Scenario

After compromising a Linux server within the environment, the threat actor was able to pivot deeper into the network and ultimately gain access to the domain controller. From there, they deployed ransomware across the Wowza Enterprise infrastructure, resulting in widespread system outages and the loss of all recoverable backups. Fortunately, network traffic from the first day of the intrusion, specifically communications between the compromised Linux host and the domain controller, was captured and preserved. Your task is to analyze this evidence to determine how the breach occurred, identify the attacker's actions and access path, and provide clear, actionable lessons learned for the organization to strengthen its security posture and prevent similar incidents in the future.

Note: every timestamp answer in this lab is UTC. The capture carries no timezone hint, so Wireshark renders packets in your own local time and a wrong offset is invisible because the times still look plausible. Set View > Time Display Format > UTC Date and Time of Day before you begin.

Q1: To begin the investigation, we need to identify the target Active Directory environment that was compromised during this intrusion. What is the domain that was attacked by the threat actor?

What do we need to know?

Before anything else you need to scope the incident, and that starts with naming the environment under attack.

Two protocols in this capture announce the domain without being asked. Kerberos carries a realm field in every AS-REQ and TGS-REQ. Realms are conventionally the DNS domain name in uppercase, so the realm string is effectively the domain name. NTLM over SMB carries a domain name too, inside the NTLMSSP_AUTH message of a session setup.

Because the two are populated by completely different mechanisms, agreeing on the same value gives you a cross-check rather than a single point of failure.

How to do that?

1. Apply a display filter that isolates Ke…