This lab simulates a scenario where a Windows VM is infected by an Exploitation Kit (EK). You'll be acting as a security blue team member and analyzing a PCAP file to investigate the attack further.

What you'll learn:

*   How to identify the infected machine based on network traffic.

*   Analyze the infection chain, including compromised websites and Exploit Kit servers.

*   Extract details like malicious script URLs and potential exploit file hashes.

*   Identify the exploited vulnerability (CVE).

*   Understand the role of redirect URLs in exploit kit attacks.

Tools:

This lab allows you flexibility to use your preferred tool. Here are some options mentioned:

  *   Wireshark

  *    Zui/Brim

  *   NetworkMiner 

Challenge Questions:

The lab provides ten challenge questions that will guide you through the investigation. Each question includes a detailed walkthrough explaining how to find the answer using the PCAP file and your chosen tool.

Here's a sneak peek at the questions you'll be tackling:

  *   Identifying the Infected Machine: You'll learn how to pinpoint the IP address of the compromised Windows VM by analyzing traffic  patterns, focusing on Windows-specific protocols and ICMP traffic.

  *   Tracing the Infection Chain: We'll walk you through identifying compromised websites and servers involved in delivering the exploit kit  and malware payload, analyzing HTTP traffic and DNS queries.

  *   Exploit Kit and Malware Delivery: You'll investigate the IP address and port used for delivering the exploit kit and malware, focusing  on non-standard port HTTP connections.

  *   Identifying Malicious URLs and Files: You'll learn how to extract FQDNs associated with the exploit kit, the compromised website's  FQDN, the redirect URL to the exploit kit landing page, and extract the malware payload for MD5 hash calculation.

  *   Exploit Kit Identification: You'll identify the name of the exploit kit used in the att…