The PCAP provided for this analysis is from the ‘edge sensor’ located on the victim network. Packet Capture (PCAP) files are tremendous resources for investigations when they are available.These small slices of PCAP typically do not tell the complete story.

To Log Analysis: Malicious IP Addresses, Malicious Filenames.

From Log Analysis: Malicious IP Addresses, Malicious Filenames.

To Memory Analysis: Malicious IP Addresses, Malicious Filenames.

From Memory Analysis: Malicious IP Addresses, Malicious Filenames.To Disk Analysis: Malicious IP Addresses, Malicious Filenames.From Disk Analysis: Malicious IP Addresses, Malicious Filenames.A great piece of software to take Screen Shots is Greenshot.A great note keeping App that teams can use to coordinate is OneNote.The reader should quickly understand what they’re looking at Examples: Highlights, Boxes, Arrows Text.Notes should be accompanied by screenshots that tell a story.Understand your own thinking later… or after sleep.This is for team mates to understand your thinking.Keep solid notes on your thinking around evidence and data that you find.

How data reduction aids in investigations.

How to pivot into and away from PCAP Analysis (how to use findings for quicker analysis).

Understand the advantages and goals of PCAP Analysis.

Pcap analysis