Unit 12: Capstone: investigate an incident · Lesson 3 of 5 · 22 min
Trace the beacon and the sweep
Measure the laptop's check-ins and map the internal servers it probed.
mission
- You are
- The incident analyst.
- Situation
- After the download, the laptop kept talking to the same server and then reached into the server room.
- Goal
- Measure the check-in interval and list every internal host and port it probed, with the answers it got.
- Hand in
- The interval, the number of servers probed and which ports answered.
A beacon keeps time
Count the TLS sessions
Every session to the outside server starts with a Client Hello naming the telemetry host.
tshark -r incident.pcap -Y 'tls.handshake.type==1' -T fields -e ip.src -e tls.handshake.extensions_server_name | sort | uniq -c
21 10.10.0.44 telemetry.invoice-portal.example.net
Measure the interval
The same awk you used for the beacon unit.
tshark -r incident.pcap -Y 'tls.handshake.extensions_server_name=="telemetry.invoice-portal.example.net"' -T fields -e frame.time_relative | awk 'NR>1 {printf "%.0f\n", $1-prev} {prev=$1}' | sort -n | uniq -c
4 29
12 30
3 31
1 40
you should see Every 30 seconds, plus one gap of 40 before the last session. That last one is different; keep it for the next lesson.
Map the sweep
List every server the laptop sent a SYN to, then which ones answered SYN-ACK.
tshark -r incident.pcap -Y 'ip.src==10.10.0.44 && ip.dst==10.20.0.0/24 && tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.dst | sort -u 10.20.0.11 10.20.0.12 10.20.0.25 10.20.0.40 10.20.0.53 tshark -r incident.pcap -Y 'ip.src==10.20.0.0/24 && tcp.flags.syn==1 && tcp.flags.ack==1' -T fields -e ip.src -e tcp.srcport 10.20.0.11 22 10.20.0.12 22
you should see Five servers probed on 22, 445 and 3389. SSH answered on web01 and db01.
defender tip The firewall drop log showed the same laptop hitting 445 on web01 at 13:09. Two independent sources agreeing makes the finding solid.
Count probes per port
The ports chosen show the plan: remote shells, file shares and remote desktop.
tshark -r incident.pcap -Y 'ip.src==10.10.0.44 && ip.dst==10.20.0.0/24 && tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e tcp.dstport | sort -n | uniq -c
5 22
7 445
5 3389
you should see SMB was tried most, then SSH and remote desktop.
What a defender takes away
- 1A 30 second check-in started 50 seconds after the download.
- 2The sweep took three seconds and found SSH on two servers.
- 3Cross-check captures with firewall and DNS logs before you report.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.