Simulating and Detecting Windows

Powershell events

Lab Setup

Requirements:
 Systems: Windows 10/11 or Windows Server 2019/2022, Linux
(Ubuntu or CentOS)
 Tools:
o Windows Event Viewer
o PowerShell (Pre-installed on Windows)

Preparation:
For this lab, you will need to set up log collection on both Windows and
Linux systems. Follow these steps to ensure everything is ready:

On Windows:
1. Open Group Policy Editor (gpedit.msc):
o Navigate to Computer Configuration > Administrative Templates
> Windows Components > Windows PowerShell.
o Ensure that Module Logging, Script Block Logging,
and Script Execution are enabled.

2. Open Event Viewer:

o Go to Applications and Services Logs → Microsoft →

Windows → PowerShell → Operational.

Step 1: Simulate a Suspicious PowerShell Command

To simulate a suspicious activity, open an elevated PowerShell session
and run the following command:

Get-LocalUser | Select-Object Name, Enabled

This command lists all local user accounts on the system, which could be
used by attackers to enumerate users post-exploitation.

Step 2: Detect the Log in Windows Event Viewer

 1. Press Win + R, type eventvwr.msc, and press Enter.
2. Navigate to: Applications and Services Logs → Microsoft → Windows →
PowerShell → Operational.

3. Click Filter Current Log, and filter for Event ID 4104 (which logs
PowerShell script execution).

4. Look for an entry that shows the execution of the Get-LocalUser

command.

5. Take a screenshot of the event details.

Log Analysis Basics: Windows Security Logs

Objective:
The objective of this lab is to introduce students to Windows Security
Logs and help them understand how to analyze logs for security-related
events. Students will learn how to explore and analyze various security
logs such as login attempts, user account changes, and other critical
system events that could indicate potential security threats.

▶️Video Tutorial
Lab Setup

Requirements:
 System: Windows 10/11 or Windows Server 2019/2022
 Tools:
 o Windows Event Viewer (pre-installed)
o Notepad (to create custom events, if needed)
o Administrative Privileges (to access certain security logs)

What are Windows Security Logs?

Windows Security Logs contain records of security-related events on the
system, such as:

 Successful and Failed Login Attempts: Track users who log in or fail to
log in.
 Account Lockouts: Occurs when a user exceeds the maximum allowed
number of incorrect login attempts.
 Audit Policies: Logs related to changes in system audit settings and
configurations.
 Group Membership Changes: Tracks changes in group memberships
and user privileges.
 Privilege Escalation: Logs events when a user gains elevated privileges.

These logs are valuable for monitoring security incidents, detecting

unauthorized access, and auditing system changes.

Understanding Event IDs in Security Logs:

Some common Event IDs in Windows Security Logs that you will
encounter include:

 Event ID 4624: Successful Logon.

 Event ID 4625: Failed Logon.
 Event ID 4740: Account Lockout.
 Event ID 4732: A user was added to a security-enabled local group.
 Event ID 4672: Special privileges assigned to a new logon (Privilege
escalation).

Lab Task: Explore and Analyze Windows

Security Logs

Step 1: Simulate a Failed Login Attempt

 1. Create a test user name "haxuser1" on Windows machine.
2. Simulate a failed account access using this command
Open PowerShell and enter an invalid username and password. You can
do this by using the following command:

net use \\127.0.0.1\IPC$ /user:haxuser1 WrongPassword

Here:

Command Part Explanation

A command used to connect to shared resources (like network shares or

net use printers).

A special hidden administrative share called IPC$ on your local machine

\\127.0.0.1\
(127.0.0.1 = localhost). IPC$ is used for inter-process communication,
IPC$
especially for authentication purposes.

Specifies the username to use for authentication (in this

/user:haxuser1
case, haxuser1).

The password you're trying to authenticate with — which is

WrongPassword
intentionally incorrect.

Or Else you can sign out with your existing account and sign in
with haxuser1 account with an invalid password

Step 2: Detect the Log in Windows Event Viewer

1. In the Event Viewer, navigate to:
Windows Logs → Security
2. After the failed login, go back to Event Viewer.
3. Filter the Security Logs for Event ID 4625 (Failed Logon). 4.. Look for
entries that correspond to the failed login attempt.
4. Take a screenshot of the event details, including:
o Failed Login Attempt Details
o User Name
o Logon Type
o Source Network Address

Conclusion:
 Understanding Windows Security Logs: Windows Security Logs are
essential for identifying suspicious behavior such as unauthorized login
attempts, privilege escalation, and system configuration changes.
 SOC Analyst Role: As a SOC Analyst, reviewing and analyzing these logs
regularly is critical to detecting and responding to security incidents in
real-time.
  Threat Detection: By monitoring for multiple failed logins, account
lockouts, and privilege escalations, SOC Analysts can quickly detect
malicious activities on a network.

Submission:
 Event ID 4624 (Successful Login): Submit a screenshot showing a
successful login event from the Security logs.
 Event ID 4625 (Failed Login): Submit a screenshot showing a failed login
attempt event from the Security logs.

Log Analysis Basics: Windows PowerShell Logs

Objective:
The objective of this lab is to introduce students to Windows PowerShell
Logs and help them understand how to analyze PowerShell-related
events. Students will learn how to explore and analyze PowerShell logs to
detect suspicious or malicious PowerShell commands that could indicate
an attack or compromise.

▶️Video Tutorial
Lab Setup

Requirements:
 System: Windows 10/11 or Windows Server 2019/2022
 Tools:
 o Windows Event Viewer (pre-installed)
o PowerShell (Pre-installed on Windows)
o Administrative Privileges (required for enabling logs)

Preparation:
Before proceeding, make sure PowerShell script block logging is enabled
on your system:

1. Press Win + R, type gpedit.msc, and press Enter to open the Group Policy
Editor.
2. Navigate to: Computer Configuration > Administrative Templates >
Windows Components > Windows PowerShell
3. Turn on Module Logging, Script Block Logging, and Script
Execution.
4. Apply the settings and close the Group Policy Editor.

What are Windows PowerShell Logs?

PowerShell logs contain information about PowerShell script executions,
including details about the commands that were run, the processes that
invoked them, and the user who executed them. These logs can be used
to detect potential misuse of PowerShell, including post-exploitation
techniques often used by attackers.

