| name | net-traffic-incdnt |
| description | Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
|
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["network-forensics","PCAP-analysis","Wireshark","Zeek","traffic-analysis"] |
| mitre_attack | ["T1071","T1095","T1573","T1572"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Analyzing Network Traffic for Incidents
When to Use
- SIEM alerts on anomalous network traffic patterns requiring deeper investigation
- C2 beaconing is suspected and needs confirmation through packet-level analysis
- Data exfiltration volume or destination must be quantified from network evidence
- Lateral movement between systems needs to be traced through network connections
- An IDS/IPS alert requires packet-level validation to confirm or dismiss
Do not use for host-based forensic analysis (process execution, file system artifacts); use endpoint forensics tools instead.
Prerequisites
- Full packet capture (PCAP) infrastructure or on-demand capture capability (network tap, SPAN port)
- Wireshark installed on the analysis workstation with appropriate display filters knowledge
- Zeek (formerly Bro) deployed for network metadata generation (conn.log, dns.log, http.log, ssl.log)
- NetFlow/IPFIX collection from network devices for traffic flow analysis
- Network architecture diagram showing VLAN layout, firewall placement, and monitoring points
- Threat intelligence feeds for correlating observed network indicators
Workflow
Step 1: Capture or Acquire Network Traffic
Obtain the relevant traffic data for the investigation:
Live Capture (if incident is active):
tcpdump -i eth0 -w capture.pcap host 10.1.5.42
tcpdump -i eth0 -w c2_traffic.pcap host 185.220.101.42
tcpdump -i eth0 -w capture_%Y%m%d%H%M.pcap -C 1000 -W 10
From Existing Infrastructure:
- Export PCAP from full packet capture appliance (Arkime/Moloch, ExtraHop, Corelight)
- Pull Zeek logs from the Zeek cluster for the investigation timeframe
- Export NetFlow data from network devices for high-level traffic analysis
Step 2: Identify C2 Communications
Detect command-and-control traffic patterns:
Beaconing Detection (Zeek conn.log):
cat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes \
| awk '$4 ~ /^185\.220/' | -t. -k1,1n -k2,2n
