Network, Mobile, and Cloud Forensics Questions

Clarify scope & constraints

• Confirm affected cloud providers, accounts, regions, on‑prem clusters, business windows for remediation, and backup/restore SLAs.

Forensic challenges (hybrid-specific)

• Ephemeral instances: short-lived VMs/containers lose local artifacts; persistence may live only in images, user-data, or orchestration configs.
• Cloud metadata services: attacker can harvest temporary credentials; metadata access logs often absent unless IMDS logging enabled.
• Cross-account roles: trust relationships expand blast radius; compromise may persist via long‑lived role assumptions.
• Distributed logging: logs split across cloud provider services, on‑prem SIEM, K8s audit logs—time sync and correlation are hard.

Investigation methodology

1. Triage & preserve

   • Isolate suspect accounts/segments (network ACLs, security groups) but avoid destroying assets.
   • Snapshot EBS/volume, export instance metadata, container images, orchestration manifests.
   • Export IAM policies, role trust relationships, service principals, and instance user-data.

2. Collection & timeline building

   • Aggregate CloudTrail/Audit logs, provider-specific API logs, on‑prem syslogs, K8s audit, SIEM events; normalize timestamps (NTP drift accounting).
   • Correlate API calls (CreateRole, AttachRolePolicy, RunInstances, ModifyInstanceAttribute), metadata access from instance roles, user-data changes, image builds.

3. Hunt for persistence artifacts

   • IAM: list roles with non‑standard trust policies, inline policies granting broad AssumeRole, recently created keys.
   • Compute: inspect instance user-data, startup scripts, AMI lifecycle, cloud-init, systemd units, cronjobs, container entrypoints.
   • Workloads: service accounts (K8s), secrets in configmaps/parameter store, scheduled jobs (CloudWatch Events / EventBridge, cron).
   • Cross-account: enumerate external principals in role trusts and resource-based policies (S3, KMS).

4. Validate & risk-assess

   • Test suspected persistence in safe sandbox: rotate credentials, detach role policies in a test account to observe impact.
   • Map dependencies to avoid data loss (backups, databases, orchestration controllers).

Safe removal / remediation

• Short-term containment: revoke session tokens (revoke refresh tokens, rotate keys), disable IAM roles with deny statements rather than delete; revoke insecure trust relationships.
• Remove persistence in staged steps:
  1. Block network/console access for compromised principals.
  2. Disable suspicious roles/accounts (mark, not delete).
  3. Patch/replace images: build clean AMIs/containers, redeploy from trusted CI/CD artifacts.
  4. Clean on‑prem: remove cron/systemd entries after backups and verification.
  5. Rotate all credentials, rotate KMS keys if suspected, revoke temporary credentials.
• Monitor: enable/validate metadata and IMDSv2 enforcement, enable detailed logging (CloudTrail Data Events, VPC Flow Logs, K8s audit), feed to SIEM with alerts for recreated artifacts.
• Post‑remediation: forensic report, full credential rotation, remove risky cross-account trusts, harden IaC templates, implement least privilege and break-glass procedures.

Tools & evidence

• Use cloud provider APIs/CLI, forensic imaging (EBS snapshots), SIEM, ELK, GRR/Velociraptor, kube-bench/audit, ScoutSuite/Prowler for posture checks.

Lessons & controls

• Enforce IMDSv2, short-lived instance roles, centralized image signing, immutable infrastructure, continuous attestation of runtime configs, and automated detection for role/trust changes.

Overview / Goals
Stepwise plan to find C2, staging/exfiltration, and pivoting in a PCAP using Zeek, Wireshark/tshark, Bro/Suricata outputs and manual inspection.

1) Triage & ingest

• Run Zeek to generate conn, http, dns, ssl, files, and weird logs:

zeek -r capture.pcap local

• Extract flows with tshark for quick stats:

tshark -r capture.pcap -q -z conv,ip

2) Identify noisy / suspicious endpoints

• Sort Zeek conn.log by bytes/duration/frequency to find unusual long-lived low-bandwidth flows (C2) and high-volume uploads (exfil):

cat conn.log | zeek-cut id.orig_h id.resp_h duration resp_bytes orig_bytes proto | sort -k4 -n

• Heuristics: >20 short periodic flows to same host, beaconing intervals, small payload sizes, uncommon ports.

