{"id":8788,"date":"2022-01-19T05:56:00","date_gmt":"2022-01-19T03:56:00","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8788"},"modified":"2022-02-19T05:58:40","modified_gmt":"2022-02-19T03:58:40","slug":"pcap-analysis","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/application-and-software-security\/pcap-analysis\/","title":{"rendered":"PCAP Analysis"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"learning-objectives\">Learning Objectives<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Understand the advantages and goals of PCAP Analysis<\/li><li>How to pivot into and away from PCAP Analysis (how to use findings for quicker analysis)<\/li><li>Common tools to use<\/li><li>How data reduction aids in investigations<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"common-tools\">Common Tools<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Snort<\/li><li>Tcpdump<\/li><li>WireShark<\/li><li>TShark<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"tools-covered-here\">Tools Covered Here<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Snort<\/li><li>Tcpdump<\/li><li>Wireshark<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"notes\">Notes<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Keep solid notes on your thinking around evidence and data that you find<ul><li>This is for team mates to understand your thinking<\/li><li>Understand your own thinking later\u2026 or after sleep.<\/li><\/ul><\/li><li>Notes should be accompanied by screenshots that tell a story<ul><li>Examples: Highlights, Boxes, Arrows Text. The reader should quickly understand what they\u2019re looking at<\/li><\/ul><\/li><li>A great note keeping App that teams can use to coordinate is OneNote.<ul><li>Each host gets a tab etc.<\/li><\/ul><\/li><li>A great piece of software to take Screen Shots is <a href=\"https:\/\/getgreenshot.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">Greenshot<\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"applicable-pivots\">Applicable Pivots<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>From Disk Analysis: Malicious IP Addresses, Malicious Filenames<\/li><li>To Disk Analysis: Malicious IP Addresses, Malicious Filenames<\/li><li><a href=\"https:\/\/dfirmadness.com\/case-001-memory-analysis\/\">From Memory Analysis<\/a>: Malicious IP Addresses, Malicious Filenames<\/li><li><a href=\"https:\/\/dfirmadness.com\/case-001-memory-analysis\/\">To Memory Analysis<\/a>: Malicious IP Addresses, Malicious Filenames<\/li><li>From Log Analysis: Malicious IP Addresses, Malicious Filenames<\/li><li>To Log Analysis: Malicious IP Addresses, Malicious Filenames<\/li><li>And so on\u2026<\/li><\/ul>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"pcap-analysis-with-sift-remnux\">PCAP Analysis with <a href=\"https:\/\/dfirmadness.com\/building-a-dfir-analysis-fort\/\" target=\"_blank\" rel=\"noreferrer noopener\">SIFT REMNUX<\/a><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"overview\">Overview<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Packet Capture (PCAP) files are tremendous resources for investigations <em>when<\/em> they are available.These small slices of PCAP typically do not tell the complete story. The PCAP provided for this analysis is from the \u2018edge sensor\u2019 located on the victim network. It is small for portability, but large enough that only an insane person would begin digging through it starting at frame 1. An analyst must learn to <em>pivot<\/em> through the data effectively. Using data reduction, indicators of interest, or Indicators of Compromise (IOC) analysts can pivot through large data sets quickly and effectively. Snort is a great example of a tool an analyst can use to pivot through network traffic effeciently. Keep in mind this is merely an intro, and is being used to quickly triage the PCAP data.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"installing-snort\">Installing Snort<\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"712\" height=\"127\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/apt-update-6799647.png\" alt=\"\" class=\"wp-image-8790\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/apt-update-6799647.png 712w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/apt-update-6799647-300x54.png 300w\" sizes=\"auto, (max-width: 712px) 100vw, 712px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Add Snort to your analysis VM with: <code>sudo apt update &amp;&amp; sudo apt install snort<\/code>. Alternatively, you can run those two commands separately as shown.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"714\" height=\"150\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/apt-install-snort-3319187.png\" alt=\"\" class=\"wp-image-8791\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/apt-install-snort-3319187.png 714w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/apt-install-snort-3319187-300x63.png 300w\" sizes=\"auto, (max-width: 714px) 100vw, 714px\" \/><\/figure><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"setting-home-net\">Setting HOME_NET<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Snort works off of signatures, or \u2018rules\u2019, to detect anomalies in network traffic. Many of these rules are written with the idea that the Snort Intrusion Detection System (IDS) will as a permanent sensor in an environment. Snort runs more effectively when it has knowledge of the environment it is monitoring. The <code>HOME_NET<\/code> variable tells Snort what network it is defending. This variable is set in \/etc\/snort\/snort.conf by default. The rules written for snort recognize this variable and alert accordingly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using our analyst station to do triage and incident response as a stand alone system requires that we inform snort of the network that was defended when the PCAP was collected. From the client interview we know the network is <code>10.42.something.something<\/code> . We run a quick tcpdump command to sample the PCAP for hosts fitting this general description <code>tcpdump -nr case001.pcap 'host 10.42' -c15<\/code>. This reads the case pcap, disables DNS resolution, and pulls the first 15 packets that have a host with an address that starts with 10.42.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"871\" height=\"386\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-discover-7269655.png\" alt=\"\" class=\"wp-image-8792\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-discover-7269655.png 871w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-discover-7269655-300x133.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-discover-7269655-768x340.png 768w\" sizes=\"auto, (max-width: 871px) 100vw, 871px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Looking at the last 2 Octets of each host in the 10.x network we can make a fairly decent guess here that the Home Network is 10.42.85.0\/24. This is close enough for our purpose. Edit the <code>\/etc\/snort\/snort.conf<\/code> file where <code>ipvar HOME_NET any<\/code> is and change it to <code>ipvar HOME_NET 10.42.85.0\/24<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We disable DNS resolution for speed and to reduce noise the adversary may pick up on. Bad guys are smart enough to stand up DNS servers that the authority for their evil domains. You potentially tip your hand if you send traffic to their monitored DNS server; try and use <code>-n<\/code> as often as possible when using tcpdump for investigations.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"finding-the-snort-config\">Finding the Snort Config<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">As a side bit of training \u2013 to locate a file in Linux you can simply use the <code>locate<\/code> command. Update, and then ask. Notice the lack of results before <code>updatedb<\/code> was used.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"925\" height=\"187\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/locate-snort-conf-1998476.png\" alt=\"\" class=\"wp-image-8793\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/locate-snort-conf-1998476.png 925w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/locate-snort-conf-1998476-300x61.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/locate-snort-conf-1998476-768x155.png 768w\" sizes=\"auto, (max-width: 925px) 100vw, 925px\" \/><\/figure><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"testing-snort\">Testing Snort<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Test snort to ensure your changes didn\u2019t break anything and you are ready to go with <code>snort -c \/etc\/snort\/snort.conf -T -i lo<\/code>. This tells Snort to use the default config file at <code>\/etc\/snort\/snort.conf<\/code>, run a Test against that configuration and use the loopback interface.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"974\" height=\"601\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-Test-3015571.png\" alt=\"\" class=\"wp-image-8794\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-Test-3015571.png 974w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-Test-3015571-300x185.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-Test-3015571-768x474.png 768w\" sizes=\"auto, (max-width: 974px) 100vw, 974px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">And hope for a result like this\u2026<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"978\" height=\"769\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-test-ok-1269827.png\" alt=\"\" class=\"wp-image-8795\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-test-ok-1269827.png 978w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-test-ok-1269827-300x236.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-test-ok-1269827-768x604.png 768w\" sizes=\"auto, (max-width: 978px) 100vw, 978px\" \/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"general-approach\">General Approach<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The name of the game in most forensics is data reduction; this holds especially true in analyzing network traffic. Reducing the noise is key. If you have analyzed other artifacts prior to this and obtained a known Malicious IP address you could start your search that way. If you haven\u2019t done analysis on other artifacts you must find interesting data using tools in your arsenal. Both approaches will be shown.