Key PowerShell Logs to Monitor:

 Event ID 4104: Script block logging, capturing the PowerShell commands
executed.
 Event ID 4103: Command invocation with parameter binding (detailed
command execution).
 Event ID 4698: PowerShell Module Logging for the execution of specific
modules.
 Event ID 4101: Execution of PowerShell commands through command-
line arguments.

Lab Task: Explore and Analyze Windows

PowerShell Logs
Step 1: Generate PowerShell Logs
1. Open PowerShell as Administrator.
2. Run the following PowerShell command to generate a log entry:

Start-Process "notepad.exe" -ArgumentList "C:\Windows\System32\drivers\etc\

hosts"
This command

 Starts a new process using the Start-Process cmdlet.

 Specifies "notepad.exe" as the program to launch.
 Passes "C:\Windows\System32\drivers\etc\hosts" as an argument to
Notepad.
 As a result, Notepad opens the hosts file directly.

Step 2: Visualize the events

1. After running the command, go back to Event Viewer and navigate to:

Applications and Services Logs → Microsoft → Windows → PowerShell →

Operational

4. Look for Event ID 4103 in the logs (this will show script block logging for
the PowerShell command you executed).
5. Take a screenshot of the event details, including:

 PowerShell command that was executed

 User who ran the command
 Timestamp of the execution

Step 3: Why Is This Important for Blue Teams?

This log can be used to detect malicious PowerShell usage, such as:

 LOLBAS (Living Off The Land Binaries) like using Start-Process or Invoke-
WebRequest
 Loading payloads or obfuscated PowerShell commands
 Persistence via PowerShell commands in startup or tasks

Example of LOLBAS Tools These are legitimate Windows tools that

attackers often abuse for stealthy malicious actions.

🚩 Abuse
🛠️Tool 📌 Path
Technique

powershell. C:\Windows\System32\WindowsPowerShell\v1.0\ Execute

exe powershell.exe payloads,
download
 🚩 Abuse
🛠️Tool 📌 Path
Technique

malware,
bypass AV

Download
files
certutil.exe C:\Windows\System32\certutil.exe using: certut
il -
urlcache -
f

Execute
malicious
mshta.exe C:\Windows\System32\mshta.exe
HTML apps or
remote scripts

Load and
regsvr32.ex execute
C:\Windows\System32\regsvr32.exe
e remote/local
DLLs

Execute DLLs
rundll32.ex or scripts to
C:\Windows\System32\rundll32.exe
e evade
detection

Execute
commands,
wmic.exe C:\Windows\System32\wbem\wmic.exe
gather system
info

Download/
bitsadmin.e
C:\Windows\System32\bitsadmin.exe upload files
xe
silently

Execute
C:\Windows\Microsoft.NET\Framework\ malicious C#
msbuild.exe
v4.0.30319\msbuild.exe code in
project files

installutil.ex C:\Windows\Microsoft.NET\Framework\ Run code

e v4.0.30319\installutil.exe during .NET
assembly
 🚩 Abuse
🛠️Tool 📌 Path
Technique

install

Create
schtasks.ex scheduled
C:\Windows\System32\schtasks.exe
e tasks for
persistence

ℹ️For more: lolbas-project.github.io

Conclusion:
 PowerShell Logs: Key to spotting malicious command usage.
 SOC Analyst Role: Review logs to detect post-exploitation actions.
 Threat Detection: Flags abnormal activity for faster response.

Submission:
 Event ID 4103 (PowerShell Script Execution): Submit a screenshot showing
a PowerShell script execution event from the logs.

Log Analysis Basics – Network-Based Attack Detection

Using UFW

🎯 Objective
The objective of this lab is to simulate a network-based port scan
attack and demonstrate how to detect it using ufw.log logs on a Linux
system. Students will learn how to launch the HTTP scan prob from Kali
Linux(attacker) machine and detect these scan ataempt on Victim
machine using UFW.

▶️Video Tutorial
🛠️Lab Setup

System Requirements
 Attacker Machine:: Kali Linux
 Target Machine: Ubuntu Linux

Tools Needed
  nmap (on attacker machine)
 ufw or iptables (on target machine)

Log Files
 /var/log/ufw.log on Ubuntu Server– Captures system and network-related
messages

🧠 What is a Network Port Scan?

A port scan is a technique used by attackers to probe a system for open
ports and active services. Tools like nmap are commonly used to map a
system’s network surface.

Why It’s Dangerous

 Port scans are often a precursor to exploitation
 They help attackers identify vulnerable services like open SSH, FTP, or
outdated web servers

What is Nmap?
 Nmap (Network Mapper) is an open-source network scanning tool.
 Used to discover hosts and services on a network.
 Helps in identifying open ports, running services, and OS detection.
 Commonly used for network inventory and vulnerability scanning.

Nmap Popular Scan Types

 SYN Scan (-sS): Fast and stealthy port scan.
 TCP Connect Scan (-sT): Full TCP connection, less stealthy.
 UDP Scan (-sU): Scans UDP ports for services.
 Ping Scan (-sn): Checks which hosts are up, no port scan.

🔐 What is UFW?
 UFW stands for Uncomplicated Firewall, a frontend for iptables.
 Simplifies firewall management for Linux users.
  Used to allow, deny, and manage traffic rules easily.
 Logs are stored in /var/log/ufw.log.
 Rule file /etc/ufw/before.rules
 To check ufw status ufw status
 To check the rule number ufw status numbered

###🧾 UFW Rule Syntax

 Basic allow rule: ufw allow

 Deny a port: ufw deny
 Allow by service: ufw allow (e.g., ufw allow ssh)
 Allow by IP: ufw allow from
 Allow specific port from IP: ufw allow from to any port
 Delete rule: ufw delete allow

🧪 Lab Task: Explore and Analyze Linux

Syslog for Network Scans

⚔️Step 1: Attack Simulation – Perform a Port Scan

⚠️Only scan systems you own or are authorized to test.
On the Attacker Machine:

nmap -p80 TARGET-IP

🔍 Step 2: Detection and Analysis – Analyze Syslog

1. Installing UFW firewall
2. sudo apt install ufw
3. sudo ufw enable
4. sudo ufw logging on
5. sudo ufw logging high
6. Create a Firewall rule to drop HTTP traffic from Attack machine
7. sudo ufw deny from 69.62.84.69 to any port 80 proto tcp
8. Reload the firewall rules to take effect
9. sudo ufw reload
10.Detect the HTTP Scanning traffic
11. sudo tail -f /var/log/ufw.log | grep "Attcker IP"

✅ Conclusion
 ufw.log, combined with firewall logs, is powerful for detecting early-stage
reconnaissance
 Port scanning is often the first indicator of an attacker mapping your
system
  Detecting and blocking IPs performing scans is a crucial step in proactive
defense

📸 Submission
Submit a screenshot of a syslog entry showing blocked network traffic due
to a port scan. Include:

 Source IP of scan
 Targeted port
 Timestamp

Log Analysis Basics – Linux Auth Log

🎯 Objective
The objective of this lab is to simulate an SSH brute force attack and
demonstrate how to detect it using Linux authentication logs. Students
will learn how to identify multiple failed login attempts and analyze
patterns to uncover brute force activity.

