Network Threat Investigation Lab

Network threat investigation is about turning traffic, logs, and context into a defensible explanation of what happened, what was affected, and what should happen next.

Welcome to the Network Threat Investigation Lab.

You have already completed the preventive-control sequence:

Network Security Fundamentals
ACL Security
Firewall Security
VPN Security

Now you will shift from:

How do we control traffic?

to:

How do we investigate traffic that looks wrong?

This lab is especially relevant for:

SOC Analysts
Network Security Analysts
Network Security Engineers
Incident Responders
Threat Hunters
Firewall Engineers
Security Consultants

🎯 Mission Information

Item	Details
Lab	Network Threat Investigation
Difficulty	Intermediate
Estimated Time	2–4 Hours
Primary Focus	Network Detection, Investigation & Incident Analysis
Target Roles	SOC Analyst, Network Security Analyst, Incident Responder
Certification Alignment	CCST Cybersecurity, CCNA, CCNP Security
Career Skill	Network Threat Analysis & Incident Investigation
Environment	Approved lab, firewall logs, VPN logs, DNS logs, packet/log datasets
Output	Investigation Timeline, Evidence Matrix, Scope Assessment, Findings & Recommendations

🏢 Mission Scenario

You are working in a Security Operations Center.

During normal monitoring, the SOC identifies several suspicious events:

one workstation repeatedly connects to an unfamiliar external IP
multiple failed VPN logins occur from the same source
an internal host scans several systems
a server begins communicating with systems it normally does not access
a privileged account authenticates shortly before unusual firewall activity

Security leadership asks:

Is this normal activity, misconfiguration, or an active security incident?

Your mission is to:

validate the events
build context
correlate evidence
determine scope
identify possible attack paths
recommend containment
document the investigation professionally

🎯 Mission Objectives

By the end of this lab, you should be able to:

analyze source and destination traffic
interpret firewall logs
review VPN authentication activity
analyze DNS evidence
recognize repeated connection patterns
identify port scanning behavior
investigate brute-force and password-spray activity
recognize possible beaconing
investigate lateral movement
correlate network and authentication evidence
build an incident timeline
determine affected systems
assess severity
recommend containment
create professional findings
answer network-security interview scenarios

📚 Prerequisites

You should understand:

IPv4 addressing
TCP/UDP
common ports
routing
ACLs
firewalls
VPNs
DNS
basic security monitoring
incident-response fundamentals

Recommended previous labs:

Firewall Security Lab
VPN Security Lab

🧠 Network Investigation Mental Model

For every suspicious event, ask:

Who / What?
   ↓
Source
   ↓
Destination
   ↓
Protocol / Port
   ↓
Security Control
   ↓
Allowed / Denied
   ↓
Time Pattern
   ↓
Context
   ↓
Scope
   ↓
Decision

🧠 The Six Questions

For every network event, answer:

1. Who?

Which host, user, or device generated the activity?

2. Where?

Which source and destination are involved?

3. What?

Which protocol or service?

4. When?

Is this isolated or repeated?

5. Why?

Is there a legitimate business explanation?

6. What Next?

What happened before and after the event?

🧪 Task 1 — Build an Investigation Worksheet

Create:

Field	Details
Case ID
Alert Source
First Seen
Last Seen
Source IP
Destination IP
Protocol
Port
User
Host
Initial Severity
Analyst

🧪 Task 2 — Review Basic Firewall Logs

Use a sample firewall event such as:

2026-08-24 10:14:21
SRC=10.10.10.25
DST=198.51.100.25
PROTO=TCP
DPT=443
ACTION=ALLOW

Identify:

timestamp
source
destination
protocol
destination port
firewall decision

🧠 Do Not Stop at “Allowed”

An allowed connection may be:

normal
unwanted
suspicious
malicious

The firewall tells you what happened to the traffic.

It does not automatically tell you why.

🧪 Task 3 — Determine Asset Ownership

For:

10.10.10.25

identify:

device name
owner
department
network segment
asset criticality

Create:

IP	Hostname	Owner	Zone	Criticality

🧠 Investigation Principle

An IP address alone is not enough.