3) DNS and domain anomalies

• Inspect dns.log for fast-flux, high TTL variability, many NXDOMAIN, many unique subdomains:

grep -v success dns.log | sort | uniq -c

• Look for DGA-like randomness (entropy) and domains resolving to many IPs.

4) HTTP & TLS inspection

• Check http.log for unusual Host headers, uncommon user-agents, encoded payloads, long POSTs:

zeek-cut id.orig_h id.resp_h method host uri user_agent | sort | uniq -c

• TLS: use ssl.log (or zeek ssl) for SNI anomalies and self-signed certs. Beaconing over HTTPS indicated by periodic small encrypted flows to same SNI.

5) Beaconing and timing analysis

• Compute inter-arrival times per (src,dst,port). Regular intervals imply C2. Use Python/pandas or tshark exports to chart timing and size patterns.
• Heuristic: standard deviation of intervals << mean.

6) File extraction & staging

• Use Zeek files.log and oftentimes NetworkMiner or Wireshark to reassemble and extract artifacts (HTTP POST bodies, FTP, SMB).
• Search for large outbound transfers or many small chunks to remote host (exfil chunking).

7) Pivoting / Lateral movement

• Identify internal IPs contacting many unique external hosts or uncommon internal-to-internal SMB/RDP traffic. Inspect unusual protocols (SMB on nonstandard ports, Kerberos anomalies).
• Correlate with src being internal host with prior compromise indicators (beacons, malicious downloads).

8) Enrichment & validation

• Cross-check IPs/domains with threat intel, passive DNS and sandbox names. Retrieve file hashes from extracted files.

9) Reporting & containment

• Document IOCs, timeline, sampled packets (pcap slices), and recommend containment (block IPs, isolate hosts) and full host forensic triage.

Tools: Zeek, tshark/wireshark, NetworkMiner, pyshark/pandas, Suricata, Bro-cut, passive DNS, MISP.

Immediate collection — capture before teardown

• Take hypervisor/cloud snapshots of VM volumes (EBS, persistent disks) and export to immutable storage (object store with WORM/retention). Snapshots preserve block-level state; note snapshot IDs, region, and create timestamps.
• For containers/Pods: pause or cordon node if possible; use container runtime tooling (crictl/docker) to export filesystem: docker export / crictl export or copy layered image tarballs and overlayfs diffs. Capture process list, open sockets, /proc, and container logs.
• Collect memory where feasible (LiME for Linux, vendor tools) from nodes running suspicious pods or from the host snapshot to reconstruct in-memory artifacts.

Logging and telemetry

• Centralize logs (application, container stdout/stderr, kube-audit, kubelet, cloud audit logs) into an immutable SIEM or object store with append-only/WORM policies and cryptographic integrity (hashing + HMAC).
• Ensure structured, timestamped logs (UTC, NTP-synced) and preserve metadata: pod/node IDs, image digests, autoscaler events, instance lifecycle hooks.

Chain of custody for cloud artifacts

• Record who performed actions, via what API keys/roles, with timestamps, IPs, and justification. Export cloud provider audit trails (CloudTrail/AzureActivity) and attach snapshot hashes and access-control lists.
• Use automated playbooks to record each collection step (scripted APIs) to reduce human error; sign artifacts and logs with analyst key when exported.

Legal admissibility

• Prove integrity: keep original snapshots/logs immutable, store cryptographic hashes, and preserve provider audit logs showing existence and lifecycle of ephemeral instances.
• Document standard operating procedures and obtain pre-approved forensic authority/retain legal holds for short-lived services. If instances self-destruct, rely on centralized telemetry and upstream artifacts (load balancer logs, registry image digests, CI/CD provenance).
• Work with legal/forensics to ensure preservation orders and vendor/subpoena where provider-held evidence is required.

Why this matters: combine rapid technical capture with immutable telemetry and rigorous documentation to make ephemeral evidence defensible in investigations and court.

Situation & approach
I would treat this as a network-forensics investigation: preserve originals, then reconstruct and analyze sessions for TLS manipulation and signs of exfiltration using packet-level and metadata analysis.

Reconstruction steps

• Preserve evidence (see chain-of-custody below). Work on copies only.
• Reassemble TCP streams: Wireshark -> Analyze -> Follow -> TCP Stream (or tshark -z follow,tcp,raw,…).
• Identify TLS/SSL flows: apply display filters below and export per-connection PCAPs.
• If decrypt keys are available: use server private key or session keys (NSS/SSLKEYLOGFILE) to decrypt in Wireshark and reassemble application payloads. If not, rely on metadata (sizes, timing, SNI, JA3).

