp_stream": 550, "frame_number": 23547, "display_filter": "frame.number == 23547", "timestamp_epoch": "1634914507.436179000" }, { "tcp_stream": 550, "frame_number": 23549, "display_filter": "frame.number == 23549", "timestamp_epoch": "1634914507.436780000" }, { "tcp_stream": 550, "frame_number": 23551, "display_filter": "frame.number == 23551", "timestamp_epoch": "1634914507.437301000" } ] }, { "id": "finding-91d5d1512d50a5639fdf314a", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "packets": 514, "wire_bytes": 376928, "destination": "37.0.10.22", "destination_port": 1187, "duration_seconds": 336.595 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 232, "frame_number": 5644, "display_filter": "tcp.stream == 232", "timestamp_epoch": "1634913296.323615" } ] }, { "id": "finding-cb37c859dd88ca2b28065961", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "packets": 72, "wire_bytes": 4376, "destination": "37.0.10.22", "destination_port": 1187, "duration_seconds": 171.549 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 391, "frame_number": 17795, "display_filter": "tcp.stream == 391", "timestamp_epoch": "1634914008.104086" } ] }, { "id": "finding-a7dddf26a0330e1c346d8c35", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "packets": 134, "wire_bytes": 8096, "destination": "37.0.10.22", "destination_port": 1187, "duration_seconds": 330.753 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 691, "frame_number": 24560, "display_filter": "tcp.stream == 691", "timestamp_epoch": "1634914834.452296" } ] }, { "id": "finding-6120c4e7f6ec4e47993b5da0", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.156", "packets": 9622, "wire_bytes": 1586196, "destination": "23.111.114.52", "destination_port": 65400, "duration_seconds": 3322.704 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 810, "frame_number": 42858, "display_filter": "tcp.stream == 810", "timestamp_epoch": "1634915276.907685" } ] }, { "id": "finding-303595c47bae259613031e88", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "packets": 136, "wire_bytes": 8216, "destination": "37.0.10.22", "destination_port": 1187, "duration_seconds": 334.618 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 968, "frame_number": 51877, "display_filter": "tcp.stream == 968", "timestamp_epoch": "1634915581.265992" } ] }, { "id": "finding-a11bdd34b8499fe7086849e4", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "packets": 134, "wire_bytes": 8096, "destination": "37.0.10.22", "destination_port": 1187, "duration_seconds": 330.634 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1254, "frame_number": 61387, "display_filter": "tcp.stream == 1254", "timestamp_epoch": "1634916305.874935" } ] }, { "id": "finding-5c3b43fdca4945be3516de85", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.156", "packets": 52, "wire_bytes": 3186, "destination": "45.153.241.142", "destination_port": 443, "duration_seconds": 699.347 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1346, "frame_number": 67512, "display_filter": "tcp.stream == 1346", "timestamp_epoch": "1634916791.498014" } ] }, { "id": "finding-3426cee31955e110f7d57224", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.156", "packets": 54, "wire_bytes": 3306, "destination": "45.153.241.142", "destination_port": 443, "duration_seconds": 699.318 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1347, "frame_number": 67513, "display_filter": "tcp.stream == 1347", "timestamp_epoch": "1634916791.526839" } ] }, { "id": "finding-5f9dede2af77370f489e5247", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "packets": 132, "wire_bytes": 7976, "destination": "37.0.10.22", "destination_port": 1187, "duration_seconds": 331.166 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1450, "frame_number": 69549, "display_filter": "tcp.stream == 1450", "timestamp_epoch": "1634917151.222338" } ] }, { "id": "finding-8cb9c129bd6937c3a7eef36d", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.156", "packets": 19, "wire_bytes": 1120, "destination": "45.153.241.142", "destination_port": 443, "duration_seconds": 30.11 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1485, "frame_number": 74529, "display_filter": "tcp.stream == 1485", "timestamp_epoch": "1634917460.73518" } ] }, { "id": "finding-4220077e4a1dbcaf29f61024", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "packets": 132, "wire_bytes": 7976, "destination": "37.0.10.22", "destination_port": 1187, "duration_seconds": 333.255 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1559, "frame_number": 76852, "display_filter": "tcp.stream == 1559", "timestamp_epoch": "1634917716.942239" } ] }, { "id": "finding-359f33c8adbd328fb49f63c3", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "packets": 134, "wire_bytes": 8096, "destination": "37.0.10.22", "destination_port": 1187, "duration_seconds": 331.75 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1607, "frame_number": 81050, "display_filter": "tcp.stream == 1607", "timestamp_epoch": "1634918141.451196" } ] }, { "id": "finding-512418f6412b894737398114", "type": "pcap-finding", "label": "Sustained external TCP conversation outside decoded application coverage", "source": "deterministic-pcap-analysis", "metrics": { "source": "10.10.22.157", "packets": 41, "wire_bytes": 2522, "destination": "37.0.10.22", "destination_port": 1187, "duration_seconds": 91.986 }, "rule_id": "unclassified-external-tcp", "severity": "medium", "confidence": 0.7, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "rule_version": "pcap-rules-v3", "frame_evidence": [ { "tcp_stream": 1645, "frame_number": 83774, "display_filter": "tcp.stream == 1645", "timestamp_epoch": "1634918507.685795" } ] }, { "id": "identity-5e4de9a1d77e753b27b1a305", "type": "identity", "label": "account: agnes.warren", "value": "agnes.warren", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.156" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 184, "frame_number": 4153, "display_filter": "frame.number == 4153", "timestamp_epoch": "1634913238.912446000" }, { "tcp_stream": 185, "frame_number": 4161, "display_filter": "frame.number == 4161", "timestamp_epoch": "1634913238.920172000" }, { "tcp_stream": 185, "frame_number": 4163, "display_filter": "frame.number == 4163", "timestamp_epoch": "1634913238.920739000" }, { "tcp_stream": 186, "frame_number": 4175, "display_filter": "frame.number == 4175", "timestamp_epoch": "1634913238.922317000" }, { "tcp_stream": 189, "frame_number": 4208, "display_filter": "frame.number == 4208", "timestamp_epoch": "1634913239.061306000" }, { "tcp_stream": 187, "frame_number": 4233, "display_filter": "frame.number == 4233", "timestamp_epoch": "1634913239.078398000" }, { "tcp_stream": 187, "frame_number": 4264, "display_filter": "frame.number == 4264", "timestamp_epoch": "1634913239.088685000" }, { "tcp_stream": 191, "frame_number": 4297, "display_filter": "frame.number == 4297", "timestamp_epoch": "1634913239.277211000" }, { "tcp_stream": 192, "frame_number": 4309, "display_filter": "frame.number == 4309", "timestamp_epoch": "1634913239.278574000" }, { "tcp_stream": 1032, "frame_number": 56437, "display_filter": "frame.number == 56437", "timestamp_epoch": "1634915852.298353000" }, { "tcp_stream": 1036, "frame_number": 56472, "display_filter": "frame.number == 56472", "timestamp_epoch": "1634915852.437817000" }, { "tcp_stream": 1037, "frame_number": 56493, "display_filter": "frame.number == 56493", "timestamp_epoch": "1634915852.466347000" }, { "tcp_stream": 1041, "frame_number": 56531, "display_filter": "frame.number == 56531", "timestamp_epoch": "1634915852.585078000" }, { "tcp_stream": 1284, "frame_number": 65581, "display_filter": "frame.number == 65581", "timestamp_epoch": "1634916650.252976000" }, { "tcp_stream": 1286, "frame_number": 65599, "display_filter": "frame.number == 65599", "timestamp_epoch": "1634916650.261430000" } ] }, { "id": "identity-d3ebf82e9523b0e7487b2a3c", "type": "identity", "label": "account: desktop-87wce26$", "value": "desktop-87wce26$", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.158" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 83, "frame_number": 1764, "display_filter": "frame.number == 1764", "timestamp_epoch": "1634913145.831706000" }, { "tcp_stream": 87, "frame_number": 1791, "display_filter": "frame.number == 1791", "timestamp_epoch": "1634913145.848618000" }, { "tcp_stream": 85, "frame_number": 1796, "display_filter": "frame.number == 1796", "timestamp_epoch": "1634913145.852967000" }, { "tcp_stream": 85, "frame_number": 1798, "display_filter": "frame.number == 1798", "timestamp_epoch": "1634913145.853587000" }, { "tcp_stream": 88, "frame_number": 1809, "display_filter": "frame.number == 1809", "timestamp_epoch": "1634913145.859061000" }, { "tcp_stream": 89, "frame_number": 1810, "display_filter": "frame.number == 1810", "timestamp_epoch": "1634913145.859091000" }, { "tcp_stream": 88, "frame_number": 1814, "display_filter": "frame.number == 1814", "timestamp_epoch": "1634913145.859840000" }, { "tcp_stream": 90, "frame_number": 1826, "display_filter": "frame.number == 1826", "timestamp_epoch": "1634913145.865255000" }, { "tcp_stream": 91, "frame_number": 1834, "display_filter": "frame.number == 1834", "timestamp_epoch": "1634913145.868768000" }, { "tcp_stream": 91, "frame_number": 1840, "display_filter": "frame.number == 1840", "timestamp_epoch": "1634913145.869642000" }, { "tcp_stream": 92, "frame_number": 1844, "display_filter": "frame.number == 1844", "timestamp_epoch": "1634913145.870168000" }, { "tcp_stream": 92, "frame_number": 1846, "display_filter": "frame.number == 1846", "timestamp_epoch": "1634913145.870622000" }, { "tcp_stream": 94, "frame_number": 1868, "display_filter": "frame.number == 1868", "timestamp_epoch": "1634913145.876752000" }, { "tcp_stream": 95, "frame_number": 1875, "display_filter": "frame.number == 1875", "timestamp_epoch": "1634913145.877659000" }, { "tcp_stream": 96, "frame_number": 1888, "display_filter": "frame.number == 1888", "timestamp_epoch": "1634913145.879102000" }, { "tcp_stream": 97, "frame_number": 1910, "display_filter": "frame.number == 1910", "timestamp_epoch": "1634913145.880667000" }, { "tcp_stream": 98, "frame_number": 1927, "display_filter": "frame.number == 1927", "timestamp_epoch": "1634913145.881980000" }, { "tcp_stream": 99, "frame_number": 1935, "display_filter": "frame.number == 1935", "timestamp_epoch": "1634913145.882910000" }, { "tcp_stream": 102, "frame_number": 2028, "display_filter": "frame.number == 2028", "timestamp_epoch": "1634913145.967311000" }, { "tcp_stream": 108, "frame_number": 2129, "display_filter": "frame.number == 2129", "timestamp_epoch": "1634913147.397698000" } ] }, { "id": "identity-83f4d817dbabecf372b8243a", "type": "identity", "label": "account: desktop-cfa3367$", "value": "desktop-cfa3367$", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.156" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 39, "frame_number": 848, "display_filter": "frame.number == 848", "timestamp_epoch": "1634913114.876916000" }, { "tcp_stream": 40, "frame_number": 856, "display_filter": "frame.number == 856", "timestamp_epoch": "1634913114.887524000" }, { "tcp_stream": 40, "frame_number": 858, "display_filter": "frame.number == 858", "timestamp_epoch": "1634913114.888225000" }, { "tcp_stream": 43, "frame_number": 883, "display_filter": "frame.number == 883", "timestamp_epoch": "1634913114.893968000" }, { "tcp_stream": 45, "frame_number": 