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"assessing-the-pcap\">Assessing the PCAP<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To quickly understand the scope of the PCAP use the command <code>capinfos<\/code> against it.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"890\" height=\"662\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/capinfos-9110714.png\" alt=\"\" class=\"wp-image-8796\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/capinfos-9110714.png 890w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/capinfos-9110714-300x223.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/capinfos-9110714-768x571.png 768w\" sizes=\"auto, (max-width: 890px) 100vw, 890px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Important items to note:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Packet capture date time range. Was this during the incident time frame?<\/li><li>Number of packets. How much am I dealing with here?<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">An interesting note: this was not captured by a Kali box, despite what it says in the <code>Capture oper-sys<\/code> field. This was captured by a virtual router at the edge of the victim network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Knowing that there are nearly <em>half a million<\/em> packets in this we must find a way to assess the data in quick meaningful ways.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"alerts\">Alerts<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">One way to pivot into the data quickly is to see if any low hanging fruit can be found with Snort. We are about ask snort to read the pcap and write alerts to the screen. The alerts will be \u2018flags\u2019 about anomalies in the traffic, or outright threats. Like any other \u2018alert\u2019 in this business they are not always full proof. It is up to the analyst to be\u2026 well\u2026 an analyst and <em>ANALYZE <\/em>the data. This is what separates the true analyst from the alert monkey. An alert monkey see\u2019s the alert, pushes a button, and gets a banana. Alert monkey\u2019s don\u2019t get the top spot in the SOC. Be the analyst. Look into the data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To begin the analysis ensure the pcap is living a directory in the appropriate case directory. As an example, for this case a directory titled <code>\/cases\/szechuan\/pcap<\/code>. In SIFT analysts do most of their work in the <code>\/cases<\/code> directory. A good practice is to ensure data is kept in an organized fashion. As always it is a good idea to use the <code>tee<\/code> command to create outputs every time a tool is run. Some tools take a long time to run. Simply reviewing the output can be much faster than running the tool a second time (looking at you memory analysis).<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"303\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts3-3221609-1024x303.png\" alt=\"\" class=\"wp-image-8797\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts3-3221609-1024x303.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts3-3221609-300x89.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts3-3221609-768x227.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts3-3221609.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Before analyzing the results let\u2019s talk about noise reduction. If you recall the PCAP has over 400k packets. If you count the number of lines in the output file you will find only a few hundred alerts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wc -l snort.out<\/code><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"57\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wc-snort-out-9106309.png\" alt=\"\" class=\"wp-image-8798\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wc-snort-out-9106309.png 618w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wc-snort-out-9106309-300x28.png 300w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">256 alerts is much easier to look at versus 411 thousand lines. <strong>Note<\/strong>: over time the exact number of alerts may change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Take a look through the alerts. Look for things that stand out like references to hacking tools and malware. Alerts in this situation can be noisy due to a lack of tuning. There is also activity that won\u2019t be flagged here that normally would be flagged by other tools. For example, Security Onion applies the Snort rule set: <code>downloaded.rules<\/code>. It flags an event that makes quick work of this PCAP. Security Onion will be covered near the end of this post. Yes, the <code>downloaded.rules<\/code> rule set could be added here but for now this will work great (adding rules here can be a real bear \u2013 let\u2019s roll on). Look through the output either through scrolling, or using <code>less snort.out<\/code> (or whatever you named the output with <code>tee<\/code>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Can you find evidence of hacking tools being used in the traffic?<\/p>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Spoilers ahead.<\/p>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">In the alerts there was a great pivot point that should catch your eye. NMAP. This is an example of how understanding attack methodologies is a huge benefit to defenders. Network defenders should spend time attending Penetration Testing, and Red Teaming, courses to understand the tools of the adversary. A great hunter will understand what sort of animal left tracks in the mud. Likewise, defenders should understand when they are looking at evidence of a predator in their systems.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"311\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-1-6812887-1024x311.png\" alt=\"\" class=\"wp-image-8799\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-1-6812887-1024x311.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-1-6812887-300x91.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-1-6812887-768x234.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-1-6812887.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Take a look at the NMAP alert. Is this an internal system or an external system reaching into the network? You have Private IP Address ranges (RFC 1918) memorized don\u2019t you? Also, what is the host at <code>.10<\/code>? In a real case you would want to ask the victim company what system is at this address since they likely didn\u2019t provide a network map. The Administrator of the victim network would tell you this is the Domain Controller! You are looking at an outside system sending an NMAP probe to a key piece of the network. The Domain Controller is the heart of a Windows Enterprise. Both the attacker and the Defender want complete dominance of this system. NMAP, or Network Mapper, is a common tool for attackers to probe and and map out systems and open ports on target systems. This is a key moment in the \u2018kill chain\u2019. A good analyst looks at activity prior to and after a key event to try and understand the whole picture. What occurs just minutes later? By the way \u2018minutes later\u2019 in the PCAP is a tremendous amount of data versus only a few lines of text in the Alerts output. See how data reduction helps?<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"311\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-2-5752990-1024x311.png\" alt=\"\" class=\"wp-image-8800\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-2-5752990-1024x311.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-2-5752990-300x91.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-2-5752990-768x234.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/snort-alerts-review-2-5752990.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Moment later we observe rapid connections from an outside source to an inside source; in this case the Domain Controller. <strong>Side note<\/strong>: there is no good reason to have the DC exposing anything to the Internet. Ever. It should be in a private network. If Admins need access from the outside world the only ingress route should be a VPN tunnel. What sort of attack methodology would involve multiple connections per second to a service? A brute force! This remote system is likely attempting different username and password combinations! There is more to the story however. Take a closer look at the details. What are the source and destination ports?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not make the mistake of simply observing the destination port! Let\u2019s walk through this together.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Outside system connecting inbound to<\/li><li>An inside host; the Domain Controller\u2019s<\/li><li>Remote Desktop Protocol Port 3389<\/li><li>The host attempting the connection increments the source port by 2 every attempt.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Take a screenshot of this event and take notes. This source IP just became interesting as it is attempting to brute force its way into the server. This activity is very normal for any server that is exposing services to the Internet. In fact, it will begin experiencing attacks soon after it is connected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now we have an indicator of interest to look into! Now we can use this IP address as a <em>pivot<\/em> into the data.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"pivots\">Pivots<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Pivots are data points discovered elsewhere in the investigation that are used to speed up your analysis. For example, an IP Address found in something like Memory Analysis from the same case can be used as a \u201csearch term\u201d in the PCAP. You will hear about pivots often here at DFIRmadness. That\u2019s because it is one of the most import skills for an analyst to wield through the course of an investigation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"who-is-going-where\">Who is Going Where?!