Reference no: EM132225728 , Length: word count:2200
Assignment -
Complete the Wireshark Column Display Exercise and provide a screen shot of your re-configured Wireshark user interface.
Complete a 3-5 page reflection (double spaced) for Situation 1 and a 3-5 page reflection (double spaced) for Situation 2. Given these sample incident reports, write about what you learned, what you have questions about, what you researched as part of this review, and anything else you feel is relevant.
Project will begin by introducing you to the process of malware traffic analysis. Review the following situations utilizing Wireshark:
1. Situation: Traffic Analysis Exercise
Download this PCAP source file
Review the sample analysis discussing these questions:
- What was the date and time of the infection?
- What is the MAC address of the infected Windows computer?
- What is the IP address of the infected Windows computer?
- What is the host name of the infected Windows computer?
- What type of malware was the computer infected with?
- What is the name of the malware that infected the user's computer?
- What exploit kit was used to infect the user's computer?
- What compromised website kicked off the infection chain of events?
- Before the Windows computer was infected, what did the user search for on Bing?
- Which campaign(s) used the exploit kit noted in the pcap?
- What are the indicators of compromise (I0Cs) from the pcap?
2. Situation: Co-worker Suffers from March Madness
You work as an analyst at a Security Operations Center (SOC) for Pollerman's Pharmaceuticals, a regional pharmaceutical conglomerate. You work the same shift as another analyst named Leonard.
Your relationship with Leonard is a lot like Jerry's relationship with Newman on episodes of Seinfeld. You find Leonard comically annoying.
Leonard was tasked to investigate some suspicious traffic, but he came down with a case of "March madness" and left the work undone. He called in sick, and now you have to pick up where he left off. He only saved traffic for the affected IP address in a pcap file.
Students Should:
Download this PCAP source file
Review the sample analysis discussing these questions:
- Date and time of the activity
- MAC address of the affected Windows computer
- IP address of the affected Windows computer
- Host name of the affected Windows computer
- What happened
Attachment:- Assignment Files.rar