▶️Video Tutorial
🛠️Lab Setup

System Requirements
 Attacker Machine: Kali Linux (or any Linux with hydra)
 Target Machine: Ubuntu Linux Server

Tools Needed
  hydra (on attacker machine)
 openssh-server (on target machine)
 rsyslog (default logging service)

Log Files
 /var/log/auth.log – Authentication logs (Ubuntu/Debian)
 /var/log/secure – (CentOS/RHEL)

📘 Preparation
Linux systems log every authentication event, including successful and
failed SSH login attempts. Brute force attacks can be identified by
analyzing patterns such as:

 Rapid failed logins from a single IP

 Attempts with multiple usernames
 Login successes after a string of failures

🧠 What is an SSH Brute Force Attack?

A brute force attack attempts to guess a user’s SSH password by trying
many combinations quickly using automated tools like Hydra.

Why It’s Dangerous

 Successful brute force = full shell access
 Attackers can pivot, install malware, or exfiltrate data
 It often goes unnoticed without proper log monitoring

🛡️Attack Patterns Detectable via Auth Logs

 Multiple failed password attempts from one IP
 Repeated login attempts to root/admin accounts
 Success after multiple failures (brute force success)
 Logins from unknown or foreign IPs
What is Hydra?
 Hydra is a fast, open-source password-cracking tool used for brute force
attacks on logins.
 It supports 50+ protocols like SSH, FTP, HTTP, SMB, and more.
 Common use: penetration testing and checking for weak passwords in
network services.
 Syntax: hydra -L users.txt -P passlist.txt <target_ip> <protocol>
 Use -l/-p for single username/password or -L/-P for files.
 Add -vV for verbose output and -t 4 to set number of threads.

🧪 Lab Task: Explore and Analyze Auth Logs

for SSH Brute Force

⚔️Step 1: Attack Simulation – Brute Force SSH using

Hydra
⚠️Only perform on authorized systems you own or control.
On the Attacker Machine:

hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://TARGET-IP

This will attempt multiple password guesses for user root on the SSH port.

Ensure SSH is enabled on the target:

sudo systemctl status ssh

🔍 Step 2: Detection and Analysis – Analyze Auth Logs

Check for failed login attempts:

sudo grep "Failed password" /var/log/auth.log

Find usernames tried:

sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-5)}' |

sort | uniq -c | sort -nr
Watch live log activity:

sudo tail -f /var/log/auth.log

🔍 What to Look For

 20+ failed attempts from the same IP in under 5 mins
  Attempts on sensitive users (root, admin)
 Sudden success after multiple failures

✅ Conclusion
 Auth logs are vital for detecting brute force login attempts
 Multiple failures from a single IP is a strong signal of attack
 Combine log analysis with tools like fail2ban to block repeat offenders
automatically

📸 Submission
Submit a screenshot showing:

 failed login entries from the same IP

 Username attempted

PowerShell for Security Analysts

1. Introduction to PowerShell
PowerShell is a powerful command-line shell and scripting language
developed by Microsoft, designed specifically for system administration. It
is built on the .NET framework and is widely used for automating tasks,
managing configurations, and performing administrative tasks on both
Windows and Linux systems.

Why Should Security Analysts Learn PowerShell?

 Automation and Efficiency: Automate repetitive tasks such as log
analysis, system audits, and security monitoring.
 Incident Response: Quickly collect forensic artifacts, investigate
suspicious activities, and respond to incidents.
 Threat Hunting: Identify anomalous behaviors by querying system
information and event logs.
 Red Teaming and Blue Teaming: Used by attackers for persistence and
lateral movement, making it crucial for defenders to understand its
capabilities.
2. Overview of Cmdlets, Scripts, and the
PowerShell Environment

2.1 Cmdlets
 Cmdlets (pronounced "command-lets") are the building blocks of
PowerShell. They are lightweight commands that perform specific
operations.
 Syntax: Verb-Noun (e.g., Get-Process, Set-Item, New-User)
 Example:
 Get-Process # Lists all running processes
 Get-Service # Displays all services on the system
Get-EventLog -LogName Security # Retrieves security event logs

2.2 Scripts
 Scripts are text files containing a series of PowerShell commands saved
with the .ps1 extension.
 They allow automation of complex tasks by executing multiple cmdlets in
sequence.
 Example Script (Get-SystemInfo.ps1):
 # Get System Information
 Get-ComputerInfo
 Get-Process | Where-Object {$_.CPU -gt 100} # High CPU usage
processes
Get-EventLog -LogName Security -Newest 10

2.3 The PowerShell Environment

 Console and ISE: PowerShell can be executed from the traditional
console or the Integrated Scripting Environment (ISE).
 Modules: Packages containing cmdlets, functions, variables, and other
resources.
 Pipeline (|): Used to pass output from one cmdlet as input to another.

Get-Process | Where-Object {$_.CPU -gt 50} | Select-Object

ProcessName, CPU

3. Understanding the Execution Policy

Execution Policy in PowerShell determines the conditions under which
PowerShell loads configuration files and runs scripts.

Types of Execution Policies

 1. Restricted: Default setting, allows no scripts to run.
2. AllSigned: Only scripts signed by a trusted publisher can be run.
3. RemoteSigned: Local scripts can run, but scripts downloaded from the
internet must be signed.
4. Unrestricted: Scripts are allowed to run without restrictions.
5. Bypass: No restrictions; used for automation.

Checking and Setting Execution Policy

Get-ExecutionPolicy # Check current execution policy
Set-ExecutionPolicy RemoteSigned # Set to RemoteSigned
###Best Practice for Security Analysts

 Always set the policy to RemoteSigned or AllSigned to prevent

unauthorized scripts from running.
 Use Bypass only in controlled environments, such as for incident response
scripts.

4. Use Cases for Security Analysts

4.1 Incident Response

 Collect logs and system artifacts for forensic analysis.