<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We now have an indicator to work with. Let\u2019s table that for a moment and look at how we can explore a large PCAP quickly. A great tool to do this from the command line is <code>tcpdump<\/code>. There are some common switches you will seen thrown with the tcpdump you should be familiar:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>-r<\/code> simply reads the provided PCAP filename<br><code>-n<\/code> Disables DNS resolution<br><code>-t<\/code> Do not print the date time stamp<br><code>-tttt<\/code> Print the time as hours, minutes, seconds and fractions of a second since midnight.<br><code>-v<\/code> Verbose<br><code>-X<\/code> Provide the Hex output of the frame.<br><code>-c<\/code> Number of packets to display before exiting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You are encouraged to do <code>man tcpdump<\/code> and read through the capabilities of the tool.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A quick lesson on how to read the IP and port pairing: the IP and Port are displayed as <code>IP.PORT<\/code>. For example, <code>192.168.10.24.80<\/code> would be <code>192.168.10.24<\/code> port <code>80<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To get start let\u2019s read a sample of the activity in the PCAP related to <code>194.61.24.102<\/code>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"flags-to-keep-an-eye-on\">Flags to Keep an Eye On<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><code>[S]<\/code> SYN<br><code>[S.]<\/code> SYN\/ACK<br><code>[.]<\/code> ACK<br><code>[R]<\/code> RST (Reset)<br><code>[F]<\/code> FIN<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Remember TCP basics like the 3 way handshake? <code>[S]<\/code> , <code>[S.]<\/code> , <code>[.]<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A lot of hacking tools break the rules or look like anomalies. As an analyst you want to look for these. Keep in mind sometimes there are actual anomalies due to bad captures or bad connections; though these are the exception not the rule.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"a-quick-peek\">A Quick Peek<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Now that we have an Indicator that in interesting to us we can take a quick glance at any traffic involving our interesting host. Let\u2019s pull the first 20 packets:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>tcpdump -nr case001.pcap 'host 194.61.24.102' -c 20<\/code><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"263\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-4982145-1024x263.png\" alt=\"\" class=\"wp-image-8801\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-4982145-1024x263.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-4982145-300x77.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-4982145-768x197.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-4982145.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The first thing to glance at is the date of the first packet. Notice that the date time stamp is not as useful as it could be. Let\u2019s try that again with <code>tttt<\/code>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"374\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-tttt-1625051-1024x374.png\" alt=\"\" class=\"wp-image-8802\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-tttt-1625051-1024x374.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-tttt-1625051-300x110.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-tttt-1625051-768x280.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-tttt-1625051.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">A full date time group can be obtained with <code>tttt<\/code> and is often helpful in increasing situational awareness. In this example, we can now say with confidence when the first observed contact occurred with the interesting remote host of <code>194.61.24.102<\/code>. Is that time UTC or local? What do most forensics tools log their time in? We know this event took place in Mountain Time (recall the info from the client interview \u2013 or from data obtained in the forensics). It took place in September \u2013 which makes it 6 hours behind UTC. This means that if you want to correlate this to local time you need to subtract 6 hours from the time displayed by the tool. Keep in mind some tools can be off! Again, the analyst must be on their toes at all times.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Look at the data. What are the first few events between this host and the Domain Controller? Does this look normal? Let\u2019s walk through this.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here we see the ICMP Echo Request and its related reply. That\u2019s easy enough to understand. The remote host sent a ping and our Domain Controller replied. Note, and screenshot, this as information leakage the client should shore up during the Recovery stages of the Incident Response process. We should not allow our machines to respond to pings to outside machines. We know this request and reply pair together due to the matching <code>id<\/code> number. This is a great example of why learning protocols and their internal functions is key.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"374\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-ICMP-event-3480933-1024x374.png\" alt=\"\" class=\"wp-image-8803\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-ICMP-event-3480933-1024x374.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-ICMP-event-3480933-300x110.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-ICMP-event-3480933-768x280.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-ICMP-event-3480933.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s look a bit deeper. Have you seen anything odd yet? Look at the traffic that occurred at the same time as the ping. Does this look like a standard 3 way handshake for port 80 and 443?<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"374\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event1-8973622-1024x374.png\" alt=\"\" class=\"wp-image-8804\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event1-8973622-1024x374.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event1-8973622-300x110.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event1-8973622-768x280.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event1-8973622.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">No. This is <em><strong>not <\/strong><\/em>normal. It <em>could<\/em> be some error with the capture- but it\u2019s unlikely. We see the remote host try to SYN (initiate communication) with port 443, and then it immediately sends an ACK to port 80. It is even more odd that these two weird packets are seemingly related when we look the Seq and Ack numbers. They\u2019re seeming related but also very odd! Take a look at other 3 Way Hand Shakes in the data. What we expect to see is a Seq number displayed, followed by an Ack of Sequence + 1. The increment of 1 in the handshake is due to the 1 bit flag being exchanged. Many folks incorrectly assume that this increment is a design of TCP regardless of the bits exchanged. In other words, it is not simply incrementing because it is supposed to do that as some sort of pattern to show a relation. It is a typical pattern because of the 1 bit flag typically being exchanged. Apply this knowledge to the odd pair we see above.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now that we know it is odd, what do we do about it? We could simply flag this as odd and move on. However, we can also quickly spin up some VM\u2019s and take a deeper look. Before we do that, let\u2019s put together a hypothesis as to what is going on here. We see an ICMP probe from a system prior to that system initiating a suspected brute force. At the same time as this ICMP probe we see some very odd behavior in the packets from that system. Additionally, look back at the Snort alert. We saw a reference to NMAP. Let\u2019s test in our lab and see what we find. For an accurate test we must set up a lab where the two systems are in separate networks \u2013 in geekier terms: <em>we need the traffic to transit layer 3 just like it did in the real<\/em> world. In other words, 2 machines in the same subnet won\u2019t be an accurate test.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To test if this was in fact NMAP two virtual machines were spun up in separate virtual networks connected via a virtual router. We know that the attack centered on 3389, and that there was not a broad port scan prior. Let\u2019s see what the traffic looks like when we conduct a Service Scan against a single port of 3389.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"419\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-8859978-1024x419.png\" alt=\"\" class=\"wp-image-8805\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-8859978-1024x419.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-8859978-300x123.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-8859978-768x314.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-8859978.png 1161w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Well, lookie here! We have proven our theory! That is the exact same signature! Take a look at the odd activity again. It even includes the ICMP\u2019s!<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"161\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-compare-4282212-1024x161.png\" alt=\"\" class=\"wp-image-8806\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-compare-4282212-1024x161.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-compare-4282212-300x47.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-compare-4282212-768x121.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test-compare-4282212.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">This next screenshot is simply a comparison of the port values when tcpdump is run without the <code>-n<\/code> flag.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"396\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test2-7531034-1024x396.png\" alt=\"\" class=\"wp-image-8807\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test2-7531034-1024x396.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test2-7531034-300x116.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test2-7531034-768x297.