Warzone 2
You received another IDS/IPS alert. Time to triage the alert to determine if its a true positive.
Another day, another alert.
Start Machine
You work as a Tier 1 Security Analyst L1 for a Managed Security Service Provider (MSSP). Again, you're tasked with monitoring network alerts.
An alert triggered: Misc activity, A Network Trojan Was Detected, and Potential Corporate Privacy Violation.
The case was assigned to you. Inspect the PCAP and retrieve the artifacts to confirm this alert is a true positive.
Your tools:
Deploy the machine attached to this task; it will be visible in the split-screen view once it is ready.
If you don't see a virtual machine load then click the Show Split View button.
Answer the questions below
What was the alert signature for A Network Trojan was Detected?
ET MALWARE Likely Evil EXE download from MSXMLHTTP non-exe extension M2
What was the alert signature for Potential Corporate Privacy Violation?
ET POLICY PE EXE or DLL Windows file download HTTP
What was the IP to trigger either alert? Enter your answer in a defanged format.
Cyberchef can defang.
Provide the full URI for the malicious downloaded file. In your answer, defang the URI.
Cyberchef can defang.
What is the name of the payload within the cab file?
Extract the file from PCAP, get the hash, then hop to VirusTotal
draw.dll
What is the user-agent associated with this network traffic?
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; .NET4.0C; .NET4.0E)
Check the Misc Activity alert in Brim. Cyberchef can defang.
There are IP addresses flagged as Not Suspicious Traffic. What are the IP addresses? Enter your answer in numerical order and defanged. (format: IPADDR,IPADDR)
Brim, Network Miner, or Wireshark
[[Warzone 1]]
Last updated
Was this helpful?