WEBVTT

0:00:06.780000 --> 0:00:12.020000
 We're going to be taking a look at how
 to analyze network traffic in the

0:00:12.020000 --> 0:00:18.400000
 form of PCAPs and investigate what was
 captured in terms of the network

0:00:18.400000 --> 0:00:21.720000
 traffic for signs of attacks.

0:00:21.720000 --> 0:00:27.600000
 And we're going to be utilizing a lab
 to facilitate the demonstration.

0:00:27.600000 --> 0:00:32.820000
 Now, before we get started with the
 lab, the lab has a scenario and I've

0:00:32.820000 --> 0:00:38.600000
 transposed it here because it's quite
 important in terms of what we're

0:00:38.600000 --> 0:00:42.180000
 supposed to do. So it reads as follows.

0:00:42.180000 --> 0:00:45.640000
 A company's internal network
 is under serious attacks.

0:00:45.640000 --> 0:00:51.440000
 The IDS intrusion detection system at
 every department is or are throwing

0:00:51.440000 --> 0:00:55.420000
 various alerts of unknown
 network attacks.

0:00:55.420000 --> 0:00:59.940000
 So this is a prime example of when
 an analyst or an incident responder

0:00:59.940000 --> 0:01:06.900000
 would be called in to analyze these alerts
 or this activity to accurately

0:01:06.900000 --> 0:01:09.660000
 identify exactly what's going on.

0:01:09.660000 --> 0:01:15.740000
 So as the next sentence or as the next
 statement reads, you have been

0:01:15.740000 --> 0:01:19.940000
 called to find out what's going on, explain
 what type of attacks are being

0:01:19.940000 --> 0:01:24.020000
 conducted and how it may be
 possible to mitigate them.

0:01:24.020000 --> 0:01:27.780000
 The network engineers at each department
 installed a packet capturing

0:01:27.780000 --> 0:01:31.220000
 device and presented you
 with the captured files.

0:01:31.220000 --> 0:01:36.400000
 So the goals are as follows, A, examine
 the traffic generated by the various

0:01:36.400000 --> 0:01:40.920000
 network attacks in the form of PCAPs,
 determine the attack and its potential

0:01:40.920000 --> 0:01:46.120000
 impact and find the machine or the system
 or the endpoint where the attack

0:01:46.120000 --> 0:01:48.140000
 originated from.

0:01:48.140000 --> 0:01:52.840000
 So as I mentioned, this video
 has a lab associated with it.

0:01:52.840000 --> 0:01:56.280000
 It's going to be the lab
 just below this video.

0:01:56.280000 --> 0:02:00.420000
 And again, it has the same title or
 shares the same title as this video.

0:02:00.420000 --> 0:02:02.820000
 So investigating network attacks.

0:02:02.820000 --> 0:02:07.180000
 So I'm going to start up my lab and
 I'll see you there in a couple of

0:02:07.180000 --> 0:02:10.720000
 seconds. All right.

0:02:10.720000 --> 0:02:16.360000
 So I'm currently within the lab environment
 and we have, I think we have

0:02:16.360000 --> 0:02:18.740000
 about five tasks.

0:02:18.740000 --> 0:02:26.220000
 The first task revolves around examining
 the captured traffic of the HR

0:02:26.220000 --> 0:02:31.140000
 department. So we need to examine the
 PCAP file containing traffic from

0:02:31.140000 --> 0:02:32.220000
 the HR department.

0:02:32.220000 --> 0:02:39.420000
 This is found under module seven on the
 desktop and under lab 22, I believe.

0:02:39.420000 --> 0:02:44.120000
 And we want to look for one
 HR department PCAP NG.

0:02:44.120000 --> 0:02:48.960000
 So it's great that they have actually
 been, they have the numbering or

0:02:48.960000 --> 0:02:52.900000
 the task numbering, you
 know, in the file name.

0:02:52.900000 --> 0:03:00.040000
 So we'll just open this up and task
 one, you know, identify is pretty

0:03:00.040000 --> 0:03:05.580000
 much requires us to identify what type
 of attack or, you know, identify,

0:03:05.580000 --> 0:03:11.500000
 you know, what's the cause
 of a specific complaint?

