Windows Network Analysis

Network analysis is the process of capturing and examining both historical and active network activity on a host, which can provide a wealth of information, such as:

• IP Addresses (such as source and destination)
• Ports
• URLs
• Correlating processes and network traffic.

This room will introduce you to the network artefacts present on a Windows host and how these can be analysed using tooling already provided on Windows. Often in the initial stages of an incident, you may not be able to install all of your fancy tooling. It's essential to know how to work with the Operating System to capture the evidence you need, as well as build a picture of the host's activity.

Finally, you will come on to practice what you have learnt in this room by analysing a Windows machine that has been infected with a C2 agent that keeps real-time communication with the host.

This room recommends that you have either completed or are familiar with the following content:

• Windows Fundamentals
• Investigating Windows
• Introductory Networking
• Hacking with PowerShell

Learning Objectives

• How to benefit from network artefacts present on Windows using internal tooling
• Auditing network logs on a Windows host
• Determining a process' network activity
• Triage a host using PowerShell for some "quick wins"