Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Strange & Unusual Activity

Something is hiding in the network traffic. Hunt through Zeek logs and uncover what slipped through.

Task 1: SIEMStrange & Unusual Activity

STRANGE & UNUSUAL ACTIVITY // NETWORK FORENSICS

Strange & Unusual Activity

MEDIUM
Something strange is happening on the corporate network, but the usual security tools have nothing to report. Investigate a day of network activity, follow the evidence, and uncover what slipped through unnoticed.
SIEM THREAT HUNTING
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

A threat-intelligence feed has flagged suspicious communications within the 10.10.14.0/24 corporate network. No security alerts were triggered, and the activity went unnoticed by internal monitoring.

With a full day of network logs at your disposal, investigate the traffic, identify the source of the suspicious communications, and determine what took place.

ANALYST WORKSPACE
KIBANA WEB INTERFACE
>http://<MACHINE_IP>:5601
DATA VIEW zeek-*
Captured traffic: 07 October 2025 (24 hours)
02 // OBJECTIVES
01. Examine the network traffic for unusual communication patterns.
02. Distinguish suspicious activity from legitimate network services.
03. Identify the affected workstation and its external communications.
04. Investigate the volume of data transferred and determine the extent of the activity.
ANALYST NOTE
Not every unusual connection is malicious, and not every malicious connection looks unusual on its own. Look at the bigger picture, compare the traffic, and let the evidence guide your investigation.
 
NETWORK_ANOMALY_DETECTED // CASE FILE OPEN
STRANGE_AND_UNUSUAL_ACTIVITY // SIEM // NETWORK_FORENSICS

Answer the questions below

  1. What is the domain name used by the command-and-control (C2) server?

  2. What is the callback interval, in seconds, between the compromised host and the C2 server?

  3. What is the IP address of the compromised host?

  4. How many check-ins (callbacks) did the compromised host make to the C2 domain over the capture window?

  5. How many bytes of data were exfiltrated in the single largest outbound transfer to the C2 server?

Room Icon

Strange & Unusual Activity

Something is hiding in the network traffic. Hunt through Zeek logs and uncover what slipped through.

medium

45 min

Team room

79

User profile photo.
User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off
STRANGE & UNUSUAL ACTIVITY // NETWORK FORENSICS

Strange & Unusual Activity

MEDIUM
Something strange is happening on the corporate network, but the usual security tools have nothing to report. Investigate a day of network activity, follow the evidence, and uncover what slipped through unnoticed.
THREAT HUNTING
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

A threat-intelligence feed has flagged suspicious communications within the 10.10.14.0/24

corporate network. No security alerts were triggered, and the activity went unnoticed by internal monitoring.

With a full day of network logs at your disposal, investigate the traffic, identify the source of the suspicious communications, and determine what took place.

ANALYST WORKSPACE
WEB INTERFACE
>://<MACHINE_IP>:5601
DATA VIEW -*
Captured traffic: 07 October 2025 (24 hours)
02 // OBJECTIVES
01. Examine the network traffic for unusual communication patterns.
02. Distinguish suspicious activity from legitimate network services.
03. Identify the affected workstation and its external communications.
04. Investigate the volume of data transferred and determine the extent of the activity.
ANALYST NOTE
Not every unusual connection is malicious, and not every malicious connection looks unusual on its own. Look at the bigger picture, compare the traffic, and let the evidence guide your investigation.
 
NETWORK_ANOMALY_DETECTED // CASE FILE OPEN
STRANGE_AND_UNUSUAL_ACTIVITY // SIEM // NETWORK_FORENSICS
Answer the questions below

What is the domain name used by the command-and-control (C2) server?

What is the callback interval, in seconds, between the compromised host and the C2 server?

What is the IP address of the compromised host?

How many check-ins (callbacks) did the compromised host make to the C2 domain over the capture window?

How many bytes of data were exfiltrated in the single largest outbound transfer to the C2 server?