0:03:11.500000 --> 0:03:17.080000
 In this case, the users within the
 HR department are complaining about

0:03:17.080000 --> 0:03:22.860000
 it's okay. And we need to identify why
 this is the case or what's causing

0:03:22.860000 --> 0:03:26.300000
 this slow network performance
 and what's the impact of this.

0:03:26.300000 --> 0:03:32.440000
 So right out of the gate, we can
 see we have our timestamp here.

0:03:32.440000 --> 0:03:39.440000
 We have the source, so IPv6 addresses
 and then we have this here.

0:03:39.440000 --> 0:03:46.000000
 Okay. So we have the protocol
 and we have the length here.

0:03:46.000000 --> 0:03:54.140000
 Okay. So we have SSDP and then we have,
 yeah, just in this case, just

0:03:54.140000 --> 0:03:56.840000
 IP information here.

0:03:56.840000 --> 0:03:58.880000
 So let me zoom in.

0:03:58.880000 --> 0:04:02.240000
 Actually, let me zoom out slightly.

0:04:02.240000 --> 0:04:08.300000
 So let's take a look at the protocol
 hierarchy statistics.

0:04:08.300000 --> 0:04:17.800000
 And we can see right over here, Ethernet
 in terms of, yeah, there we are.

0:04:17.800000 --> 0:04:21.100000
 IPv4 seems to be a lot of traffic here.

0:04:21.100000 --> 0:04:25.120000
 So just by, you know, taking it, just
 by looking at the packets here,

0:04:25.120000 --> 0:04:30.320000
 we can see a lot of interesting activity,
 all, you know, IPv4 packets

0:04:30.320000 --> 0:04:34.880000
 here, nothing, nothing additional.

0:04:34.880000 --> 0:04:35.840000
 Actually, hold on.

0:04:35.840000 --> 0:04:39.020000
 Let's see. There's quite
 a bit of traffic in here.

0:04:39.020000 --> 0:04:43.620000
 So we, yeah, it's mainly, yeah, that's
 exactly what you'd expect.

0:04:43.620000 --> 0:04:46.340000
 We talk about network level.

0:04:46.340000 --> 0:04:49.880000
 So let's take a look at them here.

0:04:49.880000 --> 0:04:54.040000
 So we have quite a few packets and, you
 know, multiple source and destination

0:04:54.040000 --> 0:05:00.220000
 IPs. But one thing you can realize or
 you do realize is they're not carrying

0:05:00.220000 --> 0:05:05.500000
 any data. They're just IP, you know,
 they're just IPv4 packets, which

0:05:05.500000 --> 0:05:06.380000
 is kind of strange.

0:05:06.380000 --> 0:05:08.340000
 And it's a deadringer.

0:05:08.340000 --> 0:05:15.540000
 This is a, you know, a deadringer for,
 it's a deadringer that someone

0:05:15.540000 --> 0:05:19.140000
 is, you know, crafting these packets
 because, again, they don't have any

0:05:19.140000 --> 0:05:25.340000
 data. And if they've had any data, you
 know, I'm sure a lot of it would

0:05:25.340000 --> 0:05:27.200000
 just be the same type of data.

0:05:27.200000 --> 0:05:34.400000
 But what appears to be going on here is
 sort of a flooding, flooding attack,

0:05:34.400000 --> 0:05:35.860000
 you know, network flooding.

0:05:35.860000 --> 0:05:41.440000
 And really in this case, I can see any,
 you know, particular or any unique

0:05:41.440000 --> 0:05:43.440000
 IPs are in fact, hold on.

0:05:43.440000 --> 0:05:57.200000
 So if we go into, we should have one
 second statistics, not CTCP stream

0:05:57.200000 --> 0:06:05.140000
 graphs, we take a look at the IPv4
 statistics, destinations and ports.

0:06:05.140000 --> 0:06:11.340000
 Yeah, we can see, let's wait for
 it to complete the analysis.

0:06:11.340000 --> 0:06:15.480000
 Yeah, this is insane.

0:06:15.480000 --> 0:06:17.480000
 But hold on, let's see.

0:06:17.480000 --> 0:06:20.360000
 So we have destinations and ports.

0:06:20.360000 --> 0:06:30.620000
 So count, let's see.

0:06:30.620000 --> 0:06:33.220000
 So the burst rate here.

