Module 6: Network Detection & Forensics

Attacks cross the network. Catch them and dissect them.

8 lessons · 7 labs

Suricata + EveBoxWireshark / tshark
Operation APT Breach

See the same C2 callback (update-service.darknet.example) that Wazuh detected, now from Suricata's network view.

Path

  1. 01
    Lesson

    What NIDS Sees

    Sensor placement, network visibility, protocol metadata, where NIDS fits in defense-in-depth

  2. 02
    Lab

    Lab 6.1 — Network Alert Triage

    Categorize 25+ Suricata alerts across 5 categories: scan/recon, exploit, C2, DNS anomaly, policy violation. Escalate the 5 most critical.

  3. 03
    Lesson

    Suricata Rules & EveBox

    Rule anatomy (action, header, options), severity categories, navigating alerts in EveBox

  4. 04
    Lab

    Lab 6.2 — Read a Suricata Rule

    Analyze a C2 detection rule keyword-by-keyword, find the matching alert in EveBox, then modify the rule to catch a second C2 pattern.

  5. 05
    Lesson

    Protocol Analysis: HTTP, TLS & SMB

    Normal vs suspicious traffic patterns, User-Agents, JA3 fingerprints, SMB lateral movement indicators

  6. 06
    Lesson

    DNS as a Weapon

    DNS tunneling, DGA domains, DNS over HTTPS, entropy analysis

  7. 07
    Lab

    Lab 6.3 — Suspicious DNS

    Hunt DNS tunneling, DGA domains, and suspicious TLDs in EveBox. Calculate subdomain entropy and explain why each domain is suspicious.

  8. 08
    Lesson

    Network + SIEM Correlation

    Same attack from two perspectives — correlating network and endpoint alerts into a unified timeline

  9. 09
    Lab

    Lab 6.4 — Two Views, One Attack

    The same attack generates both Suricata network alerts and Wazuh endpoint alerts. Correlate them by timestamp, IP, and hostname into a unified kill-chain timeline.

  10. 10
    Lesson

    PCAP Analysis with Wireshark

    Wireshark fundamentals, display filters, following TCP streams, protocol hierarchy, hands-on PCAP analysis

  11. 11
    Lab

    Lab 6.5 — PCAP Analysis with Wireshark

    Open a PCAP in Wireshark/tshark. Follow TCP streams, extract HTTP objects, identify C2 beacons, and build a network forensic timeline.

  12. 12
    Lesson

    Network Forensics: File Extraction & C2 Detection

    Extracting files from PCAPs, identifying C2 beacon patterns, DNS forensics, building network forensic timelines

  13. 13
    Lab

    Lab 6.6 — Network Forensics Challenge

    Given a PCAP from a compromised network: extract exfiltrated files, identify the C2 channel, calculate beacon intervals, and map the full attack chain.

  14. 14
    Lesson

    tcpdump: The Command-Line Packet Analyzer

    CLI packet capture when no GUI is available — BPF filters, reading output, common one-liners, writing PCAPs for Wireshark

  15. 15
    Lab

    Lab 6.7 — tcpdump Capture Challenge

    Use tcpdump to capture DNS traffic, isolate a suspicious IP, extract HTTP requests, and identify a C2 beacon from raw packet output.