896, "display_filter": "frame.number == 896", "timestamp_epoch": "1634913114.898720000" }, { "tcp_stream": 45, "frame_number": 899, "display_filter": "frame.number == 899", "timestamp_epoch": "1634913114.899293000" }, { "tcp_stream": 47, "frame_number": 910, "display_filter": "frame.number == 910", "timestamp_epoch": "1634913114.901972000" }, { "tcp_stream": 49, "frame_number": 927, "display_filter": "frame.number == 927", "timestamp_epoch": "1634913114.903831000" }, { "tcp_stream": 48, "frame_number": 929, "display_filter": "frame.number == 929", "timestamp_epoch": "1634913114.903912000" }, { "tcp_stream": 50, "frame_number": 947, "display_filter": "frame.number == 947", "timestamp_epoch": "1634913114.912442000" }, { "tcp_stream": 51, "frame_number": 949, "display_filter": "frame.number == 949", "timestamp_epoch": "1634913114.913042000" }, { "tcp_stream": 50, "frame_number": 953, "display_filter": "frame.number == 953", "timestamp_epoch": "1634913114.913384000" }, { "tcp_stream": 52, "frame_number": 980, "display_filter": "frame.number == 980", "timestamp_epoch": "1634913114.918262000" }, { "tcp_stream": 58, "frame_number": 1109, "display_filter": "frame.number == 1109", "timestamp_epoch": "1634913115.051423000" }, { "tcp_stream": 64, "frame_number": 1206, "display_filter": "frame.number == 1206", "timestamp_epoch": "1634913116.464149000" }, { "tcp_stream": 66, "frame_number": 1239, "display_filter": "frame.number == 1239", "timestamp_epoch": "1634913116.747935000" }, { "tcp_stream": 67, "frame_number": 1251, "display_filter": "frame.number == 1251", "timestamp_epoch": "1634913116.749617000" }, { "tcp_stream": 75, "frame_number": 1564, "display_filter": "frame.number == 1564", "timestamp_epoch": "1634913124.236684000" }, { "tcp_stream": 76, "frame_number": 1572, "display_filter": "frame.number == 1572", "timestamp_epoch": "1634913124.237776000" }, { "tcp_stream": 76, "frame_number": 1574, "display_filter": "frame.number == 1574", "timestamp_epoch": "1634913124.238388000" } ] }, { "id": "identity-0411f0ddeb8e63883f9ba06d", "type": "identity", "label": "account: desktop-nz875r4$", "value": "desktop-nz875r4$", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.157" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 4, "frame_number": 80, "display_filter": "frame.number == 80", "timestamp_epoch": "1634913054.060291000" }, { "tcp_stream": 6, "frame_number": 98, "display_filter": "frame.number == 98", "timestamp_epoch": "1634913054.070767000" }, { "tcp_stream": 6, "frame_number": 100, "display_filter": "frame.number == 100", "timestamp_epoch": "1634913054.071481000" }, { "tcp_stream": 7, "frame_number": 112, "display_filter": "frame.number == 112", "timestamp_epoch": "1634913054.075197000" }, { "tcp_stream": 11, "frame_number": 197, "display_filter": "frame.number == 197", "timestamp_epoch": "1634913054.364095000" }, { "tcp_stream": 12, "frame_number": 207, "display_filter": "frame.number == 207", "timestamp_epoch": "1634913054.373964000" }, { "tcp_stream": 12, "frame_number": 209, "display_filter": "frame.number == 209", "timestamp_epoch": "1634913054.374917000" }, { "tcp_stream": 13, "frame_number": 221, "display_filter": "frame.number == 221", "timestamp_epoch": "1634913054.389337000" }, { "tcp_stream": 14, "frame_number": 233, "display_filter": "frame.number == 233", "timestamp_epoch": "1634913054.390879000" }, { "tcp_stream": 17, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1634913054.707829000" }, { "tcp_stream": 18, "frame_number": 288, "display_filter": "frame.number == 288", "timestamp_epoch": "1634913054.709117000" }, { "tcp_stream": 18, "frame_number": 290, "display_filter": "frame.number == 290", "timestamp_epoch": "1634913054.709731000" }, { "tcp_stream": 19, "frame_number": 302, "display_filter": "frame.number == 302", "timestamp_epoch": "1634913054.711963000" }, { "tcp_stream": 21, "frame_number": 364, "display_filter": "frame.number == 364", "timestamp_epoch": "1634913055.675094000" }, { "tcp_stream": 23, "frame_number": 395, "display_filter": "frame.number == 395", "timestamp_epoch": "1634913055.741180000" }, { "tcp_stream": 24, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1634913055.743870000" }, { "tcp_stream": 31, "frame_number": 674, "display_filter": "frame.number == 674", "timestamp_epoch": "1634913063.084470000" }, { "tcp_stream": 32, "frame_number": 682, "display_filter": "frame.number == 682", "timestamp_epoch": "1634913063.085568000" }, { "tcp_stream": 32, "frame_number": 684, "display_filter": "frame.number == 684", "timestamp_epoch": "1634913063.086125000" }, { "tcp_stream": 33, "frame_number": 696, "display_filter": "frame.number == 696", "timestamp_epoch": "1634913063.087678000" } ] }, { "id": "identity-dacecb528cc0ac5cc25a716b", "type": "identity", "label": "account: kevin.henderson", "value": "kevin.henderson", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.158" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 122, "frame_number": 2596, "display_filter": "frame.number == 2596", "timestamp_epoch": "1634913184.474804000" }, { "tcp_stream": 123, "frame_number": 2604, "display_filter": "frame.number == 2604", "timestamp_epoch": "1634913184.482254000" }, { "tcp_stream": 123, "frame_number": 2606, "display_filter": "frame.number == 2606", "timestamp_epoch": "1634913184.482917000" }, { "tcp_stream": 124, "frame_number": 2618, "display_filter": "frame.number == 2618", "timestamp_epoch": "1634913184.484847000" }, { "tcp_stream": 128, "frame_number": 2659, "display_filter": "frame.number == 2659", "timestamp_epoch": "1634913184.594595000" }, { "tcp_stream": 126, "frame_number": 2682, "display_filter": "frame.number == 2682", "timestamp_epoch": "1634913184.615582000" }, { "tcp_stream": 126, "frame_number": 2715, "display_filter": "frame.number == 2715", "timestamp_epoch": "1634913184.629836000" }, { "tcp_stream": 131, "frame_number": 2760, "display_filter": "frame.number == 2760", "timestamp_epoch": "1634913184.836361000" }, { "tcp_stream": 132, "frame_number": 2772, "display_filter": "frame.number == 2772", "timestamp_epoch": "1634913184.837806000" }, { "tcp_stream": 551, "frame_number": 23434, "display_filter": "frame.number == 23434", "timestamp_epoch": "1634914507.243041000" } ] }, { "id": "identity-249e5ec8c500b999486e0e6a", "type": "identity", "label": "account: marcus.cobb", "value": "marcus.cobb", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.157" ], "identity_type": "account", "frame_evidence": [ { "tcp_stream": 152, "frame_number": 3366, "display_filter": "frame.number == 3366", "timestamp_epoch": "1634913211.323482000" }, { "tcp_stream": 153, "frame_number": 3374, "display_filter": "frame.number == 3374", "timestamp_epoch": "1634913211.333574000" }, { "tcp_stream": 153, "frame_number": 3376, "display_filter": "frame.number == 3376", "timestamp_epoch": "1634913211.334373000" }, { "tcp_stream": 154, "frame_number": 3388, "display_filter": "frame.number == 3388", "timestamp_epoch": "1634913211.336377000" }, { "tcp_stream": 158, "frame_number": 3431, "display_filter": "frame.number == 3431", "timestamp_epoch": "1634913211.570097000" }, { "tcp_stream": 157, "frame_number": 3454, "display_filter": "frame.number == 3454", "timestamp_epoch": "1634913211.587306000" }, { "tcp_stream": 157, "frame_number": 3483, "display_filter": "frame.number == 3483", "timestamp_epoch": "1634913211.599905000" }, { "tcp_stream": 161, "frame_number": 3515, "display_filter": "frame.number == 3515", "timestamp_epoch": "1634913211.657164000" }, { "tcp_stream": 162, "frame_number": 3525, "display_filter": "frame.number == 3525", "timestamp_epoch": "1634913211.658852000" } ] }, { "id": "identity-83fdf0c6338307b2f2d78104", "type": "identity", "label": "domain: ENEMYWATCH", "value": "ENEMYWATCH", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.156", "10.10.22.157", "10.10.22.158" ], "identity_type": "domain", "frame_evidence": [ { "tcp_stream": 126, "frame_number": 2682, "display_filter": "frame.number == 2682", "timestamp_epoch": "1634913184.615582000" }, { "tcp_stream": 157, "frame_number": 3454, "display_filter": "frame.number == 3454", "timestamp_epoch": "1634913211.587306000" }, { "tcp_stream": 187, "frame_number": 4233, "display_filter": "frame.number == 4233", "timestamp_epoch": "1634913239.078398000" }, { "tcp_stream": 1032, "frame_number": 56437, "display_filter": "frame.number == 56437", "timestamp_epoch": "1634915852.298353000" }, { "tcp_stream": 1036, "frame_number": 56472, "display_filter": "frame.number == 56472", "timestamp_epoch": "1634915852.437817000" }, { "tcp_stream": 1037, "frame_number": 56493, "display_filter": "frame.number == 56493", "timestamp_epoch": "1634915852.466347000" }, { "tcp_stream": 1041, "frame_number": 56531, "display_filter": "frame.number == 56531", "timestamp_epoch": "1634915852.585078000" }, { "tcp_stream": 1284, "frame_number": 65581, "display_filter": "frame.number == 65581", "timestamp_epoch": "1634916650.252976000" }, { "tcp_stream": 1286, "frame_number": 65599, "display_filter": "frame.number == 65599", "timestamp_epoch": "1634916650.261430000" } ] }, { "id": "identity-d2c45be8891f1e195bbfe21d", "type": "identity", "label": "full-name: Agnes Warren", "value": "Agnes Warren", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.156" ], "identity_type": "full-name", "frame_evidence": [ { "tcp_stream": 187, "frame_number": 4264, "display_filter": "frame.number == 4264", "timestamp_epoch": "1634913239.088685000" } ] }, { "id": "identity-2edf965c4a800c1b042af247", "type": "identity", "label": "full-name: Kevin Henderson", "value": "Kevin Henderson", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.158" ], "identity_type": "full-name", "frame_evidence": [ { "tcp_stream": 126, "frame_number": 2715, "display_filter": "frame.number == 2715", "timestamp_epoch": "1634913184.629836000" } ] }, { "id": "identity-d01711a1c8eb585fff7545c6", "type": "identity", "label": "full-name: Marcus Cobb", "value": "Marcus Cobb", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.157" ], "identity_type": "full-name", "frame_evidence": [ { "tcp_stream": 157, "frame_number": 3483, "display_filter": "frame.number == 3483", "timestamp_epoch": "1634913211.599905000" } ] }, { "id": "identity-8450b12deedacd9d1a3a4d36", "type": "identity", "label": "hostname: DESKTOP-87WCE26", "value": "DESKTOP-87WCE26", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.158" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 0, "frame_number": 1667, "display_filter": "frame.number == 1667", "timestamp_epoch": "1634913143.408229000" }, { "udp_stream": 79, "frame_number": 1691, "display_filter": "frame.number == 1691", "timestamp_epoch": "1634913144.032979000" }, { "udp_stream": 79, "frame_number": 1726, "display_filter": "frame.number == 1726", "timestamp_epoch": "1634913145.533441000" }, { "udp_stream": 79, "frame_number": 2106, "display_filter": "frame.number == 2106", "timestamp_epoch": "1634913146.785136000" }, { "udp_stream": 79, "frame_number": 2107, "display_filter": "frame.number == 2107", "timestamp_epoch": "1634913147.049038000" }, { "udp_stream": 79, "frame_number": 2310, "display_filter": "frame.number == 2310", "timestamp_epoch": "1634913148.283485000" }, { "udp_stream": 102, "frame_number": 2315, "display_filter": "frame.number == 2315", "timestamp_epoch": "1634913148.596077000" }, { "udp_stream": 102, "frame_number": 2321, "display_filter": "frame.number == 