Log huntUnit 3 · Topic 3.5
Find the indicators of compromise in a network log
Find the indicators of compromise in a network log.
New to this? Read the topic first: 3.5 Detecting Network Attacks.
Simulation · [3.5.E.6, 3.5.E.7]
Log hunt: find the indicators of compromise in a network log
The school has listed 203.0.113.0/24 as known malicious. The web server is 10.0.1.10. Administrators work from 10.0.3.0/24 and students from 10.0.2.0/24. Ports: 443 is Hypertext Transfer Protocol Secure (HTTPS) and 22 is secure shell (SSH); hypertext transfer protocol (HTTP) is unencrypted web traffic and TCP is the transmission control protocol. Tap every line that is an indicator of compromise. There are 4.
-
Fine. A student laptop loading the school website over HTTPS on port 443. Normal.
-
Red flag. A connection to a known malicious IP address. That laptop may be infected and calling out.
-
Red flag. One device probing hundreds of ports across a whole subnet: an unauthorized network scan.
-
Fine. Remote login from the admin subnet on port 22, the right port for secure shell. Expected.
-
Red flag. Mismatched port and application: web traffic on port 22, which belongs to secure shell.
-
Red flag. A sudden flood of internet control message protocol (ICMP) requests sent to the broadcast address 10.0.2.255: the sign of a smurf attack.
-
Fine. Normal again.
Go to the topic: 3.5 Detecting Network Attacks