Unit 12: Capstone: investigate an incident · Lesson 4 of 5 · 24 min
Scope the loss and write the finding
Measure the final upload, assemble the timeline and write a finding the response team can act on.
mission
- You are
- The incident analyst writing the report.
- Situation
- The response team is waiting for your write-up before they isolate the laptop and reset credentials.
- Goal
- Measure what left the network, then write the finding with times, evidence and actions.
- Hand in
- The upload size and a short written finding.
Weighing what leaves
Find the odd session
There are 22 TCP sessions with the outside server. Keep only those where the laptop sent kilobytes rather than bytes: the -> size unit is the ninth column.
tshark -r incident.pcap -q -z conv,tcp,ip.addr==203.0.113.99 | grep -c '<->' 22 tshark -r incident.pcap -q -z conv,tcp,ip.addr==203.0.113.99 | awk '$2=="<->" && $9=="kB"' 10.10.0.44:50773 <-> 203.0.113.99:443 9 3341 bytes 466 665 kB 475 668 kB 720.000000000 0.1174
you should see One session sent 665 kB. Each check-in sends 754 bytes.
Time the upload
Relative time 720 seconds after 13:01:10 is 13:13:10. Confirm it from the Client Hello.
tshark -r incident.pcap -Y 'tls.handshake.extensions_server_name=="telemetry.invoice-portal.example.net"' -T fields -e frame.time_utc | tail -n 1
Oct 14, 2026 13:13:10.002800000 UTC
Two ways to report it
laptop-mchen got malware from a zip and sent data out, see capture
No times, no evidence, no actions.
13:02:10 10.10.0.44 resolves invoice-portal.example.net (203.0.113.99) 13:02:10 downloads invoice_1014.zip over HTTP, sha256 d165004f...b055 13:03:00 TLS check-ins every 30 s to telemetry.invoice-portal.example.net 13:09:10 probes 5 servers on 22, 445, 3389; SSH answers on web01, db01 13:13:10 uploads 665 kB to 203.0.113.99 actions: isolate 10.10.0.44; block invoice-portal.example.net and 203.0.113.99; check SSH logs on web01 and db01 from 13:09; reset mchen's credentials; find the email that linked the zip
Each line maps to a filter anyone can rerun.
Write your finding
Use the right-hand template above with your own commands next to each line. Keep it to one screen.
you should see Five timeline lines, the evidence for each and five actions.
defender tip State what you saw, not what you assume. You saw SSH answer; you did not see a login. Say so, and ask for the server logs that would show it.
List everything the laptop touched
Scope is every system the compromised host spoke to. Each one needs a check.
tshark -r incident.pcap -Y 'ip.src==10.10.0.44' -T fields -e ip.dst | sort -u
10.20.0.11
10.20.0.12
10.20.0.25
10.20.0.40
10.20.0.53
203.0.113.99
you should see Five internal servers and one outside address.
What a defender takes away
- 1Size the loss from bytes out, even when the content is encrypted.
- 2A timeline with times, evidence and actions is the deliverable.
- 3Separate what the network shows from what still needs host evidence.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.