2321", "timestamp_epoch": "1634913149.346507000" }, { "udp_stream": 79, "frame_number": 2398, "display_filter": "frame.number == 2398", "timestamp_epoch": "1634913149.814810000" }, { "udp_stream": 102, "frame_number": 2399, "display_filter": "frame.number == 2399", "timestamp_epoch": "1634913150.143269000" }, { "udp_stream": 102, "frame_number": 2402, "display_filter": "frame.number == 2402", "timestamp_epoch": "1634913150.939982000" }, { "udp_stream": 102, "frame_number": 2403, "display_filter": "frame.number == 2403", "timestamp_epoch": "1634913151.361974000" }, { "udp_stream": 102, "frame_number": 2404, "display_filter": "frame.number == 2404", "timestamp_epoch": "1634913152.158689000" }, { "udp_stream": 102, "frame_number": 2405, "display_filter": "frame.number == 2405", "timestamp_epoch": "1634913152.956431000" }, { "udp_stream": 102, "frame_number": 2406, "display_filter": "frame.number == 2406", "timestamp_epoch": "1634913153.768683000" }, { "udp_stream": 107, "frame_number": 2422, "display_filter": "frame.number == 2422", "timestamp_epoch": "1634913154.545976000" }, { "tcp_stream": 126, "frame_number": 2682, "display_filter": "frame.number == 2682", "timestamp_epoch": "1634913184.615582000" }, { "udp_stream": 107, "frame_number": 6745, "display_filter": "frame.number == 6745", "timestamp_epoch": "1634913391.991249000" }, { "udp_stream": 107, "frame_number": 16289, "display_filter": "frame.number == 16289", "timestamp_epoch": "1634913871.528482000" }, { "udp_stream": 107, "frame_number": 23833, "display_filter": "frame.number == 23833", "timestamp_epoch": "1634914589.589976000" } ] }, { "id": "identity-ae1caf01f8d0ff5ac951deb5", "type": "identity", "label": "hostname: DESKTOP-CFA3367", "value": "DESKTOP-CFA3367", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.156" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 0, "frame_number": 776, "display_filter": "frame.number == 776", "timestamp_epoch": "1634913112.606848000" }, { "udp_stream": 39, "frame_number": 797, "display_filter": "frame.number == 797", "timestamp_epoch": "1634913113.386438000" }, { "udp_stream": 39, "frame_number": 871, "display_filter": "frame.number == 871", "timestamp_epoch": "1634913114.891550000" }, { "udp_stream": 39, "frame_number": 1183, "display_filter": "frame.number == 1183", "timestamp_epoch": "1634913116.001875000" }, { "udp_stream": 39, "frame_number": 1197, "display_filter": "frame.number == 1197", "timestamp_epoch": "1634913116.438441000" }, { "udp_stream": 39, "frame_number": 1419, "display_filter": "frame.number == 1419", "timestamp_epoch": "1634913117.516621000" }, { "udp_stream": 62, "frame_number": 1426, "display_filter": "frame.number == 1426", "timestamp_epoch": "1634913117.969840000" }, { "udp_stream": 62, "frame_number": 1504, "display_filter": "frame.number == 1504", "timestamp_epoch": "1634913118.735645000" }, { "udp_stream": 39, "frame_number": 1505, "display_filter": "frame.number == 1505", "timestamp_epoch": "1634913119.033900000" }, { "udp_stream": 62, "frame_number": 1506, "display_filter": "frame.number == 1506", "timestamp_epoch": "1634913119.503076000" }, { "udp_stream": 62, "frame_number": 1510, "display_filter": "frame.number == 1510", "timestamp_epoch": "1634913120.298084000" }, { "udp_stream": 62, "frame_number": 1515, "display_filter": "frame.number == 1515", "timestamp_epoch": "1634913120.594845000" }, { "udp_stream": 62, "frame_number": 1516, "display_filter": "frame.number == 1516", "timestamp_epoch": "1634913121.344879000" }, { "udp_stream": 62, "frame_number": 1517, "display_filter": "frame.number == 1517", "timestamp_epoch": "1634913122.157959000" }, { "udp_stream": 62, "frame_number": 1518, "display_filter": "frame.number == 1518", "timestamp_epoch": "1634913122.939445000" }, { "udp_stream": 67, "frame_number": 1526, "display_filter": "frame.number == 1526", "timestamp_epoch": "1634913123.722599000" }, { "tcp_stream": 187, "frame_number": 4233, "display_filter": "frame.number == 4233", "timestamp_epoch": "1634913239.078398000" }, { "udp_stream": 67, "frame_number": 6607, "display_filter": "frame.number == 6607", "timestamp_epoch": "1634913361.217367000" }, { "udp_stream": 67, "frame_number": 16214, "display_filter": "frame.number == 16214", "timestamp_epoch": "1634913841.007291000" }, { "udp_stream": 67, "frame_number": 23753, "display_filter": "frame.number == 23753", "timestamp_epoch": "1634914561.173186000" } ] }, { "id": "identity-e652c96d5285d4224b8c4b0d", "type": "identity", "label": "hostname: DESKTOP-NZ875R4", "value": "DESKTOP-NZ875R4", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [ "10.10.22.157" ], "identity_type": "hostname", "frame_evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1634913051.987411000" }, { "udp_stream": 12, "frame_number": 42, "display_filter": "frame.number == 42", "timestamp_epoch": "1634913053.870688000" }, { "udp_stream": 12, "frame_number": 333, "display_filter": "frame.number == 333", "timestamp_epoch": "1634913054.958211000" }, { "udp_stream": 12, "frame_number": 343, "display_filter": "frame.number == 343", "timestamp_epoch": "1634913055.363162000" }, { "udp_stream": 12, "frame_number": 545, "display_filter": "frame.number == 545", "timestamp_epoch": "1634913056.488079000" }, { "udp_stream": 12, "frame_number": 547, "display_filter": "frame.number == 547", "timestamp_epoch": "1634913056.878752000" }, { "udp_stream": 12, "frame_number": 623, "display_filter": "frame.number == 623", "timestamp_epoch": "1634913057.988133000" }, { "udp_stream": 26, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1634913058.411946000" }, { "udp_stream": 26, "frame_number": 627, "display_filter": "frame.number == 627", "timestamp_epoch": "1634913059.175815000" }, { "udp_stream": 26, "frame_number": 628, "display_filter": "frame.number == 628", "timestamp_epoch": "1634913059.566278000" }, { "udp_stream": 26, "frame_number": 629, "display_filter": "frame.number == 629", "timestamp_epoch": "1634913059.956931000" }, { "udp_stream": 26, "frame_number": 631, "display_filter": "frame.number == 631", "timestamp_epoch": "1634913060.378814000" }, { "udp_stream": 26, "frame_number": 632, "display_filter": "frame.number == 632", "timestamp_epoch": "1634913060.770870000" }, { "udp_stream": 26, "frame_number": 634, "display_filter": "frame.number == 634", "timestamp_epoch": "1634913061.177107000" }, { "udp_stream": 26, "frame_number": 635, "display_filter": "frame.number == 635", "timestamp_epoch": "1634913061.973600000" }, { "udp_stream": 28, "frame_number": 638, "display_filter": "frame.number == 638", "timestamp_epoch": "1634913062.813903000" }, { "tcp_stream": 157, "frame_number": 3454, "display_filter": "frame.number == 3454", "timestamp_epoch": "1634913211.587306000" }, { "udp_stream": 28, "frame_number": 5741, "display_filter": "frame.number == 5741", "timestamp_epoch": "1634913300.309105000" }, { "udp_stream": 28, "frame_number": 14544, "display_filter": "frame.number == 14544", "timestamp_epoch": "1634913778.963684000" }, { "udp_stream": 28, "frame_number": 23372, "display_filter": "frame.number == 23372", "timestamp_epoch": "1634914496.868629000" } ] }, { "id": "identity-6149a59e1909d2ffe4528ed7", "type": "identity", "label": "netbios-group: ENEMYWATCH", "value": "ENEMYWATCH", "source": "deterministic-pcap-analysis", "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "ip_addresses": [], "identity_type": "netbios-group", "frame_evidence": [ { "udp_stream": 12, "frame_number": 43, "display_filter": "frame.number == 43", "timestamp_epoch": "1634913053.870984000" }, { "udp_stream": 12, "frame_number": 342, "display_filter": "frame.number == 342", "timestamp_epoch": "1634913055.363048000" }, { "udp_stream": 12, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1634913056.878694000" }, { "udp_stream": 26, "frame_number": 625, "display_filter": "frame.number == 625", "timestamp_epoch": "1634913058.412198000" }, { "udp_stream": 26, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1634913059.175670000" }, { "udp_stream": 26, "frame_number": 630, "display_filter": "frame.number == 630", "timestamp_epoch": "1634913059.957115000" }, { "udp_stream": 26, "frame_number": 633, "display_filter": "frame.number == 633", "timestamp_epoch": "1634913060.771156000" }, { "udp_stream": 39, "frame_number": 798, "display_filter": "frame.number == 798", "timestamp_epoch": "1634913113.386499000" }, { "udp_stream": 39, "frame_number": 870, "display_filter": "frame.number == 870", "timestamp_epoch": "1634913114.891502000" }, { "udp_stream": 39, "frame_number": 1198, "display_filter": "frame.number == 1198", "timestamp_epoch": "1634913116.438503000" }, { "udp_stream": 62, "frame_number": 1427, "display_filter": "frame.number == 1427", "timestamp_epoch": "1634913117.969941000" }, { "udp_stream": 62, "frame_number": 1503, "display_filter": "frame.number == 1503", "timestamp_epoch": "1634913118.735434000" }, { "udp_stream": 62, "frame_number": 1507, "display_filter": "frame.number == 1507", "timestamp_epoch": "1634913119.503246000" }, { "udp_stream": 62, "frame_number": 1511, "display_filter": "frame.number == 1511", "timestamp_epoch": "1634913120.298200000" }, { "udp_stream": 79, "frame_number": 1692, "display_filter": "frame.number == 1692", "timestamp_epoch": "1634913144.033073000" }, { "udp_stream": 79, "frame_number": 1725, "display_filter": "frame.number == 1725", "timestamp_epoch": "1634913145.533372000" }, { "udp_stream": 79, "frame_number": 2108, "display_filter": "frame.number == 2108", "timestamp_epoch": "1634913147.049101000" }, { "udp_stream": 102, "frame_number": 2316, "display_filter": "frame.number == 2316", "timestamp_epoch": "1634913148.596271000" }, { "udp_stream": 102, "frame_number": 2322, "display_filter": "frame.number == 2322", "timestamp_epoch": "1634913149.346678000" }, { "udp_stream": 102, "frame_number": 2400, "display_filter": "frame.number == 2400", "timestamp_epoch": "1634913150.143449000" } ] }, { "id": "artifact-f271fe123d45e866bd896fd9", "type": "file-artifact", "label": "44491.6090605324(1).dat", "value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "sha256": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "source": "deterministic-pcap-analysis", "size_bytes": 911360, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-b62edb1cab1c1f4cc4be2532", "type": "file-artifact", "label": "main.php", "value": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "sha256": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "source": "deterministic-pcap-analysis", "size_bytes": 337420, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-57c6ebaaf9c9c40183d28fb8", "type": "file-artifact", "label": "index.php", "value": "c8da41ae6e70a1997020d6c903d2627a3ee35383159cd04de53e73ff3f5acd82", "sha256": "c8da41ae6e70a1997020d6c903d2627a3ee35383159cd04de53e73ff3f5acd82", "source": "deterministic-pcap-analysis", "size_bytes": 183, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "artifact-bbb3e0bc2bf2028f2a6854ba", "type": "file-artifact", "label": "click-1225267-10537174-1463076242000%3fsid=552795f4335011ec81850e774cf9d6690INT", "value": "17c18c10640debcfd5b5f61f07b12d7327809410c3a90f7cd69f21fb869554ea", "sha256": "17c18c10640debcfd5b5f61f07b12d7327809410c3a90f7cd69f21fb869554ea", "source": "deterministic-pcap-analysis", "size_bytes": 577, "source_ref": "2021-10-22-ISC-forensic-challenge-traffic.pcap", "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24", "source_refs": [ "2021-10-22-ISC-forensic-challenge-traffic.pcap", "deterministic-pcap-analysis" ], "content_type": "application/octet-stream" }, { "id": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157", "type": "ioc-investigation", "label": "kamuchehddhgfgf.ddns.net", "value": "kamuchehddhgfgf.ddns.net", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "3 engines marked malicious and 1 suspicious; 52 harmless, 33 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "skipped", "summary": "MalwareBazaar is hash-focused; input is not a hash." }, { "source": "otx", "status": "ok", "summary": "OTX returned 0 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern." }, { "source": "greynoise", "status": "skipped", "summary": "GreyNoise is IP-focused; input is not an IP." }, { "source": "abuseipdb", "status": "skipped", "summary": "AbuseIPDB is IP-focused; input is not an IP." }, { "source": "shodan", "status": "skipped", "summary": "Shodan host lookup is IP-focused; input is not an IP." }, { "source": "censys", "status": "ok", "summary": "Censys web property lookup returned 2 record(s) for kamuchehddhgfgf.ddns.net. Broader Censys search requires an organization-enabled account and API role." } ], "summary": "kamuchehddhgfgf.ddns.net was classified as domain. Investigation verdict is needs review with score 22/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "needs review", "source_ref": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157", "actor_leads": [], "source_refs": [ "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157", "ioc-investigation" ], "artifact_type": "domain", "review_status": "unreviewed-provider-context", "suspicion_score": 22, "actor_lead_count": 0, "graph_edge_count": 1, "graph_node_count": 1, "source_analysis_ref": "/api/ioc/investigations/58057369-e44a-47d1-97a6-8f537e481157", "graph_preview_truncated": false, "graph_preview_edge_count": 1, "graph_preview_node_count": 1 }, { "id": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157:node:domain:kamuchehddhgfgf.ddns.net", "kind": "artifact", "tier": 0, "type": "domain", "value": "kamuchehddhgfgf.ddns.net", "sources": [ "input", "censys" ], "source_ref": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157", "suspicious": 22, "source_refs": [ "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "type": "ioc-investigation", "label": "23.111.114.52", "value": "23.111.114.52", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "13 engines marked malicious and 0 suspicious; 45 harmless, 31 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "skipped", "summary": "MalwareBazaar is hash-focused; input is not a hash." }, { "source": "otx", "status": "ok", "summary": "OTX returned 50 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 6 scan result(s). urlscan activity analysis found 1 suspicious pattern(s)." }, { "source": "greynoise", "status": "not_found", "summary": "GreyNoise classification: unknown." }, { "source": "abuseipdb", "status": "ok", "summary": "AbuseIPDB confidence score: 0/100." }, { "source": "shodan", "status": "not_found", "summary": "Shodan returned 0 open port(s)." }, { "source": "censys", "status": "ok", "summary": "Censys host lookup returned 1 service(s)." } ], "summary": "23.111.114.52 was classified as ip. Investigation verdict is highly suspicious with score 77/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "highly suspicious", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "actor_leads": [], "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation" ], "artifact_type": "ip", "review_status": "unreviewed-provider-context", "suspicion_score": 77, "actor_lead_count": 0, "graph_edge_count": 9, "graph_node_count": 8, "source_analysis_ref": "/api/ioc/investigations/593d219e-2578-45ab-8d90-697899320a04", "graph_preview_truncated": false, "graph_preview_edge_count": 9, "graph_preview_node_count": 8 }, { "id": "ioc:23.111.114.52", "type": "ioc", "value": "23.111.114.52", "source": "ioc-investigation", "verdict": "highly suspicious", "ioc_type": "ip", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "description": "23.111.114.52 was classified as ip. Investigation verdict is highly suspicious with score 77/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation" ], "suspicion_score": 77 }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "kind": "artifact", "tier": 0, "type": "ip", "value": "23.111.114.52", "sources": [ "input", "otx", "urlscan", "abuseipdb" ], "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "suspicious": 77, "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:collection:apt29", "kind": "relationship", "tier": 1, "type": "collection", "value": "APT29", "sources": [ "otx" ], "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "suspicious": 60, "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:collection:cymulateipdom", "kind": "relationship", "tier": 1, "type": "collection", "value": "CymulateIPDOM", "sources": [ "otx" ], "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "suspicious": 60, "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:collection:test created 1 year ago by testivk1 clone", "kind": "relationship", "tier": 1, "type": "collection", "value": "test CREATED 1 YEAR AGO by testivk1 clone", "sources": [ "otx" ], "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "suspicious": 60, "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:domain:23.111.114.52", "kind": "relationship", "tier": 1, "type": "domain", "value": "23.111.114.52", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "suspicious": 60, "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:domain:servers.ru", "kind": "relationship", "tier": 1, "type": "domain", "value": "servers.ru", "sources": [ "abuseipdb" ], "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "suspicious": 60, "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:url:http://23.111.114.52", "kind": "relationship", "tier": 1, "type": "url", "value": "http://23.111.114.52", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "suspicious": 60, "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:url:http://23.111.114.52/", "kind": "relationship", "tier": 1, "type": "url", "value": "http://23.111.114.52/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "suspicious": 60, "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "type": "ioc-investigation", "label": "37.0.10.22", "value": "37.0.10.22", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "1 engines marked malicious and 1 suspicious; 53 harmless, 34 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "skipped", "summary": "MalwareBazaar is hash-focused; input is not a hash." }, { "source": "otx", "status": "ok", "summary": "OTX returned 1 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern." }, { "source": "greynoise", "status": "not_found", "summary": "GreyNoise classification: unknown." }, { "source": "abuseipdb", "status": "ok", "summary": "AbuseIPDB confidence score: 0/100." }, { "source": "shodan", "status": "not_found", "summary": "Shodan returned 0 open port(s)." }, { "source": "censys", "status": "ok", "summary": "Censys host lookup returned 0 service(s)." } ], "summary": "37.0.10.22 was classified as ip. Investigation verdict is low signal with score 19/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "low signal", "source_ref": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "actor_leads": [], "source_refs": [ "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "ioc-investigation" ], "artifact_type": "ip", "review_status": "unreviewed-provider-context", "suspicion_score": 19, "actor_lead_count": 0, "graph_edge_count": 2, "graph_node_count": 3, "source_analysis_ref": "/api/ioc/investigations/20f513e1-0d5c-4c07-a135-12408729e84e", "graph_preview_truncated": false, "graph_preview_edge_count": 2, "graph_preview_node_count": 3 }, { "id": "ioc:37.0.10.22", "type": "ioc", "value": "37.0.10.22", "source": "ioc-investigation", "verdict": "low signal", "ioc_type": "ip", "source_ref": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "description": "37.0.10.22 was classified as ip. Investigation verdict is low signal with score 19/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "ioc-investigation" ], "suspicion_score": 19 }, { "id": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:node:ip:37.0.10.22", "kind": "artifact", "tier": 0, "type": "ip", "value": "37.0.10.22", "sources": [ "input", "otx", "abuseipdb" ], "source_ref": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "suspicious": 60, "source_refs": [ "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:node:collection:C2 Servers & Virus Providers & Malware Hashes", "kind": "relationship", "tier": 1, "type": "collection", "value": "C2 Servers & Virus Providers & Malware Hashes", "sources": [ "otx" ], "source_ref": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "suspicious": 60, "source_refs": [ "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:node:domain:singtel.com", "kind": "relationship", "tier": 1, "type": "domain", "value": "singtel.com", "sources": [ "abuseipdb" ], "source_ref": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "suspicious": 60, "source_refs": [ "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "type": "ioc-investigation", "label": "sobolpand.top", "value": "sobolpand.top", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "10 engines marked malicious and 1 suspicious; 46 harmless, 32 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "skipped", "summary": "MalwareBazaar is hash-focused; input is not a hash." }, { "source": "otx", "status": "ok", "summary": "OTX returned 1 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 3 scan result(s). urlscan activity analysis found no obvious suspicious pattern." }, { "source": "greynoise", "status": "skipped", "summary": "GreyNoise is IP-focused; input is not an IP." }, { "source": "abuseipdb", "status": "skipped", "summary": "AbuseIPDB is IP-focused; input is not an IP." }, { "source": "shodan", "status": "skipped", "summary": "Shodan host lookup is IP-focused; input is not an IP." }, { "source": "censys", "status": "ok", "summary": "Censys web property lookup returned 2 record(s) for sobolpand.top. Broader Censys search requires an organization-enabled account and API role." } ], "summary": "sobolpand.top was classified as domain. Investigation verdict is suspicious with score 68/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 3 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "suspicious", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "actor_leads": [], "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation" ], "artifact_type": "domain", "review_status": "unreviewed-provider-context", "suspicion_score": 68, "actor_lead_count": 0, "graph_edge_count": 17, "graph_node_count": 15, "source_analysis_ref": "/api/ioc/investigations/06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "graph_preview_truncated": false, "graph_preview_edge_count": 17, "graph_preview_node_count": 15 }, { "id": "ioc:sobolpand.top", "type": "ioc", "value": "sobolpand.top", "source": "ioc-investigation", "verdict": "suspicious", "ioc_type": "domain", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "description": "sobolpand.top was classified as domain. Investigation verdict is suspicious with score 68/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 3 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation" ], "suspicion_score": 68 }, { "id": "ttp-evidence:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:T1566", "type": "ttp-evidence", "label": "T1566 Phishing", "source": "ioc-investigation", "tactic": "initial-access", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1566", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:T1204.002", "type": "ttp-evidence", "label": "T1204.002 Malicious File", "source": "ioc-investigation", "tactic": "execution", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1204.002", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:T1219", "type": "ttp-evidence", "label": "T1219 Remote Access Tools", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1219", "references": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "otx (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation" ] }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "kind": "artifact", "tier": 0, "type": "domain", "value": "sobolpand.top", "sources": [ "input", "virustotal", "otx", "urlscan", "censys" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 85, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:collection:\"Stolen Images Evidence\" campaign pushes Sliver-based malware", "kind": "relationship", "tier": 1, "type": "collection", "value": "\"Stolen Images Evidence\" campaign pushes Sliver-based malware", "sources": [ "otx" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 60, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:dns1.hichina.com", "kind": "relationship", "tier": 1, "type": "domain", "value": "dns1.hichina.com", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 85, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:dns2.hichina.com", "kind": "relationship", "tier": 1, "type": "domain", "value": "dns2.hichina.com", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 85, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:expired.hichina.com", "kind": "relationship", "tier": 1, "type": "domain", "value": "expired.hichina.com", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 85, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:114.55.89.54", "kind": "relationship", "tier": 1, "type": "ip", "value": "114.55.89.54", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 60, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:172.67.139.101", "kind": "relationship", "tier": 1, "type": "ip", "value": "172.67.139.101", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 60, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:45.114.105.162", "kind": "relationship", "tier": 1, "type": "ip", "value": "45.114.105.162", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 60, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:47.76.127.217", "kind": "relationship", "tier": 1, "type": "ip", "value": "47.76.127.217", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 85, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:47.91.170.222", "kind": "relationship", "tier": 1, "type": "ip", "value": "47.91.170.222", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 85, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:8.218.208.240", "kind": "relationship", "tier": 1, "type": "ip", "value": "8.218.208.240", "sources": [ "virustotal" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 85, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:url:http://sobolpand.top", "kind": "relationship", "tier": 1, "type": "url", "value": "http://sobolpand.top", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 60, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:url:http://sobolpand.top/", "kind": "relationship", "tier": 1, "type": "url", "value": "http://sobolpand.top/", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 60, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:url:http://sobolpand.top/034g100/index.php", "kind": "relationship", "tier": 1, "type": "url", "value": "http://sobolpand.top/034g100/index.php", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 60, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:url:https://sobolpand.top/034g100/index.php", "kind": "relationship", "tier": 1, "type": "url", "value": "https://sobolpand.top/034g100/index.php", "sources": [ "urlscan" ], "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "suspicious": 60, "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "type": "ioc-investigation", "label": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "60 engines marked malicious and 0 suspicious; 0 harmless, 11 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "ok", "summary": "MalwareBazaar returned 1 sample record(s)." }, { "source": "otx", "status": "ok", "summary": "OTX returned 4 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern." }, { "source": "greynoise", "status": "skipped", "summary": "GreyNoise is IP-focused; input is not an IP." }, { "source": "abuseipdb", "status": "skipped", "summary": "AbuseIPDB is IP-focused; input is not an IP." }, { "source": "shodan", "status": "skipped", "summary": "Shodan host lookup is IP-focused; input is not an IP." }, { "source": "censys", "status": "skipped", "summary": "Censys host and search pivots support IP, domain, and URL inputs." } ], "summary": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d was classified as hash. Investigation verdict is highly suspicious with score 97/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 3 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "highly suspicious", "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "actor_leads": [], "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation" ], "artifact_type": "hash", "review_status": "unreviewed-provider-context", "suspicion_score": 97, "actor_lead_count": 0, "graph_edge_count": 6, "graph_node_count": 6, "source_analysis_ref": "/api/ioc/investigations/ed278503-bcef-4a9e-985d-fdb452eaa0f4", "graph_preview_truncated": false, "graph_preview_edge_count": 6, "graph_preview_node_count": 6 }, { "id": "ioc:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "type": "ioc", "value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "source": "ioc-investigation", "verdict": "highly suspicious", "ioc_type": "hash", "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "description": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d was classified as hash. Investigation verdict is highly suspicious with score 97/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 3 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation" ], "suspicion_score": 97 }, { "id": "ttp-evidence:ed278503-bcef-4a9e-985d-fdb452eaa0f4:T1082", "type": "ttp-evidence", "label": "T1082 System Information Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1082", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation" ] }, { "id": "ttp-evidence:ed278503-bcef-4a9e-985d-fdb452eaa0f4:T1083", "type": "ttp-evidence", "label": "T1083 File and Directory Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1083", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation" ] }, { "id": "ttp-evidence:ed278503-bcef-4a9e-985d-fdb452eaa0f4:T1129", "type": "ttp-evidence", "label": "T1129 Shared Modules", "source": "ioc-investigation", "tactic": "execution", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1129", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation" ] }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "kind": "artifact", "tier": 0, "type": "hash", "value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "sources": [ "input", "malwarebazaar", "otx" ], "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "suspicious": 97, "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:collection:Malware Bazar 2", "kind": "relationship", "tier": 1, "type": "collection", "value": "Malware Bazar 2", "sources": [ "otx" ], "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "suspicious": 60, "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:collection:Malware Hashes", "kind": "relationship", "tier": 1, "type": "collection", "value": "Malware Hashes", "sources": [ "otx" ], "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "suspicious": 60, "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:file:44491.6090605324.dat", "kind": "relationship", "tier": 1, "type": "file", "value": "44491.6090605324.dat", "sources": [ "malwarebazaar" ], "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "suspicious": 60, "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:e425a2d4cd89cb995a5fbf5e9b6671be8c51774f", "kind": "relationship", "tier": 1, "type": "hash", "value": "e425a2d4cd89cb995a5fbf5e9b6671be8c51774f", "sources": [ "malwarebazaar" ], "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "suspicious": 60, "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:fdc89b23e17d46173806407132b2903c", "kind": "relationship", "tier": 1, "type": "hash", "value": "fdc89b23e17d46173806407132b2903c", "sources": [ "malwarebazaar" ], "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "suspicious": 60, "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4" ], "review_status": "unreviewed-provider-context" }, { "id": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "type": "ioc-investigation", "label": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "value": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "source": "ioc-investigation", "sources": [ { "source": "local-db", "status": "ok", "summary": "Found 0 local IOC record(s)." }, { "source": "virustotal", "status": "ok", "summary": "55 engines marked malicious and 0 suspicious; 0 harmless, 17 undetected." }, { "source": "threatfox", "status": "not_found", "summary": "ThreatFox returned 0 record(s)." }, { "source": "malwarebazaar", "status": "not_found", "summary": "MalwareBazaar returned 0 sample record(s)." }, { "source": "otx", "status": "ok", "summary": "OTX returned 0 pulse(s)." }, { "source": "urlscan", "status": "ok", "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern." }, { "source": "greynoise", "status": "skipped", "summary": "GreyNoise is IP-focused; input is not an IP." }, { "source": "abuseipdb", "status": "skipped", "summary": "AbuseIPDB is IP-focused; input is not an IP." }, { "source": "shodan", "status": "skipped", "summary": "Shodan host lookup is IP-focused; input is not an IP." }, { "source": "censys", "status": "skipped", "summary": "Censys host and search pivots support IP, domain, and URL inputs." } ], "summary": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1 was classified as hash. Investigation verdict is suspicious with score 63/100. Sources checked successfully: local-db, virustotal, otx, urlscan. Found 14 ATT&CK technique lead(s) and 0 actor lead(s).", "verdict": "suspicious", "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "actor_leads": [], "source_refs": [ "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ], "artifact_type": "hash", "review_status": "unreviewed-provider-context", "suspicion_score": 63, "actor_lead_count": 0, "graph_edge_count": 0, "graph_node_count": 1, "source_analysis_ref": "/api/ioc/investigations/449a4d13-67b3-4897-a60b-1da08fcdd5ac", "graph_preview_truncated": false, "graph_preview_edge_count": 0, "graph_preview_node_count": 1 }, { "id": "ioc:11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "type": "ioc", "value": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "source": "ioc-investigation", "verdict": "suspicious", "ioc_type": "hash", "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "description": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1 