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-20-odd-event-nmap-test2-7531034.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Why would an attacker send a single probe to 3389? A better question is: <em>how did they know 3389 was open!?!?<\/em> Are you familiar with <a href=\"https:\/\/shodan.io\">shodan.io<\/a>? If not you really should be regardless if you are an attacker or a defender. The take away is that if you hook something up to the Internet it will be found and indexed. Attackers can go \u201cshopping\u201d for open RDP servers (as an example) to attack.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We have now confirmed that <code>194.61.24.102<\/code> probed our RDP server with NMAP; and then likely initiated an RDP Brute Force attack (a very common breach technique (sadly)).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Can you figure out which tool was used to do the Brute Force? Hint: it was <strong>not<\/strong> NMAP.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"who-is-who-in-the-zoo\">Who is Who in The Zoo<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">When an IP Address is identified as \u201cInteresting\u201d it should be investigated further. A quick way to do this is to look it up on VirusTotal. Keep in mind that if there are no detections for the IP Address, domain, or hash it does <strong>NOT<\/strong> mean it is clean! It simply means it isn\u2019t identified as malicious\u2026 yet.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"660\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-1-4353706-1024x660.png\" alt=\"\" class=\"wp-image-8808\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-1-4353706-1024x660.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-1-4353706-300x194.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-1-4353706-768x495.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-1-4353706.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">This is great for initial situational awareness but there is more to the story. Select the \u201cDetails\u201d tab.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"866\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-2-2268032-1024x866.png\" alt=\"\" class=\"wp-image-8809\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-2-2268032-1024x866.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-2-2268032-300x254.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-2-2268032-768x650.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-2-2268032.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Note the country that this IP <em>might <\/em>reside in. Does this organization do business in that country? Do they have admins operating from there? Is it simply an Admin using a VPN? The point is country code alone isn\u2019t damning even if it\u2019s accurate. The modern Internet is very flat. It is not unusual to see legitimate traffic from all over the world \u2013 to inlcude \u201cthe usual suspects\u201d. That said, TOR Exit nodes are almost always interesting. This may not be current or accurate! Always try and validate with other tools. Give <a href=\"https:\/\/www.shodan.io\/\" target=\"_blank\" rel=\"noreferrer noopener\">shodan.io<\/a> a try for example. The details tab offers a lot of information. Take a look at what it has to offer and then scroll down to the \u201cGoogle Results\u201d area of the Details page.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"671\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-3-6638993-1024x671.png\" alt=\"\" class=\"wp-image-8811\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-3-6638993-1024x671.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-3-6638993-300x197.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-3-6638993-768x503.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-3-6638993.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Well. Isn\u2019t that interesting?! This IP Address has been seen conducting RDP Brute Force attacks elsewhere! This is a key piece of historical information. It helps confirm some of the key pieces of our hypothesis and findings. Attackers like to do the same dance move over and over again. Keep this is mind when doing investigations. Sometimes the smallest piece of information about an artifact can break a case wide open by pushing you in a new direction. These new directions can lead you to look in places you hadn\u2019t thought of yet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The \u201cRelations\u201d tab is also a \u201cmust see\u201d. It\u2019s good for your situational awareness to understand the domains related to the IP Address in question. Note the date!! IP Address and Domain relationships drift over time! What is true today may not have been during the incident (if you are late to the party) or even a few weeks ago. Look the rest of the page for things like prior instances of malware associated with that indicator.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"770\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-4-4090528-1024x770.png\" alt=\"\" class=\"wp-image-8810\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-4-4090528-1024x770.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-4-4090528-300x226.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-4-4090528-768x577.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VirusTotal-4-4090528.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Another great resource are open source threat intel feeds. Understand these are partly crowd sourced and your mileage may vary on the accuracy of their claims. Go ahead and see what you can find at <a href=\"https:\/\/www.threatminer.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Miner<\/a> and <a href=\"https:\/\/www.threatcrowd.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Crowd<\/a>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"who-went-where\">Who Went Where<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Another approach to investigating PCAPs is to look at what internal systems were reaching out to remote systems. This works exceptionally well if you already have some hosts, or protocols, identified as interesting. We can locate hosts initiating connections by searching for SYN flags. We can search for hosts reaching out to external hosts by narrowing this search to destinations not inside our network. These searches are done using tcpdump and Berkley Packet Filters.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Berkley Packet Filters seem challenging at first but are in reality pretty easy to work with. BPF is used to select packets with particular flags. A great starting point on learning the tcpdump flag combinations is either <a href=\"https:\/\/www.sans.org\/cyber-security-courses\/intrusion-detection-in-depth\/\" target=\"_blank\" rel=\"noreferrer noopener\">SANS SEC503<\/a> or the manual for tcpdump.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>man tcpdump<\/code><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"650\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample-4392420-1024x650.png\" alt=\"\" class=\"wp-image-8812\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample-4392420-1024x650.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample-4392420-300x190.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample-4392420-768x488.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample-4392420.png 1183w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"763\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample2-7592376-1-1024x763.png\" alt=\"\" class=\"wp-image-8815\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample2-7592376-1-1024x763.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample2-7592376-1-300x224.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample2-7592376-1-768x573.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-man-sample2-7592376-1.png 1183w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The man page for this tool is a small book on the matter and well worth the read if you plan on really getting into network analysis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Macros are built in combinations of BPF that can be called with keywords. There are some key macro\u2019s in tcpdump that can be used to select packets with things like particular networks or hosts. When testing BPF and macro combinations limit the results as initial test to ensure you are on the right track.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"208\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-outside-traffic-test-2260532-1024x208.png\" alt=\"\" class=\"wp-image-8814\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-outside-traffic-test-2260532-1024x208.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-outside-traffic-test-2260532-300x61.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-outside-traffic-test-2260532-768x156.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-outside-traffic-test-2260532.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">This initial glance is a decent start. However, if we look for SYN flags specifically we can quickly find out who in the network was reaching out to initiate a TCP connection. To hunt SYN flags we need to tell TCPdump to look at the 13th field of the TCP header and find packets where the TCP flags are set to <code>0x02<\/code> \u2013 which is BPF for the SYN flag. Remember that handshake in the beginning?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>tcpdump -nttttr case001.pcap 'src net 10.42.85.0\/24 and not dst net 10.42.85.0\/24 and tcp[13]=0x02'<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You are now looking at every SYN packet that left the network\u2026 almost. There are ECN packets we are not taking into account.