0:06:33.220000 --> 0:06:36.320000
 Yeah, so we're not seeing
 any particular target IPs.

0:06:36.320000 --> 0:06:39.780000
 I think it's still analyzing one second.

0:06:39.780000 --> 0:06:42.460000
 So let me bring this up here.

0:06:42.460000 --> 0:06:53.380000
 Yeah. So it's most likely that, you know,
 the attacker or this, the source

0:06:53.380000 --> 0:06:58.040000
 is creating or crafting these packets
 and sending them onto the network

0:06:58.040000 --> 0:07:02.960000
 in order to cause the switch to through
 its cam table and to pretty much

0:07:02.960000 --> 0:07:07.540000
 work as a hub. So this is a Mac flooding.


0:07:07.540000 --> 0:07:14.820000
 Yeah, because, you know, it would
 actually cause an issue.

0:07:14.820000 --> 0:07:17.660000
 If there's nothing contained therein.

0:07:17.660000 --> 0:07:21.320000
 So we can actually move on to task two.

0:07:21.320000 --> 0:07:27.180000
 So task two, in this case, we need
 to take a look at another PCAP.

0:07:27.180000 --> 0:07:29.360000
 So let me close this up.

0:07:29.360000 --> 0:07:36.180000
 So task two involves or requires us
 to examine the captured traffic from

0:07:36.180000 --> 0:07:37.220000
 the IT department.

0:07:37.220000 --> 0:07:40.840000
 So this is this one right here.

0:07:40.840000 --> 0:07:42.240000
 So let's open it up.

0:07:42.240000 --> 0:07:45.280000
 So the task reads as follows.

0:07:45.280000 --> 0:07:49.720000
 So users are complaining about not being
 able to access the internet at

0:07:49.720000 --> 0:07:56.640000
 all, even though the router with the
 IP 192 168 153.2 is pingable or is

0:07:56.640000 --> 0:08:03.100000
 reachable. So the task asks, what type
 of attack is being conducted and

0:08:03.100000 --> 0:08:06.480000
 how can this attack be stopped?

0:08:06.480000 --> 0:08:12.120000
 Okay, so, you know, we can see DNS.

0:08:12.120000 --> 0:08:17.260000
 Yeah. DNS query for MSN,
 we get a response here.

0:08:17.260000 --> 0:08:18.620000
 Okay, let's see.

0:08:18.620000 --> 0:08:21.840000
 We take no errors or answers.

0:08:21.840000 --> 0:08:30.600000
 In this case, MSN, yeah, we have a
 C name, C name, and then let's see.

0:08:30.600000 --> 0:08:33.520000
 Yeah, a whole start dress.

0:08:33.520000 --> 0:08:35.500000
 Yeah, so it looks like that's working.

0:08:35.500000 --> 0:08:42.860000
 So the initial request, so we have ARP
 request who has what IP, all that

0:08:42.860000 --> 0:08:44.780000
 good stuff. So MSN.

0:08:44.780000 --> 0:08:49.460000
 And then right over here, we have Bing.

0:08:49.460000 --> 0:08:56.180000
 So that's the query here and then
 standard response right over here.

0:08:56.180000 --> 0:09:01.080000
 Okay, interesting.

0:09:01.080000 --> 0:09:06.220000
 So remember, they cannot reach the
 internet or they're having trouble

0:09:06.220000 --> 0:09:07.500000
 reaching the internet.

0:09:07.500000 --> 0:09:12.180000
 So let's take a look at the ARP packets.

0:09:12.180000 --> 0:09:22.180000
 Okay, so we can see who
 has 192 168 153 135.

0:09:22.180000 --> 0:09:29.060000
 Okay, yeah, it's that same actually
 hold on 153 and then 135.

0:09:29.060000 --> 0:09:36.540000
 That's very, very interesting.

0:09:36.540000 --> 0:09:40.360000
 So it's probably a good idea.

0:09:40.360000 --> 0:09:48.980000
 We're saying our, let's see, we have
 the, we have the routers IP, so we

0:09:48.980000 --> 0:09:52.600000
 can say, and IP dot source.

0:09:52.600000 --> 0:09:58.920000
 Let's see if there's anything, any ARP
 requests coming from the routers.

