Skip to content

Latest commit

 

History

History
83 lines (49 loc) · 3.21 KB

Project-2-detecting-and-investigating-malware-traffic.md

File metadata and controls

83 lines (49 loc) · 3.21 KB

Detecting and Investigating Malware Traffic

Introduction

In this project, you'll learn how to use Wireshark to detect and investigate malware traffic. Identifying malicious network behavior is crucial for protecting networks and responding to security incidents.

Pre-requisites

  • Basic understanding of networking concepts
  • Wireshark installed on your computer
  • A sample PCAP file containing malware traffic (e.g., from Malware Traffic Analysis)

Lab Set-up and Tools

  1. Wireshark: Download and install Wireshark from https://www.wireshark.org/download.html.
  2. Sample PCAP File: Download a sample PCAP file containing malware traffic for analysis.

Exercises

Exercise 1: Load a Sample PCAP File

Steps

  1. Open Wireshark.
  2. Go to "File" > "Open" and select the sample PCAP file you downloaded.
  3. The file will load, and the captured traffic will be displayed.

Expected Output

  • The sample PCAP file containing network traffic loaded in Wireshark.

Exercise 2: Identify Malicious Traffic Patterns

Steps

  1. Look for unusual patterns in the traffic, such as repeated connections to suspicious IP addresses, unusual protocols, or large amounts of data being transferred.
  2. Use the filter bar to isolate suspicious traffic. Common filters include:
    • ip.addr == x.x.x.x (replace x.x.x.x with a suspicious IP address)
    • tcp.port == 4444 (common port used by malware)
    • http.request (to view HTTP requests that might indicate command-and-control activity)

Expected Output

  • Suspicious traffic patterns identified in the network capture.

Exercise 3: Analyze Malicious Traffic

Steps

  1. Select a packet that appears suspicious based on your initial analysis.
  2. Click on the packet to view its details in the packet details pane.
  3. Expand the relevant protocol sections to examine the details of the packet, such as headers, payload data, and any anomalies.

Expected Output

  • Detailed information about a suspicious packet analyzed.

Exercise 4: Follow the Malware's Communication Stream

Steps

  1. Right-click on a suspicious packet and select "Follow" > "TCP Stream" or "UDP Stream" to view the entire conversation.
  2. Analyze the conversation for indicators of malicious activity, such as unusual commands, encoded data, or unexpected file transfers.

Expected Output

  • A complete communication stream of the malware analyzed.

Exercise 5: Document and Report Findings

Steps

  1. Take notes on the suspicious activities and patterns you identified in the traffic.
  2. Document key findings, including IP addresses, ports, payload data, and any other relevant details.
  3. Summarize your findings in a report format, which can be used for further investigation or as part of a security incident report.

Expected Output

  • A detailed report documenting the findings from your malware traffic analysis.

Conclusion

By completing these exercises, you have learned how to detect and investigate malware traffic using Wireshark. These skills are essential for identifying malicious network behavior, responding to security incidents, and protecting network infrastructure.