This traffic analysis exercise, titled "NATUREFORCE," provides security analysts with a scenario to investigate a potential malware infection within a Windows enterprise environment. The challenge begins with SOC alerts identifying a Windows executable (EXE) download from an unusual TCP port and command-and-control (C2) communication associated with the CNCmachineRMS RAT.
Participants are tasked with analyzing a provided packet capture (PCAP) to extract critical forensic details. This includes identifying the infected host's IP and MAC addresses, the system hostname, the affected user account, and calculating the SHA-256 hash of the malicious file downloaded during the incident.
Top comments (0)