0:09:58.920000 --> 0:10:03.720000
 So 192 168.153.2.

0:10:03.720000 --> 0:10:07.780000
 Okay, nothing coming there.

0:10:07.780000 --> 0:10:12.580000
 So let me just say ARP once again.

0:10:12.580000 --> 0:10:16.260000
 So let's see, so 135 tells.

0:10:16.260000 --> 0:10:17.760000
 So this is the source here.

0:10:17.760000 --> 0:10:21.420000
 In this case, address
 resolution protocol.

0:10:21.420000 --> 0:10:23.360000
 This is the Mac here.

0:10:23.360000 --> 0:10:26.040000
 We can see the sender IP address there.

0:10:26.040000 --> 0:10:32.040000
 Okay, so if that is one second.

0:10:32.040000 --> 0:10:38.260000
 Who has, yeah, okay, that makes sense.

0:10:38.260000 --> 0:10:44.060000
 So that is, yeah, it's asking 135.

0:10:44.060000 --> 0:10:47.120000
 Then it's saying right over here.

0:10:47.120000 --> 0:10:55.240000
 Yeah, 153, that's very strange.

0:10:55.240000 --> 0:11:01.040000
 So on this one, if we take a look at
 this here, we can see the sender.

0:11:01.040000 --> 0:11:09.040000
 Yeah, okay, so let's take a look a little
 bit, whether we have any, oh,

0:11:09.040000 --> 0:11:11.140000
 there we are, okay, so.

0:11:11.140000 --> 0:11:15.540000
 So we take a look at this one here.

0:11:15.540000 --> 0:11:17.420000
 This is very, very interesting.

0:11:17.420000 --> 0:11:38.380000
 So we can see in this case, the reply here,
 so we can see sender MAC address,

0:11:38.380000 --> 0:11:47.040000
 okay, so the reply in this case, so, yeah,
 so who has, and then one second.

0:11:47.040000 --> 0:11:57.000000
 Yeah, yeah, so the reply is that the
 router's physical address is this.

0:11:57.000000 --> 0:12:06.480000
 Okay, let's keep exploring this
 and something interesting here.

0:12:06.480000 --> 0:12:10.180000
 So duplicate IP address detected.

0:12:10.180000 --> 0:12:15.080000
 So, okay, so hold on a second.

0:12:15.080000 --> 0:12:21.060000
 So duplicate IP address detected
 for the router's IP address.

0:12:21.060000 --> 0:12:26.140000
 So this is a different MAC than
 the one we are aware of.

0:12:26.140000 --> 0:12:31.200000
 So it's most likely that there's some
 sort of poisoning attack, where

0:12:31.200000 --> 0:12:36.700000
 the attacker is sending spoofed ARP
 replies, telling everyone that, you

0:12:36.700000 --> 0:12:42.200000
 know, they are the, the
 router default gateway.

0:12:42.200000 --> 0:12:56.880000
 So this pretty much means that this
 right over here is most likely the

0:12:56.880000 --> 0:12:59.200000
 the attacker's MAC address.

0:12:59.200000 --> 0:13:08.260000
 So we can essentially, if we take a
 look at this here, so that is zero.

0:13:08.260000 --> 0:13:10.000000
 Yeah, hold on a second.

0:13:10.000000 --> 0:13:21.580000
 So this is what we want to copy.

0:13:21.580000 --> 0:13:24.760000
 See if I can just paste that in here.

0:13:24.760000 --> 0:13:26.160000
 So this is what we want.

0:13:26.160000 --> 0:13:36.000000
 So we can actually filter for this MAC
 address and essentially look for

0:13:36.000000 --> 0:13:40.840000
 Ethernet frames that hold, you know,
 that particular MAC address to see

0:13:40.840000 --> 0:13:41.920000
 what else they're doing.

0:13:41.920000 --> 0:13:47.780000
 So we can then say here in the display
 filter, Ethernet dot address is

0:13:47.780000 --> 0:13:50.640000
 equal to the following.

0:13:50.640000 --> 0:13:52.360000
 Okay, interesting.

0:13:52.360000 --> 0:13:58.200000
 So now let's see ARP and then TCP.

0:13:58.200000 --> 0:14:05.580000
 Let's take a look at the
 on the source here.

