Security Operations

profileMister_Security
SecOpsweek4lesson2-MaliciousTrafficAnalysiscasestudies.pptx
Home>Computer Science homework help>Security Operations

Cyber Security operations - malicious traffic analyis case study

Tutorial: HTTPS traffic

2

The capture

casestudy_https.pcap

The log: containing encryption key data

casestudy_https_log

Tutorial: Trickbot infection

3

The capture

Casestudy_trickbot.pcap

Exercise

4

The capture

CaseStudyExerciseAgentTesla.pcap

The alerts

CaseStudyExerciseAgentTesla.jpg

Answer the following questions:

What do you know about the victim?

IP address, Host name, Domain name, user account

Which file has been downloaded? How?

What data has been stolen?

Email protection

SPF – Sender Policy Framework: Checking if the sending IP address matches the ones mentioned in the Domain Name System (DNS) 

DKIM – Domain Keys Identified Mail: Checking a message's cryptographic key, securing that the proposed sender actually sent the email

DMARC – Domain-based Message Authentication, Reporting and Conformance: Making sure that emails that do not pass the SPF and/or DKIM test get eliminated

5

Demo: email header analysis

7

Dear Sir/Madam,

my name is Joseph Camarah Vieira, i  am from Guinea Bissau, my late father was the former minister of mines in my country Guinea Bissau, he was short dead by the rebels in my country, before his death he deposited $60 million Dollars with Global Trust Security Company Accra Ghana, i want you to help me receive this money in your country for investment in your country i will give you 30% of the total sum when the funds arrive your country.

 

Regards.

Mr Joseph Camarah Vieira

00233 244 617 863

my email:[email protected]

EmailHeaderAnalysis.docx

Threat analysis assignment: 4 cases

8