Get-EventLog -LogName Security -Newest 100 | Export-Csv C:\Logs\

SecurityLogs.csv

4.2 Threat Hunting

 Identify suspicious processes or unusual network activity.

Get-Process | Where-Object { $_.CPU -gt 80 }

Get-NetTCPConnection | Where-Object { $_.RemotePort -eq 4444 }

4.3 Vulnerability Assessment

 Check for missing security patches.

Get-HotFix | Where-Object { $_.InstalledOn -lt (Get-Date).AddMonths(-6) }

4.4 Security Audits and Compliance

 Audit user accounts and permissions.

Get-LocalUser
Get-LocalGroupMember -Group "Administrators"

4.5 Automation and Scripting

  Automate repetitive security tasks like log cleanup or system health
checks.

Get-EventLog -LogName Application -EntryType Error -Newest 50 | Out-File

C:\Logs\ErrorLogs.txt

5. PowerShell Basics

5.1 Basic Commands

Get-Help Get-Process # Display help for a cmdlet
Get-Command # List all available cmdlets
Get-Module # List all imported modules

5.2 Variables and Data Types

$Name = "Security Analyst"
$Number = 42
$Array = @(1, 2, 3, 4)

5.3 Loops and Conditionals

# If-Else Statement
$CPUUsage = Get-Process | Where-Object { $_.CPU -gt 80 }
If ($CPUUsage) {
Write-Host "High CPU Usage Detected"
} Else {
Write-Host "CPU Usage is Normal"
}

# ForEach Loop
$Processes = Get-Process
ForEach ($Process in $Processes) {
Write-Host $Process.ProcessName
}

5.4 Functions
Function Get-HighCPU {
Param($Threshold = 50)
Get-Process | Where-Object { $_.CPU -gt $Threshold }
}
Get-HighCPU -Threshold 80

6. PowerShell Command Cheatsheet for

Security Analysts

6.1 System Information

Get-ComputerInfo # System Information
Get-WmiObject Win32_OperatingSystem # Detailed OS Information

6.2 Process and Service Monitoring

Get-Process # List Running Processes
Get-Service # List Installed Services
Stop-Process -Name "notepad" # Stop a

6.3 Network Information

Get-NetAdapter # Network Adapter Information
Get-NetTCPConnection # Active Network Connections

6.4 Event Log Analysis

Get-EventLog -LogName Security -Newest 100
Get-WinEvent -LogName Application -MaxEvents 50

6.5 File and Directory Management

Get-ChildItem -Path C:\Logs -Recurse # List all files in a directory
Remove-Item -Path C:\Logs\*.log # Delete all log files

6.6 User and Permissions Auditing

Get-LocalUser # List all Local Users
Get-LocalGroup # List all Local Groups
Get-LocalGroupMember -Group "Admins" # List Admin Group Members

7. Summary
 PowerShell is a versatile and powerful tool for Security Analysts.
 Use cmdlets to perform system audits, incident response, and threat
hunting.
 Leverage scripts for automation of repetitive security tasks.
 Set execution policies securely (preferably RemoteSigned).
 Always review and understand scripts before execution to prevent
malicious activities.
 Continuously learn and update your PowerShell skills to stay ahead of
attackers.

Wireshark Basics – TLS Protocol Analysis

🎯 Objective
The objective of this lab is to help students analyze TLS (Transport
Layer Security) traffic using Wireshark. Students will explore how TLS
secures data over the network, understand handshake messages, and
identify metadata like server names and certificate details.

🛠️Lab Setup

System Requirements
 Operating System: Windows 10/11 (or Linux/macOS)
 Software: Wireshark (latest version)

Files Needed
 Download Sample PCAP file

📘 TLS Packet Structure and Fields

TLS is a cryptographic protocol that provides secure communication
over the internet. It runs over TCP, commonly on port 443, and is used in
HTTPS, FTPS, SMTPS, etc.

Key TLS Handshake Messages:

Message
Description
Type

Client Hello Client initiates secure connection, offers cipher suites

Server Hello Server selects cipher and provides certificate

Certificate Server provides digital certificate (X.509)

Key Exchange Client and server exchange keys for session

Finished Secure session begins

🔍 Most Common TLS Display Filters
Use these filters in Wireshark’s Display Filter bar:

Filter Description

tls Show all TLS traffic

tcp.port == 443 TLS over HTTPS

tls.handshake.type == 1 Client Hello messages

tls.handshake.type == 2 Server Hello messages

tls.record.version ==
TLS 1.2 traffic
0x0303

tls.record.version ==
TLS 1.3 traffic
0x0304

✅ Conclusion

 TLS secures communication using encryption, making traffic

unreadable without keys.
 Wireshark can't decrypt TLS by default but can reveal:
 Server name (SNI)
 Certificate chain
 TLS versions and cipher suites
 Analyzing TLS metadata helps detect:
 Outdated TLS versions (e.g., TLS 1.0)
 Suspicious or self-signed certificates
 Malicious domain encryption abuse

📸 Submission
Submit a screenshot showing:

 Show all TLS traffic

 Show Client Hello messages
 Show TLS 1.2 traffic
Introduction to Wireshark – Packet Analysis for SOC
Analysts

🎯 Objective
The objective of this lab is to introduce students to Wireshark, a powerful
packet analysis tool used by SOC analysts to investigate network traffic.
Students will learn the interface, how to capture packets, apply filters, and
identify suspicious communication patterns.

▶️Video Tutorial
🛠️Lab Setup

System Requirements
 Operating System: Windows, Linux, or macOS
 Network Adapter: Required for packet capture

Software Required
  Wireshark (latest stable version)
 Download Sample PCAP file

🎥 YouTube Tutorial Video

📺 Watch: Wireshark for Beginners – Hands-On Walkthrough
Duration: 15 minutes

📘 What is Wireshark?
Wireshark is an open-source network protocol analyzer that lets you
capture and interactively browse network traffic. It allows analysts to view
data packets flowing in and out of a system in real time or from saved
PCAP files.