0:14:05.580000 --> 0:14:08.800000
 Yeah, that is definitely suspicious.

0:14:08.800000 --> 0:14:18.620000
 Okay. Let's take a look at this TCP here.


0:14:18.620000 --> 0:14:23.320000
 So interesting. So it looks like the
 attack was successful because we

0:14:23.320000 --> 0:14:28.560000
 can see there's an act
 from the following IP.

0:14:28.560000 --> 0:14:38.080000
 And if we take a look at the, yeah,
 the MAC address here, this contains

0:14:38.080000 --> 0:14:41.580000
 the, you know, this has the
 suspects MAC address here.

0:14:41.580000 --> 0:14:44.300000
 So, yeah, that's fine.

0:14:44.300000 --> 0:14:48.920000
 Not really important here, but if we
 take a look at, sorry, Ethernet here,

0:14:48.920000 --> 0:14:53.000000
 destination, yeah, and then the source.

0:14:53.000000 --> 0:14:59.640000
 Okay. So, yeah, this is most
 likely ARP poisoning.

0:14:59.640000 --> 0:15:06.860000
 So, yeah, this is the, this is the most
 likely cause or the type of attack

0:15:06.860000 --> 0:15:12.540000
 that we're dealing with here and per
 the objectives of task two, we are

0:15:12.540000 --> 0:15:17.300000
 supposed to identify the type of attack
 being conducted and how in terms

0:15:17.300000 --> 0:15:23.700000
 of how this can be stopped, this can
 easily be stopped by implementing

0:15:23.700000 --> 0:15:28.980000
 dynamic ARP inspection or ARP
 inspection on the network.

0:15:28.980000 --> 0:15:34.020000
 So now we have task three,
 which reads as follows.

0:15:34.020000 --> 0:15:37.900000
 So you get a call from a client complaining
 about not being able to access

0:15:37.900000 --> 0:15:46.980000
 the web server with an IP address
 of 192.168.153.154.

0:15:46.980000 --> 0:15:54.040000
 We need to try and figure out what is
 the, what's the cause I'm guessing?

0:15:54.040000 --> 0:15:57.400000
 And the PCAP in question
 is the third PCAP.

0:15:57.400000 --> 0:16:08.220000
 So just get rid of this.

0:16:08.220000 --> 0:16:10.040000
 Okay. So that's the third.

0:16:10.040000 --> 0:16:16.200000
 So the description of that
 task is reads as follows.

0:16:16.200000 --> 0:16:21.280000
 So you try to access the site and you
 find out that it takes ages to load.

0:16:21.280000 --> 0:16:27.540000
 In this case, the web server
 is on 192.168.153.154.

0:16:27.540000 --> 0:16:30.720000
 So examine the traffic that was captured
 and try and determine what is

0:16:30.720000 --> 0:16:35.100000
 happening and the attackers
 IP address if possible.

0:16:35.100000 --> 0:16:48.080000
 Okay. So, yeah, this, in this case,
 we probably can easily, yeah, if we

0:16:48.080000 --> 0:16:50.660000
 read through it, it looks like
 the, you know, the web server.

0:16:50.660000 --> 0:16:54.120000
 So if we say, you know, IP address,
 let's just start there.

0:16:54.120000 --> 0:16:58.420000
 So the web server's IP is 192.168.

0:16:58.420000 --> 0:17:05.940000
 0.153. 0.154. Let's just
 see what we have here.

0:17:05.940000 --> 0:17:12.340000
 Okay. So we can see the source,
 actually hold on IP.

0:17:12.340000 --> 0:17:18.840000
 destination. We can let's
 identify the port.

0:17:18.840000 --> 0:17:22.580000
 So it's all port 80.

0:17:22.580000 --> 0:17:31.280000
 So we can actually say IP address and
 then we say and let's filter it.

0:17:31.280000 --> 0:17:35.360000
 TCP.destination port.

0:17:35.360000 --> 0:17:40.460000
 That's going to be equal to 80.

0:17:40.460000 --> 0:17:46.960000
 Okay. So there's a lot of
 interesting activities.

0:17:46.960000 --> 0:17:48.960000
 So we have a SIN, SIN.

0:17:48.960000 --> 0:17:53.020000
 Let's take a look at the size here.

