Lab Guide

Task 1.1 — First-pass protocol breakdown

Below is a tcpdump capture in human-readable format. Produce:

1. Protocol breakdown: count of packets per protocol (TCP, UDP,
   ICMP, ARP, DNS, HTTP, HTTPS, etc.).
2. Top 10 source-destination IP pairs by packet count.
3. List every unique destination port seen and identify the
   probable service (use IANA assignments + common red team ports).
4. Any "interesting" combinations:
   - Outbound traffic to unusual countries/ASNs (you can guess by IP)
   - Connections to non-standard high ports
   - ICMP volumes that suggest tunneling
   - ARP storms or spoofing patterns
5. The single most suspicious flow and why.

[paste tcpdump-capture.txt]

✓ Self-check: You should have a one-paragraph summary of "what is normal" and "what is not" within 5 minutes of analysis.

Task 1.2 — Build the BPF filters you would use next

Continuing in the same conversation, ask:

"Based on the suspicious flows above, write 5 BPF filters I would use against a live capture to (a) capture only that traffic, and (b) explicitly exclude noise. For each filter, explain in one sentence what it isolates."

This is how the AI converts analysis into action.

Task 2.1 — Find the tunnel

Below is a DNS query log. Identify:

1. Normal DNS activity baseline (top legitimate queried domains,
   typical query types, query rate).
2. Any DGA (domain generation algorithm) patterns — long, random,
   alphanumeric subdomains.
3. Any DNS tunneling indicators:
   - Subdomains that look like base32/base64 encoded data
   - High query rate to a single second-level domain
   - TXT, NULL, or unusual record types being queried
   - Very long query names (>50 chars)
4. Any DNS-over-HTTPS bypass attempts.
5. Internal hosts that are talking to suspicious external resolvers.
6. Decode any base32/base64 subdomain content if possible.

For each finding, give:
- Source IP
- Destination domain
- Query rate or count
- What the attacker is likely doing
- A defender detection rule (Sigma or Suricata syntax)

[paste dns-queries.txt]

✓ Self-check: If the data contains base64-encoded exfiltration, the AI should decode it for you. Verify the decoded content makes sense (it should look like commands or data, not random bytes).

Task 3.1 — Find the credential leak and the C2 channel

Below is a series of HTTP request/response pairs. Analyze
them as a red team operator. Identify:

1. Any credentials transmitted in cleartext (Basic auth, form
   POSTs, query parameters, custom headers).
2. Any session tokens or cookies that could be reused.
3. Any uploaded files (look for multipart/form-data, large POSTs).
4. Any "beacon" pattern: same client polling the same URL on a
   regular interval (e.g., every 60 seconds with the same POST body
   shape).
5. Any unusual HTTP methods (PUT, DELETE, PROPFIND, PATCH).
6. Any User-Agent values that suggest tooling (curl, python,
   Cobalt Strike, Sliver, Empire, custom strings).
7. Any data exfiltration indicators (large outbound POSTs to
   unusual destinations).

For the highest-value finding, write a one-paragraph
"how to reproduce" that an attacker could use, and a Sigma
detection rule a defender could deploy.

[paste http-sessions.txt]

✓ Self-check: HTTP captures usually contain at least one credential. You should have at least one usable credential or session token by the end of this exercise.

Task 4.1 — Hunt the beacon

Below is NetFlow data (src_ip, dst_ip, src_port, dst_port,
proto, bytes, packets, start, end). Analyze for:

1. Beaconing: any (src,dst,port) tuple that has a regular interval
   between flows (e.g., one connection every 60 ± 5 seconds).
   Calculate the jitter percentage. Real malware uses jitter to
   evade detection — under 30% jitter is suspicious.
2. Long-lived connections that may indicate interactive C2 or
   reverse shells.
3. Asymmetric data transfer ratios (lots of bytes one direction,
   few the other).
4. "Low and slow" exfiltration: small flows summing to large
   total bytes over hours.
5. Connections to known bad ports (common C2: 4444, 8080, 8443,
   1337, 31337, also legitimate-looking 443/80).
6. Internal lateral-movement flows (RDP/SMB/WinRM/SSH between
   hosts that should not be talking).

Output a ranked list of suspicious flows with:
- IP pair
- Port
- Periodicity / jitter
- Total bytes
- Verdict (likely C2, exfil, lateral, benign)

[paste netflow-data.txt]

✓ Self-check: You should be able to point to one specific beacon and say "this is the C2, the interval is X, the jitter is Y%."

Task 5.1 — Cross-source correlation

In a fresh AI conversation, paste the outputs of Exercises 1–4 and ask:

Here are four analyses of four traffic captures from the same
10-minute window. Reconstruct the full attack:

1. Initial access (where, when, how).
2. Command-and-control channel (protocol, beacon interval, C2 IP).
3. Lateral movement (which internal hosts, which protocol).
4. Data exfiltration (channel, volume, destination).
5. The compromised host(s) and the attacker IP(s).

Then produce TWO outputs:
- Red team perspective: "what to do next to maintain access without
  the patterns we just used"
- Blue team perspective: "5 detection rules that would have caught
  this earlier in the kill chain"

Format as markdown, max 1000 words.

✓ Self-check: Your final report should connect at least 3 of the 4 sources. If it can't, go back and ask the AI which finding from each source supports the same conclusion — that's how you build evidence chains.