🛡️Wireshark Use Cases for SOC Analysts

 🔍 Incident Investigation: Analyze malicious traffic patterns (e.g., C2
communication, lateral movement)
 🕵️Malware Analysis: Extract indicators like domains, IPs, and payloads
from suspicious network behavior
 🚨 Threat Hunting: Detect anomalies like DNS tunneling, beaconing, or
unauthorized FTP/SSH usage
 🛠️Protocol Troubleshooting: Identify service failures, misconfigurations,
or latency issues

📸 Submission
Submit screenshots showing:

 Create a New Profile Name "SOC Analyst" and share the snapshot
 Create a display filter to capture ICMP traffic and share the snapshot
 Create a capture filter to capture ICMP traffic and share the snapshot
Wireshark Basics – ICMP Protocol
Analysis

🎯 Objective
The objective of this lab is to help students understand and analyze ICMP
(Internet Control Message Protocol) packets using Wireshark.
Students will learn to identify echo requests/replies, interpret ICMP packet
fields, and apply relevant filters for investigation.

▶️Video Tutorial
🛠️Lab Setup

System Requirements
 Operating System: Windows 10/11 (or Linux/macOS)
 Software: Wireshark (latest version)

Files Needed
  Download Sample PCAP file

📘 ICMP Packet Structure and Fields

ICMP is a Layer 3 protocol used for sending error messages and
operational information. The most common ICMP messages include Echo
Request (Type 8) and Echo Reply (Type 0).

Key ICMP Fields:

Field Name Description

Type Defines the ICMP message type

Code Provides further detail for the type
Checksum Error-checking for header
Identifier Helps match requests and replies
Sequence No. Sequence of the request/reply
Data Optional payload

🔍 Most Common ICMP Display Filters

Use these filters in Wireshark’s Display Filter bar:

Filter Description

icmp Show all ICMP traffic

icmp.type == 8 Show Echo Requests (ping)
icmp.type == 0 Show Echo Replies
icmp.code == 3 Destination unreachable
ip.addr ==
192.168.1.10 ICMP traffic from/to specific host
✅ Conclusion
 ICMP is a fundamental protocol for network troubleshooting.
 Wireshark helps visualize ICMP packet flow and structure.
 Understanding ICMP helps detect network scanning, ping sweeps,
and unreachable hosts.

📸 Submission
Submit a screenshot showing:

 ICMP Echo Request and Echo Reply packets

Wireshark Basics – TCP Protocol

Analysis

🎯 Objective
The objective of this lab is to introduce students to analyzing TCP
(Transmission Control Protocol) traffic using Wireshark. Students will
learn how TCP establishes connections, the 3-way handshake process, and
how to interpret common TCP fields and flags.

▶️Video Tutorial
🛠️Lab Setup

System Requirements
 Operating System: Windows 10/11 (or Linux/macOS)
 Software: Wireshark (latest version)

Files Needed
  Download Sample PCAP file

📘 TCP Packet Structure and Fields

TCP is a Layer 4 (Transport Layer) protocol that ensures reliable,
ordered, and error-checked delivery of data between applications.

Key TCP Fields:

Field Name Description

Source Port Sender’s port number

Destination Port Receiver’s port number
Sequence Number Number of the first byte in the segment
Acknowledgment
Confirms received data
No
Flags Control bits (SYN, ACK, FIN, RST, PSH, URG)
Window Size Buffer size available
Checksum Error-checking field

🔍 Most Common TCP Display Filters

Use these filters in Wireshark’s Display Filter bar:

Filter Description

tcp Show all TCP packets

tcp.flags.syn == 1 Show SYN packets (start of connection)
tcp.flags.fin == 1 Show FIN packets (end of connection)
tcp.port == 80 Show TCP packets on port 80
ip.addr ==
192.168.1.1 TCP traffic to/from a specific host
✅ Conclusion
 TCP ensures reliable and ordered data delivery through its 3-way
handshake and flow control.
 Understanding TCP flags is essential for:
 Connection state tracking
 Troubleshooting dropped or reset connections
 Detecting scanning and abnormal behavior (e.g., RST floods)

Submission
Submit a screenshot showing:

 Show all TCP packets

 Show SYN packets (start of connection)
 Show FIN packets (end of connection)
 TCP traffic to/from a specific host

Wireshark Basics – HTTP Protocol Analysis

🎯 Objective
The objective of this lab is to help students analyze HTTP (Hypertext
Transfer Protocol) packets using Wireshark. Students will explore
HTTP request/response headers, understand how web communication
works, and learn how to detect common HTTP-based attacks or data
leaks.

▶️Video Tutorial
🛠️Lab Setup

System Requirements
 Operating System: Windows 10/11 (or Linux/macOS)
 Software: Wireshark (latest version)

Files Needed
  Download Sample PCAP file

📘 HTTP Packet Structure and Fields

HTTP is an application-layer protocol used for communication between
clients (browsers) and web servers. It typically runs over TCP port 80.

Key HTTP Fields:

Field Name Description

Request GET, POST, HEAD, etc.

Method

Host The website being accessed

User-Agent Information about the client/browser

URI Resource path on the server

Status Code Server's response status (e.g., 200 OK)

Content-Type MIME type of the response (e.g., text/html)

Cookie/Header Session or tracking information

🔍 Most Common HTTP Display Filters

Use these filters in Wireshark’s Display Filter bar:

Filter Description

http Show all HTTP traffic

tcp.port == 80 HTTP traffic by default port

http.request.method == Show all GET requests

 Filter Description

"GET"

http.request.uri View requested resources

http.set_cookie Show cookies in HTTP responses

ip.addr == 192.168.1.10 HTTP traffic to/from specific host

✅ Conclusion
 HTTP traffic is readable and easy to analyze in Wireshark.
 Analyzing HTTP helps detect:
 Sensitive data exposure in URLs or headers
 Malware beaconing to C2 servers
 Suspicious file downloads or unauthorized access

📸 Submission
Submit a screenshot showing:

 Show all HTTP traffic

 Show all GET requests
 View requested resources

Introduction to Incident Response

Objective:
The objective of this lab is to introduce students to the core concepts of
incident response, familiarize them with the incident response
lifecycle, and help them understand how basic threats on Windows
systems are detected, analyzed, and responded to by SOC Analysts.

▶️Video Tutorial
What is Incident Response?
Incident Response (IR) is the structured approach to handle and
manage the aftermath of a security breach or cyberattack, also known
as an incident. It includes steps to:

 Detect the incident

 Contain the damage
 Investigate the root cause
  Recover normal operations
 Report and document findings

Incident Response Process (NIST SP 800-61

Rev. 2)
The NIST Incident Response Lifecycle includes 4 main phases:

Phase Description

Establish policies, train team, and set up tools and logging

1. Preparation mechanisms.

Identify potential incidents using logs, alerts, and anomaly

2. Detection and Analysis
detection systems.

3. Containment, Eradication, and Isolate threats, remove malware/artifacts, and restore

Recovery systems securely.