was classified as hash. Investigation verdict is suspicious with score 63/100. Sources checked successfully: local-db, virustotal, otx, urlscan. Found 14 ATT&CK technique lead(s) and 0 actor lead(s).", "source_refs": [ "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ], "suspicion_score": 63 }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1027", "type": "ttp-evidence", "label": "T1027 Obfuscated Files or Information", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1027", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1071", "type": "ttp-evidence", "label": "T1071 Application Layer Protocol", "source": "ioc-investigation", "tactic": "command-and-control", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1071", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1082", "type": "ttp-evidence", "label": "T1082 System Information Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1082", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1106", "type": "ttp-evidence", "label": "T1106 Native API", "source": "ioc-investigation", "tactic": "execution", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1106", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1129", "type": "ttp-evidence", "label": "T1129 Shared Modules", "source": "ioc-investigation", "tactic": "execution", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1129", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1218", "type": "ttp-evidence", "label": "T1218 System Binary Proxy Execution", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1218", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1218.010", "type": "ttp-evidence", "label": "T1218.010 Regsvr32", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1218.010", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1218.011", "type": "ttp-evidence", "label": "T1218.011 Rundll32", "source": "ioc-investigation", "tactic": "stealth", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1218.011", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1497", "type": "ttp-evidence", "label": "T1497 Virtualization/Sandbox Evasion", "source": "ioc-investigation", "tactic": "stealth, discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1497", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1518", "type": "ttp-evidence", "label": "T1518 Software Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1518", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1518.001", "type": "ttp-evidence", "label": "T1518.001 Security Software Discovery", "source": "ioc-investigation", "tactic": "discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1518.001", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1574", "type": "ttp-evidence", "label": "T1574 Hijack Execution Flow", "source": "ioc-investigation", "tactic": "stealth, execution", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1574", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1574.002", "type": "ttp-evidence", "label": "T1574.002 Technique lead", "source": "ioc-investigation", "tactic": "", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1574.002", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ttp-evidence:449a4d13-67b3-4897-a60b-1da08fcdd5ac:T1622", "type": "ttp-evidence", "label": "T1622 Debugger Evasion", "source": "ioc-investigation", "tactic": "stealth, discovery", "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "attack_id": "T1622", "references": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "source_refs": [ "virustotal (submitted indicator; provider-reported lead, not packet execution proof)", "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "ioc-investigation" ] }, { "id": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac:node:hash:11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "kind": "artifact", "tier": 0, "type": "hash", "value": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "sources": [ "input" ], "source_ref": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "suspicious": 63, "source_refs": [ "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac" ], "review_status": "unreviewed-provider-context" }, { "id": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-939ff7206bca32c29b78ddb3", "type": "pcap-observable", "value": "kamuchehddhgfgf.ddns.net", "ioc_type": "domain", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "artifact_refs": [], "source_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [ { "udp_stream": 181, "frame_number": 5642, "display_filter": "frame.number == 5642", "timestamp_epoch": "1634913296.194174000" }, { "udp_stream": 181, "frame_number": 5643, "display_filter": "frame.number == 5643", "timestamp_epoch": "1634913296.292206000" }, { "udp_stream": 233, "frame_number": 11082, "display_filter": "frame.number == 11082", "timestamp_epoch": "1634913636.934027000" }, { "udp_stream": 233, "frame_number": 11083, "display_filter": "frame.number == 11083", "timestamp_epoch": "1634913637.017648000" }, { "udp_stream": 235, "frame_number": 11095, "display_filter": "frame.number == 11095", "timestamp_epoch": "1634913641.388777000" }, { "udp_stream": 235, "frame_number": 11100, "display_filter": "frame.number == 11100", "timestamp_epoch": "1634913641.488218000" }, { "udp_stream": 236, "frame_number": 11154, "display_filter": "frame.number == 11154", "timestamp_epoch": "1634913658.887387000" }, { "udp_stream": 236, "frame_number": 11156, "display_filter": "frame.number == 11156", "timestamp_epoch": "1634913658.948540000" }, { "udp_stream": 239, "frame_number": 11239, "display_filter": "frame.number == 11239", "timestamp_epoch": "1634913663.245893000" }, { "udp_stream": 239, "frame_number": 11240, "display_filter": "frame.number == 11240", "timestamp_epoch": "1634913663.282614000" }, { "udp_stream": 242, "frame_number": 11341, "display_filter": "frame.number == 11341", "timestamp_epoch": "1634913667.590924000" }, { "udp_stream": 242, "frame_number": 11342, "display_filter": "frame.number == 11342", "timestamp_epoch": "1634913667.660268000" }, { "udp_stream": 248, "frame_number": 11519, "display_filter": "frame.number == 11519", "timestamp_epoch": "1634913684.950783000" }, { "udp_stream": 248, "frame_number": 11520, "display_filter": "frame.number == 11520", "timestamp_epoch": "1634913685.005902000" }, { "udp_stream": 251, "frame_number": 11535, "display_filter": "frame.number == 11535", "timestamp_epoch": "1634913689.358333000" }, { "udp_stream": 251, "frame_number": 11536, "display_filter": "frame.number == 11536", "timestamp_epoch": "1634913689.413549000" }, { "udp_stream": 252, "frame_number": 11543, "display_filter": "frame.number == 11543", "timestamp_epoch": "1634913693.749383000" }, { "udp_stream": 252, "frame_number": 11544, "display_filter": "frame.number == 11544", "timestamp_epoch": "1634913693.798224000" }, { "udp_stream": 257, "frame_number": 11600, "display_filter": "frame.number == 11600", "timestamp_epoch": "1634913714.249814000" }, { "udp_stream": 257, "frame_number": 11601, "display_filter": "frame.number == 11601", "timestamp_epoch": "1634913714.329369000" } ], "semantic_sha256": "e2a781b6839946af3b4581e8fbaa850bc68bbe393fce12f786178323e0ccd04d", "provenance_basis": "observable-frame-evidence", "source_analysis_ref": "/api/pcap/analyses/8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_frame_count": 20, "evidence_frames_truncated": false }, { "id": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-b232062d957abb261f43207d", "type": "pcap-observable", "value": "37.0.10.22", "ioc_type": "ipv4", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "artifact_refs": [], "source_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [ { "udp_stream": 181, "frame_number": 5643, "display_filter": "frame.number == 5643", "timestamp_epoch": "1634913296.292206000" }, { "udp_stream": 233, "frame_number": 11083, "display_filter": "frame.number == 11083", "timestamp_epoch": "1634913637.017648000" }, { "udp_stream": 235, "frame_number": 11100, "display_filter": "frame.number == 11100", "timestamp_epoch": "1634913641.488218000" }, { "udp_stream": 236, "frame_number": 11156, "display_filter": "frame.number == 11156", "timestamp_epoch": "1634913658.948540000" }, { "udp_stream": 239, "frame_number": 11240, "display_filter": "frame.number == 11240", "timestamp_epoch": "1634913663.282614000" }, { "udp_stream": 242, "frame_number": 11342, "display_filter": "frame.number == 11342", "timestamp_epoch": "1634913667.660268000" }, { "udp_stream": 248, "frame_number": 11520, "display_filter": "frame.number == 11520", "timestamp_epoch": "1634913685.005902000" }, { "udp_stream": 251, "frame_number": 11536, "display_filter": "frame.number == 11536", "timestamp_epoch": "1634913689.413549000" }, { "udp_stream": 252, "frame_number": 11544, "display_filter": "frame.number == 11544", "timestamp_epoch": "1634913693.798224000" }, { "udp_stream": 257, "frame_number": 11601, "display_filter": "frame.number == 11601", "timestamp_epoch": "1634913714.329369000" }, { "udp_stream": 258, "frame_number": 11612, "display_filter": "frame.number == 11612", "timestamp_epoch": "1634913718.748556000" }, { "udp_stream": 261, "frame_number": 11734, "display_filter": "frame.number == 11734", "timestamp_epoch": "1634913724.136789000" }, { "udp_stream": 266, "frame_number": 12444, "display_filter": "frame.number == 12444", "timestamp_epoch": "1634913741.546153000" }, { "udp_stream": 267, "frame_number": 12724, "display_filter": "frame.number == 12724", "timestamp_epoch": "1634913745.965159000" }, { "udp_stream": 270, "frame_number": 13034, "display_filter": "frame.number == 13034", "timestamp_epoch": "1634913750.511809000" }, { "udp_stream": 275, "frame_number": 14007, "display_filter": "frame.number == 14007", "timestamp_epoch": "1634913767.972288000" }, { "udp_stream": 276, "frame_number": 14293, "display_filter": "frame.number == 14293", "timestamp_epoch": "1634913772.439196000" }, { "udp_stream": 277, "frame_number": 14421, "display_filter": "frame.number == 14421", "timestamp_epoch": "1634913776.842208000" }, { "udp_stream": 280, "frame_number": 15278, "display_filter": "frame.number == 15278", "timestamp_epoch": "1634913794.192362000" }, { "udp_stream": 281, "frame_number": 15373, "display_filter": "frame.number == 15373", "timestamp_epoch": "1634913798.580555000" } ], "semantic_sha256": "e2a781b6839946af3b4581e8fbaa850bc68bbe393fce12f786178323e0ccd04d", "provenance_basis": "observable-frame-evidence", "source_analysis_ref": "/api/pcap/analyses/8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_frame_count": 20, "evidence_frames_truncated": false }, { "id": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-7fd2de74ede24bd63e9575df", "type": "pcap-observable", "value": "sobolpand.top", "ioc_type": "domain", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "artifact_refs": [], "source_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [ { "udp_stream": 215, "frame_number": 6746, "display_filter": "frame.number == 6746", "timestamp_epoch": "1634913395.513700000" }, { "udp_stream": 215, "frame_number": 6747, "display_filter": "frame.number == 6747", "timestamp_epoch": "1634913395.641241000" }, { "tcp_stream": 248, "frame_number": 6751, "display_filter": "frame.number == 6751", "timestamp_epoch": "1634913395.707500000" }, { "tcp_stream": 248, "frame_number": 6756, "display_filter": "frame.number == 