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"ecn-flags\">ECN Flags<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/en.wikipedia.org\/wiki\/Explicit_Congestion_Notification\" target=\"_blank\" rel=\"noreferrer noopener\">Explicit Congestion Notification<\/a> flags will break some of the magic of using the BPF filters to find certain flags in the PCAP. An overly brief explanation is that certain Operating Systems will have their TCP Stacks set bit in the ECN bits area and we have to filter accordingly. In other words, simply looking for the exact bits set in the TCP Flags portion of the header isn\u2019t through enough. We have to account for that by slightly changing the filter to: <code>tcp[13]&amp;0x3f=0x02<\/code>. <em>Now we can see SYN flags sourced from the Domain Controller<\/em> that cannot be seen with <code>tcp[13]&amp;0x3f=0x02<\/code>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/i0.wp.com\/dfirmadness.com\/wp-content\/uploads\/2020\/10\/tcpdump-ecn-flags.png?resize=1200%2C400&amp;ssl=1\" alt=\"\" class=\"wp-image-804\"\/><\/figure><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"linux-fu-and-tcpdump\">Linux-Fu and TCPdump<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Using the Linux commands: <code>cut<\/code>,<code>awk<\/code>,<code>sort<\/code>,<code>uniq<\/code> and BPF Filters can you determine things like:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Which internal hosts reach out to remote systems?<\/li><li>Can you determine a list of remote servers that our internal hosts reached out to?<\/li><li>Which remote machines connected to our local machines?<\/li><li>How many times?<\/li><li>How many times did internal hosts reach out to remote systems?<\/li><\/ul>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">SPOILERS AHEAD<\/p>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">It is far easier to experiment with only a few packets. Limit the count to a small amount when testing. When you are done testing remove the count limit.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"168\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-limit-9433174-1024x168.png\" alt=\"\" class=\"wp-image-8817\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-limit-9433174-1024x168.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-limit-9433174-300x49.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-limit-9433174-768x126.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-limit-9433174.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"examples-of-exploring-the-pcap-from-command-line-only\">Examples of Exploring the PCAP from Command Line Only<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Frequency Analysis of Internal Machines Initiating Outbound Connections<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>tcpdump -nttttr case001.pcap 'tcp[13]&amp;0x3f=0x02 and src net 10.42.85.0\/24 and not dst net 10.42.85.0\/24'|awk '{print $4}'|cut -d '.' -f1-4|sort -n|uniq -c|sort -nr<\/code><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"97\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-freq-analysis2-2966540-1024x97.png\" alt=\"\" class=\"wp-image-8818\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-freq-analysis2-2966540-1024x97.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-freq-analysis2-2966540-300x29.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-freq-analysis2-2966540-768x73.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-freq-analysis2-2966540.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Don\u2019t simply cut and paste this and move on. Learn the command shown above. This powerful combination of Linux commands can be rearranged to answer many more questions about what happened on the network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Can you get these answers on your own?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Remote Systems Contacted by Our Internal Systems by Frequency<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/i0.wp.com\/dfirmadness.com\/wp-content\/uploads\/2020\/10\/tcpdump-sort-freq-analysis3.png?resize=722%2C477&amp;ssl=1\" alt=\"\" class=\"wp-image-809\"\/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Connections Initiated to Our Internal Systems From the Outside by Frequency<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"718\" height=\"67\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-outside-to-inside-1293780-1.png\" alt=\"\" class=\"wp-image-8821\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-outside-to-inside-1293780-1.png 718w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-sort-outside-to-inside-1293780-1-300x28.png 300w\" sizes=\"auto, (max-width: 718px) 100vw, 718px\" \/><\/figure><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"rdp-you-say\">RDP You Say?!<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">We also noticed that there was some RDP in these packets. Let\u2019s get situational awareness around RDP events.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>tcpdump -nttttr case001.pcap 'tcp port 3389'<\/code> will dump out every RDP packet in the PCAP- so long as it used the standard RDP port of TCP 3389. Remember to control for source and destination networks to answer questions accordingly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Did we see any RDP from the outside? We already know this from the Snort Alerts. However, as a point of learning lets see it in tcpdump.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>tcpdump -nttttr case001.pcap 'tcp port 3389 and (dst net 10.42.85.0\/24 and not src net 10.42.85.0\/24)' -c5<\/code><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"129\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-peek-2921725-1024x129.png\" alt=\"\" class=\"wp-image-8822\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-peek-2921725-1024x129.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-peek-2921725-300x38.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-peek-2921725-768x97.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-peek-2921725.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Were there any RDP sessions between internal hosts?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>tcpdump -nttttr case001.pcap 'tcp port 3389 and (src net 10.42.85.0\/24 and dst net 10.42.85.0\/24)' -c15<\/code><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"274\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-internal-1464931-1-1024x274.png\" alt=\"\" class=\"wp-image-8851\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-internal-1464931-1-1024x274.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-internal-1464931-1-300x80.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-internal-1464931-1-768x205.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-rdp-internal-1464931-1.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">What is this data telling you? Look at the handshakes. Treat [SEW] like [S].<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"pcap-carving-interesting-packets\">PCAP Carving Interesting Packets<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Searching a PCAP is easy when you have a starting point. Looking for evil is faster when you have indicators to hunt for. You have seen how to find indicators in the PCAP; or you could have found them elsewhere in the case. Either way, at this point you should have <code>194.61.24.102<\/code> on the \u201cwhiteboard o\u2019 doom\u201d- or where ever you are tracking the enemy. The process may look like this:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Search the PCAP for the Indicator <code>194.61.24.102<\/code><\/li><li>Carve out all packets where this host is present into a smaller PCAP<\/li><li>If this resultant PCAP is small enough open it in something like Wireshark.<\/li><li>If the PCAP is still hundreds of megabytes try carving it with multiple indicators. This doesn\u2019t apply to this case but it could easily happen in the real world.<\/li><li>Use secondary tools to look for files that flew on the wire like Wireshark, Network miner etc.<\/li><li>Continue scoping the incident by finding other internal hosts talking to the adversary<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The following walk-through is one example of roughly following this template. Every case is different. Learn the tool. Understand the goal. Don\u2019t learn clickology. Be a hacker!<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"tcpdump-carving\">TCPdump Carving<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Tcpdump can be used to easily \u2018carve\u2019 out packets with our suspect system from the larger PCAP. You should be running this from a directory containing the PCAP from the case in the <code>\/cases<\/code> folder. You\u2019re not still using the <code>Desktop<\/code> are you????<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>tcpdump -nr 'host 194.61.24.102' -w \/tmp\/host194.cap<\/code><br><code>mv !$ .<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This will carve out packets where the interesting host appears and write it to a cap file in the tmp directory. Tcpdump prefers to write to world writable directory. These settings can be over-ridden with some work. However, the easy button is to write to <code>\/tmp<\/code> and move it over with <code>mv<\/code>. Notice the <code>!$<\/code> shortcut?<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"232\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-carve-8310623-1024x232.png\" alt=\"\" class=\"wp-image-8824\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-carve-8310623-1024x232.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-carve-8310623-300x68.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-carve-8310623-768x174.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-carve-8310623.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Notice the reduction in the data! This training PCAP was kept small on purpose. This carving technique becomes far more important with PCAP\u2019s that are GIG\u2019s or several hundred Megs! Run <code>capinfos<\/code> on both and note the differences.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"wireshark-and-file-carving\">Wireshark and File Carving<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Once you have a smaller PCAP we are ready for a more focused look with Wireshark. Wireshark will easily handle the 189 MB Case PCAP. However, this is all about learning and practicing. Carve it down, then open it from the command line. It is tempting to run Wireshark as root. Don\u2019t do it. It\u2019s a bad habit and dangerous. Simply open a new terminal or drop out of <code>sudo<\/code> for a moment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>exit<\/code><br><code>wireshark host194.cap &amp;<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Exit the root prompt. Use Wireshark to open our PCAP focusing on host 194.61.24.102 and run it in the background (of the prompt). A Wireshark window should open and load the PCAP.