0:17:53.020000 --> 0:18:00.460000
 So there we are, sequence, yeah,
 source port, destination port.

0:18:00.460000 --> 0:18:07.560000
 Okay. payload data 10 bytes, 10, 10.

0:18:07.560000 --> 0:18:11.060000
 Okay. Interesting.

0:18:11.060000 --> 0:18:14.820000
 Yeah. We can see there's quite
 a few SIN segments on port 80.

0:18:14.820000 --> 0:18:20.540000
 Most likely this is a
 SIN flooding attack.

0:18:20.540000 --> 0:18:31.420000
 Yeah. And we can see that if
 we take a closer look here.

0:18:31.420000 --> 0:18:34.580000
 So we have a SIN, SIN.

0:18:34.580000 --> 0:18:45.080000
 And then, okay. So SIN, we have one
 there and then there's a reset.

0:18:45.080000 --> 0:18:47.800000
 Right over here.

0:18:47.800000 --> 0:18:51.880000
 And then a SIN here.

0:18:51.880000 --> 0:18:55.260000
 That's very interesting.

0:18:55.260000 --> 0:19:00.200000
 All right. So let's see.

0:19:00.200000 --> 0:19:04.380000
 So we have 165, 187, 62, 29.

0:19:04.380000 --> 0:19:08.980000
 So they send a SIN, but immediately
 after before even receiving the SIN

0:19:08.980000 --> 0:19:12.140000
 ACK, they reset.

0:19:12.140000 --> 0:19:16.720000
 You know, which pretty much tells
 us this is an automated attack.

0:19:16.720000 --> 0:19:22.680000
 It's not really users, individual users
 trying to access the web server.

0:19:22.680000 --> 0:19:30.380000
 Yeah. So this is most likely a denial
 of service attack because you can

0:19:30.380000 --> 0:19:32.260000
 just see SINs and resets.

0:19:32.260000 --> 0:19:33.660000
 So they make a request.

0:19:33.660000 --> 0:19:38.860000
 They don't pretty much a DOS attack.

0:19:38.860000 --> 0:19:43.420000
 And you can see there's quite a few big,
 actually this might be a distributed

0:19:43.420000 --> 0:19:46.600000
 denial of service attack because
 the IPs are different.

0:19:46.600000 --> 0:19:54.420000
 I'm not seeing any, let's see statistics,
 IPv4 statistics, source and

0:19:54.420000 --> 0:19:57.140000
 destination addresses here.

0:19:57.140000 --> 0:20:09.100000
 So source IP addresses, actually hold on.


0:20:09.100000 --> 0:20:12.820000
 Yeah. So I looks fairly distributed.

0:20:12.820000 --> 0:20:15.460000
 So you can just see two or
 one being made from each.

0:20:15.460000 --> 0:20:17.940000
 This is an insane amount of traffic.

0:20:17.940000 --> 0:20:21.180000
 So this is most likely a distributed
 denial of service attacks.

0:20:21.180000 --> 0:20:23.840000
 So we really can find the attackers IP.

0:20:23.840000 --> 0:20:33.980000
 So now we have, now we have to move on
 to task four, which reads as follows.

0:20:33.980000 --> 0:20:39.760000
 So employees at the legal department
 cannot connect to the network at

0:20:39.760000 --> 0:20:43.960000
 all. Try to figure out what is the cause.


0:20:43.960000 --> 0:20:48.620000
 Examine the PCAP file containing the
 traffic from the legal department.

0:20:48.620000 --> 0:20:59.900000
 That is the fourth PCAP, the title
 legal, legal department or PCAP NG.

0:20:59.900000 --> 0:21:03.480000
 So the question is what sort of attack
 is being conducted here and can

0:21:03.480000 --> 0:21:08.240000
 you determine the source and
 how can it be stopped?

0:21:08.240000 --> 0:21:21.860000
 Okay. So, okay. So we have quite
 a few DHCP requests here.

0:21:21.860000 --> 0:21:32.800000
 So if we take a look at statistics
 and the DHCP statistics, let's see

0:21:32.800000 --> 0:21:35.420000
 this here. Okay.

0:21:35.420000 --> 0:21:38.260000
 So we have DHCP message type.

0:21:38.260000 --> 0:21:48.140000
 The pretty much all packets are how discover
 pretty much discover messages.