Conduct lessons learned, create reports, and improve

4. Post-Incident Activity
incident response plans.

Common Types of Incidents on Windows:

Common Types of Incidents Across

Platforms
Platform Incident Type Description

Window Multiple failed logins or brute-force via RDP

Unauthorized Login Attempts
s or local access.

Obfuscated or encoded PowerShell

PowerShell-based Attacks commands for exploitation or lateral
movement.
Platform Incident Type Description

Malware/Ransomware Malicious EXE/DLL files executed, causing

Execution encryption or data theft.

Use of tools like Mimikatz to extract

Credential Dumping
credentials from LSASS memory.

Lateral Movement via WMI or Internal system traversal using Windows

RDP services and accounts.

SSH Brute Force or Repeated login attempts or access from

Linux
Unauthorized Access unknown IPs via SSH.

Malicious Cron Jobs for Scheduled tasks created by attackers to

Persistence maintain access.

Sudo Abuse / Privilege Exploiting weak sudo rules or known

Escalation vulnerabilities to gain root privileges.

Attackers upload backdoors via vulnerable

Web Shell Upload
web applications.

Hidden mining software running under

Crypto Miner Installation
compromised user accounts.

Leaked API keys used from unknown

AWS IAM Credential Misuse
geographies.

Suspicious login or activity from the AWS root

Root User Console Access
account.

Public or unauthorized access to private

Unusual S3 Bucket Access
storage.

Logging service turned off to hide attacker

CloudTrail or Logging Disabled
activity.

EC2 Abuse for Command and EC2 instances being used as a staging point or
Control C2 server.

Flood of traffic targeting public-facing

Network DDoS Attack
services.
 Platform Incident Type Description

Continuous scanning of open ports across

Port Scanning / Reconnaissance
network segments.

ARP Spoofing / Man-in-the-

Tampering with traffic flows for interception.
Middle (MitM)

DNS Tunneling Covert data exfiltration using DNS queries.

Compromised VPN credentials used for

Unauthorized VPN Access
internal access.

Phishing / Credential Fake emails with links to steal user

Email
Harvesting credentials.

Malware via Attachments Office or ZIP files with embedded malware.

Business Email Compromise Attacker impersonates an executive to trick

(BEC) employees.

Sending emails from domains that look like

Spoofed Email Domains
legitimate ones.

Compromised internal mailbox used to spread

Internal Account Compromise
phishing internally.

How SOC Analysts Respond to Incidents:

 Monitor logs and alerts (via SIEM)
 Investigate suspicious behavior
 Contain and isolate infected systems
 Coordinate with other teams
 Document and report the incident

🧪 Lab Task: Detect and Respond: Windows

Server RDP Brute Force Attack
🧰Lab Setup and Requirements

🖥️Machines Required:
 Windows Server 2019 or 2022
o RDP enabled
o Event Viewer access
o One local user account with known username
 Kali Linux VM
o Hydra pre-installed
o Connected to same LAN or Virtual Network

📶Network:
 Ensure both machines are on the same network
 Verify RDP (TCP/3389) is open on Windows Server

⚙️Preparation Steps

On Windows Server:
1. Enable RDP:
System Properties → Remote → Enable Remote Desktop
2. Allow RDP in Firewall:
Windows Defender Firewall → Advanced Settings → Inbound Rules →
Remote Desktop (TCP-In) → Enable
3. Create Test User:

net user attackerlab Password123 /add

Open Event Viewer: Windows Logs → Security Filter for Event ID 4625
(Failed Logon)

🎯Simulate the Attack

1. On Kali Linux: Install Hydra (if not installed):

sudo apt update && sudo apt install hydra

Prepare Wordlist: Use the existing list or create a custom one, e.g.:
/usr/share/wordlists/rockyou.txt 2. Run this command on Kali Linux:

hydra -t 4 -V -f -l attackerlab -P /usr/share/wordlists/rockyou.txt

rdp://<Windows_Server_IP>
Replace <Windows_Server_IP> with actual IP of Windows Server

👁️Visualize the Alert in Event Viewer

1. On Windows Server: Open Event Viewer → Windows Logs → Security
2. Look for Event ID 4625 with:

Logon Type: 10 (RemoteInteractive / RDP)

Failure Reason: "Unknown user name or bad password"

Caller IP Address: IP of Kali machine

🚨Incident Response Steps

1. Identify Repeated Failed Logons:

 Spot Event ID 4625 from same IP

2. Correlate IP Address:

 Confirm repeated failures from attacker’s IP

3. Lock the User Account (Optional):

net user attackerlab /active:no

4. Block Attacker IP:

New-NetFirewallRule -DisplayName "Block Attacker" -Direction Inbound -

RemoteAddress <Kali_IP> -Action Block

5. Collect Evidence:

 Export relevant Event Logs

6. Report Incident:

 Create a brief report with findings and actions taken

📩Submission Requirements
Submit the following:

 Screenshot of Hydra attack in Kali Linux

 Screenshot of Event Viewer showing multiple 4625 events
 Firewall rule

✅Conclusion
This lab demonstrated how to:

 Simulate an RDP brute-force attack using Hydra

 Detect suspicious logons via Windows Event Viewer
 Respond with basic IR steps without using Sysmon

Incident Response Basics – Linux Suspicious Bash Script

Execution

🎯 Objective:
The objective of this lab is to help students understand the core steps of
incident response by investigating a suspicious bash script
execution on a Linux system. Students will learn how to detect, analyze,
and respond to a basic script-based intrusion.

📘 What is Incident Response?

Incident Response (IR) is the process of detecting and managing a
cybersecurity incident to minimize impact and restore normal operations.
This lab introduces a basic Linux scenario where an attacker’s script is
executed through user error or misconfiguration.

🔁 Incident Response Process (NIST SP 800-

61 Rev. 2)
Phase Description

Ensure logging is enabled, tools are installed, and the

1. Preparation system is ready.

Identify suspicious activity using logs, running

2. Detection and Analysis
processes, and file checks.
 Phase Description

3. Containment, Eradication, and Isolate the threat, remove the script, and secure the
Recovery system.

Document the incident and implement prevention

4. Post-Incident Activity
steps.

⚠️Scenario: Suspicious Script Found in /tmp

Your monitoring system flagged a suspicious file in /tmp. Upon inspection,
it's a bash script (payload.sh) that connects to an unknown IP. You are
tasked with investigating this incident.