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"544\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-1024x544.png\" alt=\"\" class=\"wp-image-8825\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-1024x544.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-300x159.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-768x408.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-310x165.png 310w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"searching-for-keywords-in-pcaps-with-wireshark\">Searching for Keywords in PCAPs with Wireshark<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Wireshark makes searching for items of interest in the traffic easy. To search for keywords in the buried in the traffic that you are interested in you can start with a strings search in the bytes. This is an effective way to look for previously discovered IOC\u2019s or other items of interest.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/i0.wp.com\/dfirmadness.com\/wp-content\/uploads\/2020\/10\/wireshark-find-string-1.png?resize=1110%2C435&amp;ssl=1\" alt=\"\" class=\"wp-image-799\"\/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Press <code>CTRL+F<\/code> to bring up the search bar.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Select \u2018String\u2019<\/li><li>Select \u2018Packet Bytes\u2019<\/li><li>Input interesting string<\/li><li>Click \u2018Find\u2019<\/li><\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"gaining-situational-awareness\">Gaining Situational Awareness<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">A great place to start looking into a PCAP is the Statistics Menu.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"558\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-4077294-1024x558.png\" alt=\"\" class=\"wp-image-8826\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-4077294-1024x558.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-4077294-300x164.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-4077294-768x419.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-4077294.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The Protocol Hierarchy, Conversations, Endpoints and I\/O graph are good starting points for getting your situational awareness.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"558\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-starts-7589056-1024x558.png\" alt=\"\" class=\"wp-image-8827\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-starts-7589056-1024x558.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-starts-7589056-300x164.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-starts-7589056-768x419.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-stats-starts-7589056.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">As an example, let\u2019s look at the Endpoints menu option.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"960\" height=\"386\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-scope-expansion-4885549.png\" alt=\"\" class=\"wp-image-8828\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-scope-expansion-4885549.png 960w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-scope-expansion-4885549-300x121.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-scope-expansion-4885549-768x309.png 768w\" sizes=\"auto, (max-width: 960px) 100vw, 960px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s close this and take a look at the traffic.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"544\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-1-1024x544.png\" alt=\"\" class=\"wp-image-8829\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-1-1024x544.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-1-300x159.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-1-768x408.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-1-310x165.png 310w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-194-to-115-glance-8549693-1.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Using the Wireshark display filter <code>ip.addr==10.42.85.115<\/code> we can isolate the packets in this PCAP to the internal host of our network. Knowing we are already looking at a PCAP that only contains packets involving <code>194.61.24.102<\/code> we know we are looking at a conversation between the suspect remote host and the internal host. Look at the opening volley of traffic. See the TCP Handshake followed by an HTTP request? Selecting the packet where the HTTP Request occurred we can find out if the host went to a domain or directly to an IP Address. This is an <em>important<\/em> distinction in network analysis. Wireshark interpolates the data and presents its <em>belief<\/em> in what the host had requested. This interpolated data is known as \u2018Expert\u2019 data. It is information not found directly in the Packets, but rather it is derived from the data. Information like this is indicated by <code>[<\/code> and <code>]<\/code>. We can tell this host went direct to an IP Address. This is interesting since most normal user traffic doesn\u2019t behave that way. Do you type IP Addresses into web browsers usually?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s follow the stream to see what these two system exchanged. Right Click the HTTP Request Packet, Select Follow, and then select the Follow HTTP or Follow TCP options.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"544\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-4954458-1024x544.png\" alt=\"\" class=\"wp-image-8830\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-4954458-1024x544.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-4954458-300x160.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-4954458-768x408.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-4954458-310x165.png 310w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-4954458.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Examine the findings.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"612\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-malware-3045649-1024x612.png\" alt=\"\" class=\"wp-image-8831\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-malware-3045649-1024x612.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-malware-3045649-300x179.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-malware-3045649-768x459.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-follow-stream-malware-3045649.png 1176w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">We see three interesting items. An internal host reached out to a remote suspect host and downloaded a suspicious file from a Python Simple HTTP Server; a common attack technique. Together these paint a bad picture. Note this is a common PenTesting trick and more skilled attackers are likely not going to be as obvious with a Python Simple HTTP Server. That said, downloading malware over HTTP in 2020 is still a thing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The next step is to inspect this file. We need to carve it out of the PCAP. There is a quick win for this using Wireshark.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"935\" height=\"588\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-export-http-703010.png\" alt=\"\" class=\"wp-image-8832\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-export-http-703010.png 935w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-export-http-703010-300x189.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-export-http-703010-768x483.png 768w\" sizes=\"auto, (max-width: 935px) 100vw, 935px\" \/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"522\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-export-http-coreupdater-1270869-1024x522.png\" alt=\"\" class=\"wp-image-8833\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-export-http-coreupdater-1270869-1024x522.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-export-http-coreupdater-1270869-300x153.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-export-http-coreupdater-1270869-768x392.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/wireshark-export-http-coreupdater-1270869.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Save the file to the same directory where the PCAP for the case is located. This makes it easy to remember this file was extracted from the PCAP. Stay organized! Remember that Wireshark is running as a regular user. Chances are the cases folder you are working in is owed by root. Simply save this file to a new folder in the the <code>\/tmp<\/code> directory, and then move it to <code>\/cases\/szechuan\/pcap<\/code>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"924\" height=\"166\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/coreupdater-moved-1-2721411.png\" alt=\"\" class=\"wp-image-8834\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/coreupdater-moved-1-2721411.png 924w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/coreupdater-moved-1-2721411-300x54.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/coreupdater-moved-1-2721411-768x138.png 768w\" sizes=\"auto, (max-width: 924px) 100vw, 924px\" \/><\/figure><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"file-inspection-and-triage\">File Inspection and Triage<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">A great starting point to check if a file is malicious is to send the hash of it to VirusTotal. Sending the hash is a good start because some advanced attackers will be watching VirusTotal for their own malware. If it is something special they cooked up for you they will know they are burned when you submit the file. When they know they are burned they may start changing their behavior, speed up their attack, or begin removing all the evidence. Send the hash, not the file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>sha256sum coreupdater.exe<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Copy the hash into VirusTotal.