6756", "timestamp_epoch": "1634913397.426689000" } ], "semantic_sha256": "e2a781b6839946af3b4581e8fbaa850bc68bbe393fce12f786178323e0ccd04d", "provenance_basis": "observable-frame-evidence", "source_analysis_ref": "/api/pcap/analyses/8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_frame_count": 4, "evidence_frames_truncated": false }, { "id": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-bd8f6578cb555eb66de5e770", "type": "pcap-observable", "value": "23.111.114.52", "ioc_type": "ipv4", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "artifact_refs": [], "source_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [ { "frame_number": 42858, "display_filter": "frame.number == 42858" } ], "semantic_sha256": "e2a781b6839946af3b4581e8fbaa850bc68bbe393fce12f786178323e0ccd04d", "provenance_basis": "first-frame-of-exact-address-flow", "source_analysis_ref": "/api/pcap/analyses/8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_frame_count": 1, "evidence_frames_truncated": false }, { "id": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-6f7144f3d89672a5ffd6eeb3", "type": "pcap-observable", "value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "ioc_type": "sha256", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "artifact_refs": [ { "sha256": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "filename": "44491.6090605324(1).dat", "size_bytes": 911360, "artifact_id": "artifact-f271fe123d45e866bd896fd9", "extraction_method": "tshark-http-export-objects" } ], "source_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [], "semantic_sha256": "e2a781b6839946af3b4581e8fbaa850bc68bbe393fce12f786178323e0ccd04d", "provenance_basis": "capture-exported-object; exact frame mapping unavailable", "source_analysis_ref": "/api/pcap/analyses/8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_frame_count": 0, "evidence_frames_truncated": false }, { "id": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-8326a269670ee3c6f38d48b0", "type": "pcap-observable", "value": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "ioc_type": "sha256", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "artifact_refs": [ { "sha256": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "filename": "main.php", "size_bytes": 337420, "artifact_id": "artifact-b62edb1cab1c1f4cc4be2532", "extraction_method": "tshark-http-export-objects" } ], "source_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455", "interpretation": "observed in capture; not automatically malicious", "evidence_frames": [], "semantic_sha256": "e2a781b6839946af3b4581e8fbaa850bc68bbe393fce12f786178323e0ccd04d", "provenance_basis": "capture-exported-object; exact frame mapping unavailable", "source_analysis_ref": "/api/pcap/analyses/8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_frame_count": 0, "evidence_frames_truncated": false } ], "evidence_edges": [ { "id": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157:edge:domain:kamuchehddhgfgf.ddns.net->domain:kamuchehddhgfgf.ddns.net:censys", "tier": 1, "type": "domain", "source": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157:node:domain:kamuchehddhgfgf.ddns.net", "target": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157:node:domain:kamuchehddhgfgf.ddns.net", "evidence": "Censys web property hostname", "source_ref": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157", "source_refs": [ "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157", "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157:node:domain:kamuchehddhgfgf.ddns.net" ], "source_value": "kamuchehddhgfgf.ddns.net", "target_value": "kamuchehddhgfgf.ddns.net", "evidence_source": "censys" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:edge:ip:23.111.114.52->collection:cymulateipdom:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:collection:cymulateipdom", "evidence": "OTX pulse", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52" ], "source_value": "23.111.114.52", "target_value": "CymulateIPDOM", "evidence_source": "otx" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:edge:ip:23.111.114.52->collection:apt29:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:collection:apt29", "evidence": "OTX pulse", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52" ], "source_value": "23.111.114.52", "target_value": "APT29", "evidence_source": "otx" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:edge:ip:23.111.114.52->collection:test created 1 year ago by testivk1 clone:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:collection:test created 1 year ago by testivk1 clone", "evidence": "OTX pulse", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52" ], "source_value": "23.111.114.52", "target_value": "test CREATED 1 YEAR AGO by testivk1 clone", "evidence_source": "otx" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:edge:ip:23.111.114.52->domain:23.111.114.52:urlscan", "tier": 1, "type": "domain", "source": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:domain:23.111.114.52", "evidence": "urlscan page domain", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52" ], "source_value": "23.111.114.52", "target_value": "23.111.114.52", "evidence_source": "urlscan" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:edge:ip:23.111.114.52->ip:23.111.114.52:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52" ], "source_value": "23.111.114.52", "target_value": "23.111.114.52", "evidence_source": "urlscan" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:edge:ip:23.111.114.52->url:http://23.111.114.52/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:url:http://23.111.114.52/", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52" ], "source_value": "23.111.114.52", "target_value": "http://23.111.114.52/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:edge:ip:23.111.114.52->url:http://23.111.114.52/:urlscan:evidence:6", "tier": 1, "type": "url", "source": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:url:http://23.111.114.52/", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52" ], "source_value": "23.111.114.52", "target_value": "http://23.111.114.52/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:edge:ip:23.111.114.52->url:http://23.111.114.52:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:url:http://23.111.114.52", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52" ], "source_value": "23.111.114.52", "target_value": "http://23.111.114.52", "evidence_source": "urlscan" }, { "id": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:edge:ip:23.111.114.52->domain:servers.ru:abuseipdb", "tier": 1, "type": "domain", "source": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:domain:servers.ru", "evidence": "AbuseIPDB domain", "source_ref": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "source_refs": [ "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04:node:ip:23.111.114.52" ], "source_value": "23.111.114.52", "target_value": "servers.ru", "evidence_source": "abuseipdb" }, { "id": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:edge:ip:37.0.10.22->collection:C2 Servers & Virus Providers & Malware Hashes:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:node:ip:37.0.10.22", "target": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:node:collection:C2 Servers & Virus Providers & Malware Hashes", "evidence": "OTX pulse", "source_ref": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "source_refs": [ "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:node:ip:37.0.10.22" ], "source_value": "37.0.10.22", "target_value": "C2 Servers & Virus Providers & Malware Hashes", "evidence_source": "otx" }, { "id": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:edge:ip:37.0.10.22->domain:singtel.com:abuseipdb", "tier": 1, "type": "domain", "source": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:node:ip:37.0.10.22", "target": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:node:domain:singtel.com", "evidence": "AbuseIPDB domain", "source_ref": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "source_refs": [ "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e:node:ip:37.0.10.22" ], "source_value": "37.0.10.22", "target_value": "singtel.com", "evidence_source": "abuseipdb" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->domain:dns1.hichina.com:virustotal", "tier": 1, "type": "domain", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:dns1.hichina.com", "evidence": "DNS record", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "dns1.hichina.com", "evidence_source": "virustotal" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->ip:47.76.127.217:virustotal", "tier": 1, "type": "ip", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:47.76.127.217", "evidence": "DNS record", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "47.76.127.217", "evidence_source": "virustotal" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->domain:expired.hichina.com:virustotal", "tier": 1, "type": "domain", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:expired.hichina.com", "evidence": "DNS record", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "expired.hichina.com", "evidence_source": "virustotal" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->ip:47.91.170.222:virustotal", "tier": 1, "type": "ip", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:47.91.170.222", "evidence": "DNS record", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "47.91.170.222", "evidence_source": "virustotal" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->domain:dns2.hichina.com:virustotal", "tier": 1, "type": "domain", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:dns2.hichina.com", "evidence": "DNS record", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "dns2.hichina.com", "evidence_source": "virustotal" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->ip:8.218.208.240:virustotal", "tier": 1, "type": "ip", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:8.218.208.240", "evidence": "DNS record", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "8.218.208.240", "evidence_source": "virustotal" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->collection:\"Stolen Images Evidence\" campaign pushes Sliver-based malware:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:collection:\"Stolen Images Evidence\" campaign pushes Sliver-based malware", "evidence": "OTX pulse", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "\"Stolen Images Evidence\" campaign pushes Sliver-based malware", "evidence_source": "otx" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->domain:sobolpand.top:urlscan", "tier": 1, "type": "domain", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "evidence": "urlscan page domain", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "sobolpand.top", "evidence_source": "urlscan" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->ip:45.114.105.162:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:45.114.105.162", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "45.114.105.162", "evidence_source": "urlscan" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->url:https://sobolpand.top/034g100/index.php:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:url:https://sobolpand.top/034g100/index.php", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "https://sobolpand.top/034g100/index.php", "evidence_source": "urlscan" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->url:http://sobolpand.top/034g100/index.php:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:url:http://sobolpand.top/034g100/index.php", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "http://sobolpand.top/034g100/index.php", "evidence_source": "urlscan" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->ip:114.55.89.54:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:114.55.89.54", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "114.55.89.54", "evidence_source": "urlscan" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->url:http://sobolpand.top/034g100/index.php:urlscan:evidence:12", "tier": 