0:21:48.140000 --> 0:21:57.160000
 So in this particular case, yeah, someone,
 it's most likely a DHCP starvation

0:21:57.160000 --> 0:22:04.880000
 attack. And there's really no way we
 can determine or identify the source

0:22:04.880000 --> 0:22:07.740000
 of the attack or the attacker's IP.

0:22:07.740000 --> 0:22:13.900000
 You know, at least, you know, through
 the PCAP alone, there's really no

0:22:13.900000 --> 0:22:21.280000
 way. But this can easily be resolved
 by enabling the DHCP message rate

0:22:21.280000 --> 0:22:24.740000
 limiting on the switch's port.

0:22:24.740000 --> 0:22:28.180000
 So next, I believe we have a task five.

0:22:28.180000 --> 0:22:30.240000
 So that was fairly simple.

0:22:30.240000 --> 0:22:32.360000
 The task five reads as follows.

0:22:32.360000 --> 0:22:38.540000
 The management department was the only
 department which where you didn't

0:22:38.540000 --> 0:22:42.460000
 get any complaints from trying to figure
 out if there have also been attacked.

0:22:42.460000 --> 0:22:46.160000
 Okay. So examine the PCAP file containing
 traffic from the management

0:22:46.160000 --> 0:22:55.300000
 department, which is right over here.

0:22:55.300000 --> 0:23:02.160000
 Okay. And the task reads as follows or
 the task scenario that this sounds

0:23:02.160000 --> 0:23:05.760000
 suspicious since it doesn't make sense
 for a group of attackers to attack

0:23:05.760000 --> 0:23:08.780000
 the whole network and leave
 that department untouched.

0:23:08.780000 --> 0:23:13.840000
 Examine the captured traffic you have
 and see if you can spot anything

0:23:13.840000 --> 0:23:19.920000
 unusual. Okay. So, yeah, we have ARP.

0:23:19.920000 --> 0:23:24.640000
 Okay. There's some very interesting
 stuff going on here.

0:23:24.640000 --> 0:23:32.520000
 Let's take a look at the protocol
 hierarchy statistics.

0:23:32.520000 --> 0:23:45.600000
 Okay. So transmission control protocol.

0:23:45.600000 --> 0:23:46.980000
 Very interesting.

0:23:46.980000 --> 0:23:52.320000
 I've never heard of data being
 a protocol under TCP.

0:23:52.320000 --> 0:23:57.240000
 I mean, we have TLS and HTTP,
 but data, that's interesting.

0:23:57.240000 --> 0:24:00.880000
 Okay. Let's, this is some new stuff.

0:24:00.880000 --> 0:24:05.760000
 So let's go ahead and just
 filter for data here.

0:24:05.760000 --> 0:24:14.380000
 Okay. Now we can see in here
 we have ICMP echo request.

0:24:14.380000 --> 0:24:15.780000
 Reply request reply.

0:24:15.780000 --> 0:24:19.540000
 Okay. And then we have
 a portion acknowledge.

0:24:19.540000 --> 0:24:22.240000
 So this is coming from this IP.

0:24:22.240000 --> 0:24:36.860000
 Okay. Interesting.

0:24:36.860000 --> 0:24:43.280000
 Okay. TCP right over here.

0:24:43.280000 --> 0:24:46.500000
 So if we take a look at data here.

0:24:46.500000 --> 0:24:52.580000
 Okay. So we can actually see Microsoft
 Windows version six.

0:24:52.580000 --> 0:24:53.860000
 So that's Windows seven.

0:24:53.860000 --> 0:24:55.940000
 Okay. Something interesting
 is going on here.

0:24:55.940000 --> 0:24:59.620000
 So you can see C users reverse machine.

0:24:59.620000 --> 0:25:02.640000
 Desktop Windows seven
 machine tools netcat.

0:25:02.640000 --> 0:25:05.460000
 Okay. So something is definitely
 going on here.

0:25:05.460000 --> 0:25:07.740000
 We follow the TCP stream here.

0:25:07.740000 --> 0:25:10.740000
 Oh my God. Yeah.

0:25:10.740000 --> 0:25:16.720000
 This looks like C to we can
 see actually hold on.

0:25:16.720000 --> 0:25:18.220000
 So the entire conversation here.