🛠️Lab Setup

System Requirements:
 Ubuntu 20.04/22.04 or Kali Linux
 Terminal access with sudo privileges

Simulate teh attack:

1. Create a test directory:

mkdir ~/script-lab && cd ~/script-lab

2. Create a Bash script:

nano fakebackup.sh

3. Paste the following content:

#!/bin/bash
echo "[*] Simulating backup operation..."
sleep 60

4. Make the script executable:

chmod +x fakebackup.sh
 5. Simulate the Attack / Execution Run the script in the background:

./fakebackup.sh &

🧪 Step-by-Step Investigation

1. Preparation
 Install curl, lsof, ps, and grep (usually pre-installed).

2. Detection and Analysis

 Check running processes:

ps aux | grep fakebackup.sh

 Search for suspicious files:

find /tmp -name "*.sh"

3. Containment, Eradication, and Recovery

 Kill any related processes:

pkill curl

 Remove the malicious script:

rm -f /tmp/payload.sh

 Clear the crontab if persistence was found:

crontab -e

 Restart services if needed and log out inactive sessions.

4. Post-Incident Activity
 Document:
 What triggered the alert?
 What was the script doing?
 Which user executed it?
 Recommendations:
 Enable file integrity monitoring (e.g., AIDE).
 Restrict /tmp execution using mount options (noexec).
 Educate users about unknown script execution.
Lab Checklist
✅ Simulate Script Create and execute a suspicious bash script
✅ Investigate Logs Use commands to analyze the event
✅ Kill and Delete Contain and remove the malicious file
✅ Document Findings Note IPs, users, and recommendations

📸 Submission
Submit screenshots of:

 The malicious script content

 Process list showing the script or curl
 Script deleted from /tmp

Detecting and Removing Malicious Cron Jobs – Linux

Incident Response Lab

🎯 Objective:
The objective of this lab is to investigate and respond to a malicious
cron job used by an attacker to maintain persistence on a Linux system.
Students will simulate the attack, detect the malicious scheduled task,
analyze the script, and remove the threat — applying the full incident
response lifecycle.

▶️Video Tutorial
📘 What is a Cron Job?
A cron job is a scheduled task that runs automatically at defined intervals
on Unix/Linux systems. Attackers often use cron to re-execute
payloads, reconnect to command-and-control servers, or maintain access
to a compromised system.
🛠️Key Features:
 Run commands automatically (e.g., every minute, daily, weekly)
 Useful for backups, updates, monitoring scripts, etc.
 Works in the background via the cron service

🧾Format of a crontab entry:

* * * * * command-to-run
│ │ │ │ │
│ │ │ │ └─ Day of the week (0-7, Sun = 0 or 7)
│ │ │ └──── Month (1 - 12)
│ │ └─────── Day of month (1 - 31)
│ └────────── Hour (0 - 23)
└───────────── Minute (0 - 59)

🔁 Incident Response Process (NIST SP 800-

61 Rev. 2)
Phase Description

Ensure system logging is active and users are trained to

1. Preparation detect unusual cron behavior.

Identify unauthorized cron entries and investigate

2. Detection and Analysis
associated scripts or IP addresses.

3. Containment, Eradication, Stop the malicious cron activity, remove the script, and
and Recovery restore system configuration.

Document the incident, and set alerts for future cron job
4. Post-Incident Activity
changes.

⚠️Scenario: A Malicious Cron Job is Running

Every Minute
An attacker has added a cron job that silently runs a malicious script
from /tmp every minute. Your job is to detect it, understand its behavior,
and remove it safely.
🛠️Lab Setup

System Requirements:
 Ubuntu 20.04/22.04 or Kali Linux
 Terminal with sudo access

Simulate the Incident:

1. Create a fake "malicious" script:

echo -e '#!/bin/bash\necho "Ping from attacker server" >> /tmp/.cron.log' >

/tmp/malicious.sh
chmod +x /tmp/malicious.sh

2. Add a cron job for the current user:

echo "* * * * * /tmp/malicious.sh" >> /var/spool/cron/root

🧪 Step-by-Step Investigation

Step 1. Preparation
 Make sure cron is installed and running:

sudo systemctl status cron

 Enable logging (cron logs are usually in /var/log/syslog or /var/log/cron).

Step 2. Detection and Analysis

 Check for suspicious cron entries:

crontab -l

 Search cron directories for unauthorized jobs:

grep -r "/tmp/" /etc/cron* /var/spool/cron/crontabs

 Review logs to confirm execution:

cat /tmp/.cron.log

 Analyze the script:

cat /tmp/malicious.sh

Step 3. Containment, Eradication, and Recovery

  Remove the malicious cron job:

crontab -l | grep -v "malicious.sh" | crontab -

 Delete the script and its output:

rm -f /tmp/malicious.sh /tmp/.cron.log

 Restart the cron service:

sudo systemctl restart cron

Step 4. Post-Incident Activity

 Document the following:
 When the cron job was added
 What the script was doing
 Any signs of lateral movement or download activity
 Recommendations:
 Restrict cron job access to authorized users only
 Enable cron integrity checks
 Set up alerts for new cron entries (using auditd or inotify)

Lab Checklist
✅ Simulate Cron Job Create a malicious script and schedule it via cron ✅
Investigate Detect the cron job and examine the script behavior ✅
Respond Remove the script and the cron entry ✅ Document Record all
findings and suggest prevention steps

📸 Submission
Submit screenshots showing:

 crontab -l output with the malicious job

 Contents of the cron script /tmp/malicious.sh
 Logs confirming the script execution
 Cleaned cron job list and deletion confirmation

Detecting Suspicious PowerShell Activity – Windows

Incident Response Lab

🎯 Objective:
The objective of this lab is to simulate and investigate a suspicious
PowerShell command on a Windows system. Students will learn how to
detect PowerShell-based threats using built-in logs, analyze activity using
Event Viewer, and perform basic incident response actions.

📘 Why PowerShell Matters in Incident

Response
PowerShell is a powerful tool for system administration — but it’s also
commonly used by attackers to download malware, move laterally, and
execute hidden scripts. Proper logging and monitoring can help detect
abuse.

