2021-01-21 - TRAFFIC ANALYSIS EXERCISE - WOKEMOUNTAIN
ASSOCIATED FILES:
- Zip archive of the pcap: 2021-01-21-traffic-analysis-exercise.pcap.zip 4.3 MB (4,276,847 bytes)
- 2021-01-21-traffic-analysis-exercise.pcap (7,266,601 bytes)
- Zip archive of the alerts: 2021-01-21-traffic-analysis-exercise-alerts.zip 2.1 MB (2,140,417 bytes)
- 2021-01-21-traffic-analysis-exercise-alerts.jpg (2,384,478 bytes)
- 2021-01-21-traffic-analysis-exercise-alerts.txt (6,080 bytes)
NOTES:
- All zip archives on this site are password-protected with the standard password. If you don't know it, look at the "about" page of this website.
SCENARIO
LAN segment data:
- LAN segment range: 10.1.21.0/24 (10.1.21.0 through 10.1.21.255)
- Domain: wokemountain.com
- Domain controller: 10.1.21.2 - WokeMountain-DC
- LAN segment gateway: 10.1.21.1
- LAN segment broadcast address: 10.1.21.255
TASK
- Write an incident report based on the pcap and the alerts.
- The incident report should contains 3 sections:
- Executive Summary: State in simple, direct terms what happened (when, who, what).
- Details: Details of the victim (hostname, IP address, MAC address, Windows user account name).
- Indicators of Compromise (IOCs): IP addresses, domains and URLs associated with the infection. SHA256 hashes if any malware binaries can be extracted from the pcap.
ANSWERS
- Click here for the answers.
Click here to return to the main page.