Unit 12: Capstone: investigate an incident · Lesson 2 of 5 · 22 min
Find the entry point
Trace the first contact with the outside server back to a lookup and a download, and preserve the file.
mission
- You are
- The incident analyst.
- Situation
- You know the host and the outside address. Now you need the first moment they met and what came across.
- Goal
- Find the lookup and download that started it, export the file and hash it.
- Hand in
- The domain, the file name, the time and its SHA-256.
The first two minutes
Press play or step through.
What did the laptop look up
DNS questions from the suspect host show which names it resolved and in what order.
tshark -r incident.pcap -Y 'dns.flags.response==0 && ip.src==10.10.0.44' -T fields -e frame.time_utc -e dns.qry.name
Oct 14, 2026 13:02:10.000000000 UTC invoice-portal.example.net
Oct 14, 2026 13:02:59.500000000 UTC telemetry.invoice-portal.example.net
you should see Two names under one domain, 50 seconds apart.
What did it fetch
The only HTTP in the capture is a download, right after the first lookup.
tshark -r incident.pcap -Y http -T fields -e frame.number -e ip.src -e http.request.method -e http.request.uri -e http.response.code -e http.content_type
8 10.10.0.44 GET /download/invoice_1014.zip
10 203.0.113.99 200 application/zip
you should see A zip file named like an invoice, over plain HTTP.
defender tip Invoice-themed downloads right after an email arrives are the most common start of an office incident. The mail logs for 13:00 to 13:02 are your next stop outside the network.
Export and hash the file
Export the download, identify it without opening it, and record its hash.
mkdir -p ~/evidence && tshark -r incident.pcap -q --export-objects http,/home/analyst/evidence && ls ~/evidence && wc -c < ~/evidence/invoice_1014.zip invoice_1014.zip 186 sha256sum ~/evidence/invoice_1014.zip d165004f17397e5c2a3ecafa2e8fb3c7e59839fed9080422fe94fc649881b055 /home/analyst/evidence/invoice_1014.zip python3 -m zipfile -l ~/evidence/invoice_1014.zip File Name Modified Size README.txt 2026-10-14 12:00:00 68
you should see The lab's sample holds a harmless text file. A real one would go to the malware team with this hash.
defender tip List archive contents, never extract or open them on your workstation. Share the hash first: other teams may already know it.
Identify the server
The response headers say which server software answered.
tshark -r incident.pcap -Y 'http.response' -T fields -e ip.src -e http.server
203.0.113.99 nginx
you should see 203.0.113.99 answered as nginx.
What a defender takes away
- 1Lookups come before connections, so DNS often shows the first step.
- 2Export, identify, hash: in that order, without opening anything.
- 3Plain HTTP downloads can be rebuilt byte for byte from a capture.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.