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"636\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-Search-55370-1024x636.png\" alt=\"\" class=\"wp-image-8835\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-Search-55370-1024x636.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-Search-55370-300x186.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-Search-55370-768x477.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-Search-55370.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">To simulate finding unknown malware a single character will be changed. Even if VirusTotal reports the file as malware you should continue examining the file to ensure you aren\u2019t missing anything.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"589\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-NoFindings-387340-1024x589.png\" alt=\"\" class=\"wp-image-8836\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-NoFindings-387340-1024x589.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-NoFindings-387340-300x173.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-NoFindings-387340-768x442.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/VT-Hash-NoFindings-387340.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">No findings? No problem. Let\u2019s use some SIFT and REMnux pre-installed tools to investigate further.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"capa\">CAPA<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">FireEye is always putting out great tools for the industry to use in the fight against evil. One of the most recent additions is Capa. Simply run Capa against the file to try and gain an understanding of what this suspect file might be capable of.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/i0.wp.com\/dfirmadness.com\/wp-content\/uploads\/2020\/10\/capa-coreupdater.png?resize=1200%2C331&amp;ssl=1\" alt=\"\" class=\"wp-image-773\"\/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Interesting! The executable is using obfuscation to attempt to hide information. Moreover, it is using XOR! These are known techniques the bad guys use to bypass network defenses and make life harder on investigators. We have some tricks up our sleeves too. Let\u2019s keep going.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"floss\">FLOSS<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">FLOSS is yet another FireEye tool in our arsenal. It does an exceptional job of trying to cut through obfuscation and return meaningful strings. We are hoping some of these strings will reveal IOC\u2019s like IP Addresses and Domain Names the malware will call home to.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"636\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/floss-coreupdater-2443251-1024x636.png\" alt=\"\" class=\"wp-image-8839\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/floss-coreupdater-2443251-1024x636.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/floss-coreupdater-2443251-300x186.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/floss-coreupdater-2443251-768x477.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/floss-coreupdater-2443251.png 1153w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Floss wasn\u2019t able to retrieve the IOC\u2019s we were hoping for (if they are there). However, there are still interesting findings. The word <code>PAYLOAD:<\/code> should make the hairs on an investigators neck stand up. We also see some indicators this executable <em>may<\/em> be importing the functions need to do process injection! This is not definitive. It\u2019s just an indicator that when combined with everything else we are starting to get an idea this executable intends to do evil.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"clam-av\">Clam Av<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Update clamscan and let it have a crack at it as well.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>freshclam<\/code><br><code>clamscan -v coreupdater.exe<\/code><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"859\" height=\"343\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/clamscan-coreupdater-8517627.png\" alt=\"\" class=\"wp-image-8837\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/clamscan-coreupdater-8517627.png 859w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/clamscan-coreupdater-8517627-300x120.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/clamscan-coreupdater-8517627-768x307.png 768w\" sizes=\"auto, (max-width: 859px) 100vw, 859px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Nothing this time around.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"sandbox-detonation\">Sandbox Detonation<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">It looks like static analysis of this file is not giving us any quick wins. At this point a junior analyst needs to send the file to a reverse engineer, or detonate the file in a sandbox. Up until this point we have been conducting <em>static<\/em> analysis. The next phase is to see the file actually run and do what it is designed to do. This is called <em>dynamic<\/em> analysis. Executables that are obfuscated must de-obfuscate themselves to run. \u201cMalware can hide but it has to run\u201d. Systems designed to detonate malware and safely observe its behavior are called sandboxes. Advanced adversaries use malware that is aware of sandboxes and will not detonate if it detects, or suspects, it is \u201csandboxed\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A quick easy option are online sandboxes. Be careful. Some adversaries watch these public sandboxes for when their malware is detonated there and will act accordingly (see above). For this exercise we will use one of the many free online sandboxes, <a href=\"http:\/\/any.run\">any.run<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once logged in you can search for the hash to see if someone had previously detonated this malware. If nothing is found you can submit the file.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"734\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-nothing-6284554-1024x734.png\" alt=\"\" class=\"wp-image-8838\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-nothing-6284554-1024x734.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-nothing-6284554-300x215.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-nothing-6284554-768x550.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-nothing-6284554.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"721\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-submit-3847254-1024x721.png\" alt=\"\" class=\"wp-image-8840\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-submit-3847254-1024x721.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-submit-3847254-300x211.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-submit-3847254-768x541.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-submit-3847254.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"698\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-crash-4555539-1024x698.png\" alt=\"\" class=\"wp-image-8841\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-crash-4555539-1024x698.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-crash-4555539-300x205.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-crash-4555539-768x524.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-crash-4555539-110x75.png 110w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/any-run-crash-4555539.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">When you go to submit this file it doesn\u2019t run! Hmmm. Could it be this is a 64-bit file? Did you notice that it only supports 32-bit?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s try another Sandbox, <a href=\"https:\/\/www.joesandbox.com\/#windows\">Joe Sandbox<\/a>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"849\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-64-setup-7311384-1024x849.png\" alt=\"\" class=\"wp-image-8842\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-64-setup-7311384-1024x849.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-64-setup-7311384-300x249.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-64-setup-7311384-768x637.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-64-setup-7311384.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Notice even Joe tries to warn you that you are about to tip your hand to the World that you found this malware.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"650\" height=\"349\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-warning-1443825.png\" alt=\"\" class=\"wp-image-8843\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-warning-1443825.png 650w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-warning-1443825-300x161.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-warning-1443825-310x165.png 310w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Once you confirm the payload detonation it will take a few minutes. However, the results are worth the wait.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"741\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-finding-8737486-1024x741.png\" alt=\"\" class=\"wp-image-8844\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-finding-8737486-1024x741.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-finding-8737486-300x217.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-finding-8737486-768x556.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-finding-8737486.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">WHAM! We have successfully uncovered the secrets of coreupdater.exe. When the IOC tab is selected we find a new IOC to add to the Board \u2018o Doom: <code>203.78.103.109<\/code>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"742\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-IOC-5573151-1024x742.png\" alt=\"\" class=\"wp-image-8845\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-IOC-5573151-1024x742.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-IOC-5573151-300x218.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-IOC-5573151-768x557.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-metasploit-IOC-5573151.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">We now know we are dealing with a malicious Trojan that is part of the Metasploit toolkit and it\u2019s calling back to <code>203.78.103.109<\/code>, a server likely residing in Thailand.