🔁 Incident Response Process (NIST SP 800-

61 Rev. 2)
Phase Description

Enable PowerShell logging and ensure security auditing

1. Preparation is in place.

2. Detection and Analysis Identify and investigate PowerShell misuse in logs.

3. Containment, Eradication, and Kill malicious processes, remove scripts, and secure
Recovery PowerShell usage.

Document findings and improve PowerShell restrictions

4. Post-Incident Activity
and monitoring.

⚠️Scenario: Suspicious PowerShell

Command Executed
A user accidentally ran a PowerShell command that simulates suspicious
behavior — like contacting a remote server and writing data to disk. You
must detect and analyze this command through system logs.

Lab Setup

Requirements:
 System: Windows 10/11 or Windows Server 2019/2022
 Tools:
o Windows Event Viewer (pre-installed)
o PowerShell (Pre-installed on Windows)
o Administrative Privileges (required for enabling logs)

Preparation:
Before proceeding, make sure PowerShell script block logging is enabled
on your system:

1. Press Win + R, type gpedit.msc, and press Enter to open the Group Policy
Editor.
2. Navigate to: Computer Configuration > Administrative Templates >
Windows Components > Windows PowerShell
3. Turn on Module Logging, Script Block Logging, and Script
Execution.
4. Apply the settings and close the Group Policy Editor.

What are Windows PowerShell Logs?

PowerShell logs contain information about PowerShell script executions,
including details about the commands that were run, the processes that
invoked them, and the user who executed them. These logs can be used
to detect potential misuse of PowerShell, including post-exploitation
techniques often used by attackers.

Key PowerShell Logs to Monitor:

  Event ID 4104: Script block logging, capturing the PowerShell commands
executed.
 Event ID 4103: Command invocation with parameter binding (detailed
command execution).
 Event ID 4698: PowerShell Module Logging for the execution of specific
modules.
 Event ID 4101: Execution of PowerShell commands through command-
line arguments.

Lab Task: Explore and Analyze Windows

PowerShell Logs

Step 1: Generate PowerShell Logs

1. Open PowerShell as Administrator.
2. Run the following PowerShell command to generate a log entry:

Start-Process "notepad.exe" -ArgumentList "C:\Windows\System32\drivers\etc\

hosts"
This command

 Starts a new process using the Start-Process cmdlet.

 Specifies "notepad.exe" as the program to launch.
 Passes "C:\Windows\System32\drivers\etc\hosts" as an argument to
Notepad.
 As a result, Notepad opens the hosts file directly.

Step 2: Visualize the events

1. After running the command, go back to Event Viewer and navigate to:

Applications and Services Logs → Microsoft → Windows → PowerShell →

Operational

4. Look for Event ID 4103 in the logs (this will show script block logging for
the PowerShell command you executed).
5. Take a screenshot of the event details, including:

 PowerShell command that was executed

 User who ran the command
 Timestamp of the execution

Step 3: Incident Response

1. Check the file and it content
C:\Windows\System32\drivers\etc\hosts

2. Containment: Isolate the system: If you suspect malicious activity, you can
block network connections: Note: Usually this is doen from EDR tool.

New-NetFirewallRule -DisplayName "Block Network Access" -Direction Outbound

-Action Block -Enable

3. Eradication: Restore the Hosts File: If modifications to the hosts file were
made without authorization, restore it from a backup:

Copy-Item "C:\Backup\hosts" -Destination "C:\Windows\System32\drivers\etc\

hosts" -Force
Remove Suspicious Files: If you find any suspicious files related to the
incident, you can remove them:

Remove-Item "C:\Path\To\SuspiciousFile.exe" -Force

4. Recovery: Restore from Backup (if necessary): Restore the system to a

clean state from backups:

Restore-Computer -RestorePoint 1 # Restores to the first available restore

point
Re-enable Network Access: After securing the system, re-enable network
access by disabling the firewall rule:

Set-NetFirewallRule -DisplayName "Block Network Access" -Enabled False

5. Reporting

 Write incident response report with timeline, command etc

Submission
Submit screenshots showing: ✅ Enable Logging Ensure PowerShell
operational logs are active ✅ Simulate Suspicious Powershell Command ✅
Analyze Logs Investigate the command via Event ID 4103 ✅ Remove File
Delete the generated log file

Incident Response Basics – Suspicious Network

Connection

🎯 Objective
Investigate and respond to a suspicious outbound network
connection from a Linux machine. This simulates beaconing behavior or
data exfiltration. Students will learn to inspect open connections, trace
source processes, and mitigate threats.

▶️Video Tutorial
📘 Why It Matters
Attackers often use hidden outbound connections to communicate with
command-and-control (C2) servers. Detecting and cutting off these
connections is essential for SOC and IR teams.
🔁 Incident Response Process (NIST SP 800-
61 Rev. 2)
Phase Description

Ensure netstat, ss, and lsof are installed. Enable

1. Preparation auditd/network logging.

Identify unexpected remote connections and associated

2. Detection and Analysis
processes.

3. Containment, Eradication, and

Kill the process, investigate binary, block destination IP.
Recovery

Document findings, improve firewall rules, configure

4. Post-Incident Activity
monitoring tools.

⚠️Scenario: Unexpected Outbound

Connection Detected
A Linux system shows an active connection to an unknown
IP 45.13.220.98:443, not related to any known services.

🛠️Lab Setup

System Requirements
 Ubuntu/Kali Linux system
 Internet access
 Tools: curl, netstat or ss, lsof

Simulate Suspicious Connection

nohup bash -c 'while true; do curl http://45.13.220.98/ping >/dev/null
2>&1; sleep 30; done' &
🧪Step-by-Step Investigation
Step 1: Detect Active Network Connections
netstat -plant
# or
ss -plant
Look for a suspicious IP such as 45.13.220.98:443.

Here -p Show the PID and program name of the connection -l Show only
listening sockets -a Show all connections and listening ports -n Show
numeric addresses (don’t resolve hostnames or port names) -t Show only
TCP connections

Step 2: Identify the Responsible Process

Get the PID from netstat or ss output

Investigate:

ps aux | grep 45.13.220.98

Step 3: Containment & Eradication

 Kill the process:

kill <PID>
# or
pkill curl

 Block the IP using UFW:

ufw deny out to 45.13.220.98

Step 4: Post-Incident Activity

Document:

 What process initiated the connection?

 Remote IP and port?
 Binary path used?

Recommendations:

 Implement egress filtering

 Deploy IDS/IPS solutions
 Monitor outbound connections and unusual traffic

📸Submission
Submit screenshots showing:
 Output of netstat or ss with suspicious connection
 ps and lsof output with PID
 Process termination (kill or pkill)
 IP block using UFW or iptables
 Written summary of incident