Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involv

Analyzing Network Traffic for Incidents When to Use SIEM alerts on anomalous network traffic patterns requiring deeper investigation C2 beaconing is suspected and needs confirmation through packet level analysis Data exfiltration volume or destination must be quantified from network evidence Lateral movement between systems needs to be traced through network connections An IDS/IPS alert requires packet level validation to confirm or dismiss Do not use for host based forensic analysis (process execution, file system artifacts); use endpoint forensics tools instead. Prerequisites Full packet capture (PCAP) infrastructure or on demand capture capability (network tap, SPAN port) Wireshark installed on the analysis workstation with appropriate display filters knowledge Zeek (formerly Bro) deployed for network metadata generation (conn.log, dns.log, http.log, ssl.log) NetFlow/IPFIX collection from network devices for traffic flow analysis Network architecture diagram showing VLAN layout, firewall placement, and monitoring points Threat intelligence feeds for correlating observed network indicators Workflow Step 1: Capture or Acquire Network Traffic Obtain the relevant traffic data for the investigation: Live Capture (if incident is active): From Existing Infrastructure: Export PCAP from full packet capture appliance (Arkime/Moloch, ExtraHop, Corelight) Pull Zeek logs from the Zeek cluster for the investigation timeframe Export NetFlow data from network devices for high level traffic analysis Step 2: Identify C2 Communications Detect command and control traffic patterns: Beaconing Detection (Zeek conn.log): Wireshark Beacon Analysis: Beaconing characteristics to identify: Regular time intervals between connections (e.g., every 60 seconds with 10 15% jitter) Consistent packet sizes in requests and responses HTTPS to external IPs not associated with legitimate CDNs or services DNS queries with high entropy subdomains (DNS tunneling indicator) Step 3: Analyze Lateral Movement Traffic Trace adversary movement between internal systems: Wireshark Filters for Lateral Movement: Step 4: Detect Data Exfiltration Identify unauthorized data transfers leaving the network: Wireshark Exfiltration Filters: Step 5: Extract and Correlate IOCs Pull network based indicators from traffic analysis: External IP addresses contacted by compromised hosts Domains resolved via DNS during the incident timeframe URLs accessed via HTTP/HTTPS (if SSL inspection is in place) TLS certificate details (subject, issuer, serial number, JA3/JA3S hashes) User Agent strings from HTTP requests File transfers captured in PCAP (extract using Wireshark Export Objects) Step 6: Document Network Forensic Findings Compile analysis into a structured report with evidence references: Reference specific PCAP files, frame numbers, and timestamps for each finding Include packet captures of key evidence as screenshots or exported PDFs Map network activity to the incident timeline Correlate network findings with host based evidence from endpoint forensics Key Concepts Term Definition PCAP (Packet Capture) File format storing raw network packets captured from a network interface for offline analysis Beaconing Regular, periodic network connections from a compromised host to a C2 server, identifiable by consistent timing intervals JA3/JA3S TLS client and server fingerprinting method based on the ClientHello and ServerHello parameters; unique per application NetFlow/IPFIX Network traffic metadata (source, destination, ports, bytes, duration) collected by routers and switches without full packet capture DNS Tunneling Technique encoding data in DNS queries and responses to exfiltrate data or maintain C2 through DNS protocol Network Tap Hardware device that creates an exact copy of network traffic for monitoring without impacting network performance Zeek Logs Structured metadata logs generated by the Zeek network analysis framework covering connections, DNS, HTTP, SSL, and more Tools & Systems Wireshark : Open source packet analyzer for deep inspection of network protocols at the packet level Zeek (formerly Bro) : Network analysis framework generating structured metadata logs from live or captured traffic Arkime (formerly Moloch) : Open source full packet capture and search platform for large scale network forensics NetworkMiner : Network forensic analysis tool for extracting files, images, and credentials from PCAP files RITA (Real Intelligence Threat Analytics) : Open source beacon detection and DNS tunneling analysis tool for Zeek logs Common Scenarios Scenario: Confirming C2 Beaconing and Quantifying Exfiltration Context : EDR detects a suspicious process on a workstation but cannot determine the volume of data exfiltrated. Network team provides PCAP from the full packet capture appliance covering the incident timeframe. Approach : 1. Filter PCAP to traffic from the compromised host IP to external destinations 2. Identify the C2 channel by analyzing connection timing patterns (beacon detection) 3. Extract TLS certificate and JA3 hash from the C2 connection for IOC generation 4. Calculate total bytes transferred to C2 infrastructure over the incident duration 5. Check for additional exfiltration channels (DNS tunneling, cloud storage uploads) 6. Extract any unencrypted files transferred using Wireshark Export Objects feature Pitfalls : Analyzing only HTTP traffic when C2 is operating over HTTPS without SSL inspection Missing DNS tunneling because the data volume per query is small (but total over time is significant) Not correlating network timestamps with endpoint timestamps (timezone mismatches) Overlooking legitimate cloud services abused for exfiltration (OneDrive, Google Drive, Dropbox) Output Format

analyzing-network-traffic-for-incidents