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An amazing feature Joe Sandbox offers free users is a full report generated on the Malware for you! Grab a copy.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"741\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-get-8031253-1024x741.png\" alt=\"\" class=\"wp-image-8846\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-get-8031253-1024x741.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-get-8031253-300x217.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-get-8031253-768x556.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-get-8031253.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Select the PDF Report.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"490\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-options-9418455-1024x490.png\" alt=\"\" class=\"wp-image-8847\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-options-9418455-1024x490.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-options-9418455-300x144.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-options-9418455-768x367.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-options-9418455.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Read through it until you find the MITRE ATT&amp;CK portion of the report.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"360\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-MITRE-ATTACK-1348058-1024x360.png\" alt=\"\" class=\"wp-image-8849\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-MITRE-ATTACK-1348058-1024x360.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-MITRE-ATTACK-1348058-300x106.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-MITRE-ATTACK-1348058-768x270.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/Mahyar-report-MITRE-ATTACK-1348058.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">This is also known as a \u201cCross Walk\u201d. The <a href=\"https:\/\/attack.mitre.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">MITRE ATT&amp;CK Matrix<\/a> is one of the best resources to hit the industry in the past decade. It deserves its own post. For now, understand that this is here and is one of the easiest ways to understand the capabilities and intent of an adversaries malware. Take a look through the report. It\u2019s pretty epic for no money, and 5 minutes of waiting for it to detonate.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"back-to-the-pcap\">Back to the PCAP!<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We have new information! The new IP address added to the \u201cDoom Board\u201d! We need to investigate this new finding! Knowing at least one piece of malware communicates with <code>203.78.103.109<\/code> we can use this information to see which systems successfully reached out to the Command and Control (C2) platform for this adversary. You know how to do this! Look at at previous commands with tcpdump. Knowing <code>10.42.85.115<\/code> is the internal host inspect the PCAP with tcpdump and use your new found skills.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"139\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-203-and-115-3423665-1024x139.png\" alt=\"\" class=\"wp-image-8848\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-203-and-115-3423665-1024x139.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-203-and-115-3423665-300x41.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-203-and-115-3423665-768x104.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2022\/02\/tcpdump-203-and-115-3423665.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Examing the first 5 packets of the case001.pcap file what do we see here? What is significant about the time stamps and the flags? What does the P flag mean? What other tool can we use to understand the systems in our network that had <em>conversations<\/em> with this malicious host?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the end we can say for sure that <code>10.42.85.115<\/code> reached out to a known malicious IP and started communicating with it. Before you move on, ensure you understand <em>how<\/em> we are able to say that definitively here.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"pcap-analysis-with-security-onion\">PCAP Analysis with Security Onion<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"overview\">Overview<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Security Onion is about to retire. It is being replaced by Hybrid Hunter (aka Security Onion 2). For this reason a full write-up currently would be a bit of sour investment. However, understand the Security Onion OS as a stand alone Virtual Machine is an <em><strong>absolute beast<\/strong><\/em> of a PCAP Analysis station. For now, understand that it is a great option to explore on your own.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"guides\">Guides<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/docs.securityonion.net\/en\/latest\/\">official documentation<\/a> is fantastic. In the Table of Contents you will see selections for building it in VMware or VirtualBox.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"build-notes\">Build Notes<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When you build the VM ensure you have two virtual network cards installed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"importing-the-pcap\">Importing the PCAP<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To import the pcap, download it, then import it with <code>sudo so-import-pcap case001.cap<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"general-idea\">General Idea<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Security Onion allows the analyst to easily detect anomalies by seeing alerts in the Sguild client. From here they can easily extract malicious files and gather intelligence.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"further-updates\">Further Updates<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In the future this post will get an update when Hybrid Hunter is officially released and I have had time to learn the new system.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"conclusion\">Conclusion<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">We started off by reducing the noise and running an open source Intrusion Detection System (IDS), Snort, against the case001.pcap. This highlighted the brute force activity from <code>194.61.24.102<\/code>. TCPdump was used to explore activity between internal hosts and external hosts in addition to internal RDP communications. We further reduced the data by carving out the packets that contained communication with this host from the larger case001.pcap. By analyzing this smaller PCAP we discovered that both the Domain Controller and the Desktop machine were likely compromised. We also easily carved the suspect file, <code>coreupdater.exe<\/code>, from the PCAP which was downloaded to both hosts. This suspected malware was examined with static analysis. Little information was obtained with static analysis. Dynamic analysis with a sandbox was used next.<br>Using Joe Sandbox the file was confirmed to be malware calling back to <code>203.78.103.109<\/code>. This malware was explicitly identified as being from the Metasploit family; meaning this is <code>meterpreter<\/code>. To summarize, it appears that the adversary brute forced RDP to gain access to the Domain Controller. Next they RDP\u2019d to the user machine and downloaded the same malware to infect that machine as well. We can assume the malware successfully executed because we can see traffic to the Command and Control Platform from both machines. This information is key to directing other teams. For example, the firewall team should begin inspecting traffic to scope out which hosts in the Enterprise are infected with this malware. Armed with a solid set of IOC\u2019s we are now ready to pivot to other artifacts in the case.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ioc-s-to-take-away-and-pivot-with\">IOC\u2019s to Take Away and Pivot with<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We don\u2019t know if we will find the IOC\u2019s in next moves listed below, but they are great pivot points to start with things like keyword searches etc.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To Disk: Filename <strong>coreupdater.exe<\/strong>, and malicious IP\u2019s <strong>203.78.103.109, 194.61.24.102<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To Memory: Malicious filename: <strong>coreupdater.exe<\/strong> and malicious IP Addresses of <strong>203.78.103.109, 194.61.24.102<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To Autoruns: <strong>coreupdater.exe<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"things-to-study-or-try-next\">Things to Study or Try Next<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>TCP Protocols in depth<\/li><li>UDP Protocols in depth<\/li><li>TCP\/UDP Headers<\/li><li>TShark<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This was merely an intro to the deep well of knowledge that is Network Analysis. If you enjoyed it, use materials at the beginning of this post to keep studying!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learning Objectives Understand the advantages and goals of PCAP Analysis How to pivot into and away from PCAP Analysis (how to use findings for quicker analysis) [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":8829,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[220,224,229,234],"tags":[179,259,263,276],"class_list":["post-8788","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-application-and-software-security","category-dfir-and-incident-response","category-network-and-protocol-security","category-training-and-reference","tag-dfir","tag-network-security","tag-packet-analysis","tag-training"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8788"}],"version-history":[{"count":2,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8788\/revisions"}],"predecessor-version":[{"id":8852,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8788\/revisions\/8852"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8829"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}