Tools

• Wireshark / tshark (primary)
• Zeek (conn.log, ssl.log/http.log, files.log)
• NetworkMiner (session/file extraction)
• ssldump / openssl s_client / broctl for probing certs
• certutil / openssl x509 for certificate parsing
• Hashing tools (sha256sum) and write-once media for evidence

Wireshark/tshark filters (use in Display Filter)

• Show TLS traffic: tls or ssl
• ServerHello/ClientHello: tls.handshake.type == 1 or 2
• Certificates present: tls.handshake.type == 11
• TLS versions: tls.record.version != tls.handshake.version or tls.handshake.version < 0x0303
• Export ciphers / weak: tls.handshake.ciphersuite == 0x0003 || tls.handshake.ciphersuite contains EXPORT
• Filter by port: tcp.port == 443 or tcp.port == 8443
  Examples:
• tls and tls.handshake.type == 11
• tls and tls.record.version < 0x0303
• tcp and (ip.addr == x.x.x.x) and tls

Artifacts indicating TLS manipulation or forged certs

• Downgrade indicators:
  • ClientHello advertises higher TLS version but ServerHello selects lower version
  • Presence of TLS_FALLBACK_SCSV or absence where expected
  • Negotiated EXPORT/weak cipher suites (RSA_EXPORT, DES, 3DES)
  • Inconsistencies between record layer version and handshake version
• Forged/mitm cert artifacts:
  • Certificate issuer not matching expected CA (mismatched CN/O, short validity, unusual root)
  • Self-signed cert where CA-signed expected
  • Unexpected signature algorithm (md5, sha1) or very small key sizes (<2048 bits)
  • JA3/JA3S mismatches vs known fingerprints (use ja3 tool)
  • Repeated replacement certificates with different public keys for same server IP
  • Certificate chain missing intermediate CAs, odd SAN entries, or duplicate serial numbers
• Behavioral artifacts:
  • Unexpected SNI or absent SNI for HTTPS
  • Large outbound transfers to suspicious IPs soon after TLS session establishment
  • Multiple small POSTs or chunked uploads suggestive of staged exfiltration

Detection of exfiltration

• If decrypted: search HTTP/S payloads, POST bodies, file transfers, or proprietary app data for sensitive patterns (PII, credentials, corp domain data).
• If not decrypted:
  • Use Zeek files.log and conn.log to see large bytes_out vs bytes_in, unusual timing, or repeated connections to non-business endpoints.
  • Look for consistent destination IPs/domains with large upload volumes, anomalous ports, or uncommon protocols tunneled over TLS.
  • Correlate with DNS logs, proxy logs, endpoint logs (process names, user accounts).
  • Use entropy checks on payload sizes (high entropy often encrypted blobs), base64 signatures, or filename patterns extracted by NetworkMiner.

Evidence preservation & chain-of-custody

• Immediately create bit-for-bit copy of original PCAP; compute hashes (SHA-256, MD5) and record them.
• Maintain a written/electronic chain-of-custody: who acquired, when (UTC), how (tool, capture interface), storage location, access log.
• Work only on copies; keep originals offline/read-only.
• Log all analysis commands, tools and versions, timestamps, and produce immutable exports (PDF reports, hashed PCAP extracts).
• If presenting in legal context, snapshot workstation state, apply digital signatures to artifacts, and follow organizational/legal evidence policies.

Why this approach

• Layered: metadata can reveal exfiltration without decryption; decryption (when available) confirms content.
• Artifacts above are reliable indicators of active MITM/downgrade attempts and help prioritize which sessions to decrypt or escalate.

Example quick commands

• tshark filter for suspicious downgrades:
  bash

  tshark -r capture.pcap -Y "tls && tls.record.version != tls.handshake.version" -T fields -e frame.number -e ip.src -e ip.dst -e tls.record.version -e tls.handshake.version
  

• Extract certificates:
  bash

  tshark -r capture.pcap -Y "tls.handshake.certificate" -T fields -e tls.handshake.certificate > certs.der
  

This workflow surfaces manipulation artifacts, reconstructs sessions, and provides defensible evidence for an incident response or legal handoff.