1, "type": "url", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:url:http://sobolpand.top/034g100/index.php", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "http://sobolpand.top/034g100/index.php", "evidence_source": "urlscan" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->ip:172.67.139.101:urlscan", "tier": 1, "type": "ip", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:ip:172.67.139.101", "evidence": "urlscan page IP", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "172.67.139.101", "evidence_source": "urlscan" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->url:http://sobolpand.top/:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:url:http://sobolpand.top/", "evidence": "urlscan page URL", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "http://sobolpand.top/", "evidence_source": "urlscan" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->url:http://sobolpand.top:urlscan", "tier": 1, "type": "url", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:url:http://sobolpand.top", "evidence": "urlscan submitted URL", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "http://sobolpand.top", "evidence_source": "urlscan" }, { "id": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:edge:domain:sobolpand.top->domain:sobolpand.top:censys", "tier": 1, "type": "domain", "source": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top", "evidence": "Censys web property hostname", "source_ref": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "source_refs": [ "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac:node:domain:sobolpand.top" ], "source_value": "sobolpand.top", "target_value": "sobolpand.top", "evidence_source": "censys" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:edge:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d->hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d:malwarebazaar", "tier": 1, "type": "hash", "source": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "evidence": "malwarebazaar field sha256_hash", "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d" ], "source_value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target_value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:edge:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d->hash:e425a2d4cd89cb995a5fbf5e9b6671be8c51774f:malwarebazaar", "tier": 1, "type": "hash", "source": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:e425a2d4cd89cb995a5fbf5e9b6671be8c51774f", "evidence": "malwarebazaar field sha1_hash", "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d" ], "source_value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target_value": "e425a2d4cd89cb995a5fbf5e9b6671be8c51774f", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:edge:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d->hash:fdc89b23e17d46173806407132b2903c:malwarebazaar", "tier": 1, "type": "hash", "source": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:fdc89b23e17d46173806407132b2903c", "evidence": "malwarebazaar field md5_hash", "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d" ], "source_value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target_value": "fdc89b23e17d46173806407132b2903c", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:edge:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d->file:44491.6090605324.dat:malwarebazaar", "tier": 1, "type": "file", "source": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:file:44491.6090605324.dat", "evidence": "malwarebazaar field file_name", "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d" ], "source_value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target_value": "44491.6090605324.dat", "evidence_source": "malwarebazaar" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:edge:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d->collection:Malware Bazar 2:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:collection:Malware Bazar 2", "evidence": "OTX pulse", "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d" ], "source_value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target_value": "Malware Bazar 2", "evidence_source": "otx" }, { "id": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:edge:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d->collection:Malware Hashes:otx", "tier": 1, "type": "collection", "source": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:collection:Malware Hashes", "evidence": "OTX pulse", "source_ref": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "source_refs": [ "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4:node:hash:95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d" ], "source_value": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "target_value": "Malware Hashes", "evidence_source": "otx" }, { "id": "packet-enrichment:pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-939ff7206bca32c29b78ddb3:58057369-e44a-47d1-97a6-8f537e481157", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-939ff7206bca32c29b78ddb3", "target": "ioc-investigation:58057369-e44a-47d1-97a6-8f537e481157", "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_source": "native-packet-observable-and-saved-provider-result" }, { "id": "packet-enrichment:pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-b232062d957abb261f43207d:20f513e1-0d5c-4c07-a135-12408729e84e", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-b232062d957abb261f43207d", "target": "ioc-investigation:20f513e1-0d5c-4c07-a135-12408729e84e", "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_source": "native-packet-observable-and-saved-provider-result" }, { "id": "packet-enrichment:pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-7fd2de74ede24bd63e9575df:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-7fd2de74ede24bd63e9575df", "target": "ioc-investigation:06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_source": "native-packet-observable-and-saved-provider-result" }, { "id": "packet-enrichment:pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-bd8f6578cb555eb66de5e770:593d219e-2578-45ab-8d90-697899320a04", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-bd8f6578cb555eb66de5e770", "target": "ioc-investigation:593d219e-2578-45ab-8d90-697899320a04", "evidence": "Exact normalized type/value equality; first-frame-of-exact-address-flow. No execution or attribution inferred.", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_source": "native-packet-observable-and-saved-provider-result" }, { "id": "packet-enrichment:pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-6f7144f3d89672a5ffd6eeb3:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-6f7144f3d89672a5ffd6eeb3", "target": "ioc-investigation:ed278503-bcef-4a9e-985d-fdb452eaa0f4", "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_source": "native-packet-observable-and-saved-provider-result" }, { "id": "packet-enrichment:pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-8326a269670ee3c6f38d48b0:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "type": "passive-enrichment-of-exact-observable", "source": "pcap-observable:8f0da1cd-9998-4d41-9fc7-683302a6ee24:observable-8326a269670ee3c6f38d48b0", "target": "ioc-investigation:449a4d13-67b3-4897-a60b-1da08fcdd5ac", "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.", "source_ref": "pcap-analysis:8f0da1cd-9998-4d41-9fc7-683302a6ee24", "evidence_source": "native-packet-observable-and-saved-provider-result" } ], "timeline": [ { "at": "2026-09-19T12:49:58.136Z", "event": "Added Log/PCAP analysis 2021-10-22-ISC-forensic-challenge-traffic.pcap", "source": "Log/PCAP analysis 2021-10-22-ISC-forensic-challenge-traffic.pcap", "actor_count": 0, "report_count": 0, "technique_count": 0 }, { "at": "2026-09-19T12:57:49.259Z", "event": "Added Log/PCAP analysis 2021-10-22-ISC-forensic-challenge-traffic.pcap", "source": "Log/PCAP analysis 2021-10-22-ISC-forensic-challenge-traffic.pcap", "actor_count": 0, "report_count": 0, "technique_count": 0 }, { "at": "2026-09-19T13:57:23.243Z", "event": "Added IOC investigation for kamuchehddhgfgf.ddns.net", "source": "IOC investigation kamuchehddhgfgf.ddns.net", "actor_count": 0, "report_count": 1, "technique_count": 0 }, { "at": "2026-09-19T13:57:25.928Z", "event": "Added IOC investigation for 37.0.10.22", "source": "IOC investigation 37.0.10.22", "actor_count": 0, "report_count": 1, "technique_count": 0 }, { "at": "2026-09-19T13:57:28.392Z", "event": "Added IOC investigation for sobolpand.top", "source": "IOC investigation sobolpand.top", "actor_count": 0, "report_count": 1, "technique_count": 0 }, { "at": "2026-09-19T13:57:30.556Z", "event": "Added IOC investigation for 23.111.114.52", "source": "IOC investigation 23.111.114.52", "actor_count": 0, "report_count": 1, "technique_count": 0 }, { "at": "2026-09-19T13:57:32.968Z", "event": "Added IOC investigation for 95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "source": "IOC investigation 95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "actor_count": 0, "report_count": 1, "technique_count": 3 }, { "at": "2026-09-19T13:57:36.135Z", "event": "Added IOC investigation for 11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "source": "IOC investigation 11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "actor_count": 0, "report_count": 1, "technique_count": 14 }, { "at": "2026-09-19T14:02:46.171420+00:00", "event": "Superseded test-generated enrichment handoffs before corrected retry; original provider sessions and before-images retained." }, { "at": "2026-09-19T14:04:38.093Z", "event": "Added IOC investigation for 37.0.10.22", "source": "IOC investigation 37.0.10.22", "actor_count": 0, "report_count": 1, "technique_count": 0 }, { "at": "2026-09-19T14:04:59.770Z", "event": "Added IOC investigation for sobolpand.top", "source": "IOC investigation sobolpand.top", "actor_count": 0, "report_count": 1, "technique_count": 3 }, { "at": "2026-09-19T14:05:21.172Z", "event": "Added IOC investigation for 95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "source": "IOC investigation 95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "actor_count": 0, "report_count": 1, "technique_count": 3 }, { "at": "2026-09-19T14:05:42.569Z", "event": "Added IOC investigation for 11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "source": "IOC investigation 11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "actor_count": 0, "report_count": 1, "technique_count": 14 }, { "at": "2026-09-19T14:29:09.422495+00:00", "event": "Linked approved passive lookups to exact typed, capture-backed PCAP observables. Frames retained where available; object hashes retain capture-export provenance. All context remains unreviewed." } ], "created_at": "2026-09-19T12:49:53.571691+00:00", "updated_at": "2026-09-19T14:29:09.445688+00:00" }