0:25:18.220000 --> 0:25:23.160000
 So CD users hold on.

0:25:23.160000 --> 0:25:28.660000
 And then yeah, that packet has the
 command directory and then this is

0:25:28.660000 --> 0:25:32.180000
 the response. Wait a minute.

0:25:32.180000 --> 0:25:39.080000
 Yeah. Okay. Net user the command
 completed successfully.

0:25:39.080000 --> 0:25:42.280000
 So let's take a look at this.

0:25:42.280000 --> 0:25:44.700000
 So we can see that.

0:25:44.700000 --> 0:25:50.560000
 Hold on a second.

0:25:50.560000 --> 0:25:53.040000
 So TCP right over here.

0:25:53.040000 --> 0:25:59.680000
 Okay. So this has data.

0:25:59.680000 --> 0:26:05.760000
 So this is being sent to.

0:26:05.760000 --> 0:26:09.700000
 So we can see the IP address 192.168.

0:26:09.700000 --> 0:26:15.480000
 153.150. For responding with messages,
 which means this is the target

0:26:15.480000 --> 0:26:20.780000
 system. And the attacker is using
 or has the following IP.

0:26:20.780000 --> 0:26:24.000000
 And this is all through port 6666.

0:26:24.000000 --> 0:26:26.240000
 So you can actually see
 that consistently.

0:26:26.240000 --> 0:26:37.220000
 That the attacker has connected
 to 192.168.153.154 on port 6666.

0:26:37.220000 --> 0:26:41.940000
 You know, using netcat
 as we identified there.

0:26:41.940000 --> 0:26:44.860000
 And based on what we did.

0:26:44.860000 --> 0:26:49.100000
 So if we go and say follow TCP stream.

0:26:49.100000 --> 0:26:50.660000
 Let's see what they did.

0:26:50.660000 --> 0:26:57.500000
 So CD users. They created a new user
 called manager with a password.

0:26:57.500000 --> 0:27:00.880000
 This one here. That was
 completed successfully.

0:27:00.880000 --> 0:27:03.360000
 They then added the new user.

0:27:03.360000 --> 0:27:07.380000
 Called manager to the local
 administrators group.

0:27:07.380000 --> 0:27:08.680000
 And that's what they did.

0:27:08.680000 --> 0:27:12.080000
 So again, this is a classic example of.

0:27:12.080000 --> 0:27:17.920000
 You know, what you'd be dealing with
 in the context of instant response,

0:27:17.920000 --> 0:27:20.420000
 you know, detection and
 analysis specifically.

0:27:20.420000 --> 0:27:23.300000
 But more so network based analysis.

0:27:23.300000 --> 0:27:29.340000
 So yeah, this is a pretty indicative
 that something bad is or something

0:27:29.340000 --> 0:27:30.580000
 malicious has happened.

0:27:30.580000 --> 0:27:33.400000
 And now we have the endpoint
 that we need to investigate.

0:27:33.400000 --> 0:27:37.680000
 Or we should investigate or I should
 say isolate in this particular case.

0:27:37.680000 --> 0:27:40.300000
 Because yeah, it looks like.

0:27:40.300000 --> 0:27:46.300000
 In this case, not really a C2, but it's
 being facilitated by netcat through

0:27:46.300000 --> 0:27:47.600000
 a reverse shell.

0:27:47.600000 --> 0:27:51.820000
 So yeah, I think that's pretty
 much it for the tasks.

0:27:51.820000 --> 0:27:54.080000
 Definitely go through the tasks yourself.


0:27:54.080000 --> 0:27:58.700000
 The solutions to the tasks have been
 outlined in the solutions tab of

0:27:58.700000 --> 0:28:04.120000
 this lab. Or with that being said, that
 brings us to the end of the practical

0:28:04.120000 --> 0:28:06.900000
 demonstration section of this video.

0:28:06.900000 --> 0:28:12.540000
 All right, so that was the process
 of investigating network attacks in

0:28:12.540000 --> 0:28:18.680000
 the form of that illuminating.

0:28:18.680000 --> 0:28:23.160000
 And with that being said, that brings
 us to the end of this video.

0:28:23.160000 --> 0:28:25.400000
 And I'll be seeing you in the next video.