Always connect:

IP
 ↓
Device
 ↓
User / Service
 ↓
Business Context

🧪 Task 4 — Investigate Destination Context

For the external destination ask:

domain or hostname?
known business service?
approved vendor?
cloud provider?
known suspicious infrastructure?
first time observed?

Do not label an IP malicious simply because you do not recognize it.

🔍 Part 1 — Repeated Outbound Connections

Scenario:

10.10.10.25
      ↓
198.51.100.25:443
      ↓
Every 60 Seconds

🧠 Why This Is Interesting

Regular periodic communication may indicate:

legitimate application polling
monitoring
software update checks
malware beaconing

The pattern alone does not prove compromise.

🧪 Task 5 — Build a Frequency Table

Create:

Time	Source	Destination	Port
10:00	10.10.10.25	198.51.100.25	443
10:01	10.10.10.25	198.51.100.25	443
10:02	10.10.10.25	198.51.100.25	443
10:03	10.10.10.25	198.51.100.25	443

🧠 Beaconing Question

Ask:

Is the timing unusually regular?

Then ask:

Does the endpoint have a legitimate process that explains it?

🧪 Task 6 — Identify Other Hosts Using the Destination

Check whether:

198.51.100.25

is contacted by:

one system
many systems
one department
the entire organization

🧠 Interpretation

Many corporate systems

May indicate a legitimate common service.

One unusual workstation

May deserve deeper investigation.

Context changes the risk.

🧪 Task 7 — Correlate With DNS

Review whether the source resolved a domain shortly before connection.

Example:

10:13:55
10.10.10.25
DNS QUERY:
update-service.example

Then:

10:14:01
10.10.10.25
→ 198.51.100.25:443

🧠 DNS Helps Answer

What name did the host think it was connecting to?

🔍 Part 2 — DNS Investigation

DNS logs can be valuable during investigations.

Look for:

unusual domains
high query volume
random-looking names
newly observed domains
repeated failed lookups

🧪 Task 8 — Build a DNS Evidence Table

Time	Host	Domain	Result	Notes

🧠 DNS Security Principle

A suspicious domain is stronger evidence when combined with:

suspicious process
unusual destination
related alert
abnormal timing

Do not rely on domain appearance alone.

🚨 Scenario — High DNS Failure Volume

Suppose a host generates:

a12x-test.example
b94p-test.example
z77k-test.example

repeatedly with failed responses.

Possible explanations may include:

misconfigured application
malware
algorithmically generated domains

Investigate rather than immediately classify.

🔍 Part 3 — Port Scanning

Scenario:

One internal host connects to:

10.10.20.10:22
10.10.20.10:23
10.10.20.10:80
10.10.20.10:443
10.10.20.10:445
10.10.20.10:3389

within a short period.

🧠 Possible Interpretation

This may indicate:

vulnerability scanner
administrator testing
asset-discovery tool
attacker reconnaissance

🧪 Task 9 — Create a Scan Timeline

Time	Source	Destination	Port

🧠 Ask

Is the source an approved scanner?

Is scanning expected during this window?

Does the user who owns the host normally perform this activity?

🧪 Task 10 — Compare Vertical vs Horizontal Scan Concepts

Vertical Scan

One source probes many ports on one host.

Source
 ↓
Host A : 22
Host A : 80
Host A : 443
Host A : 3389

Horizontal Scan

One source probes the same port across many hosts.

Source
 ↓
Host A : 445
Host B : 445
Host C : 445
Host D : 445

🧠 Why This Matters

The pattern helps you understand the likely objective.

🔍 Part 4 — Brute Force and Password Spray

Scenario:

Firewall/VPN logs show:

User: alice
User: bob
User: carol
User: david

Source:
203.0.113.50

Result:
FAILED

🧠 Password Spray Pattern

A small number of password attempts across many accounts may indicate:

password spraying.

🧪 Task 11 — Build an Authentication Table

Time	Source IP	Username	Result

🧪 Task 12 — Look for Successful Authentication

This is critical.

Suppose:

50 Failed Logins
      ↓
1 Successful Login

The successful event may require immediate investigation.

🧠 Do Not Focus Only on Failures

Ask:

Did any account eventually authenticate successfully?

🧪 Task 13 — Investigate the Successful User

Review:

source IP
time
MFA
VPN assignment
resources accessed
session duration

🚨 Possible Sequence

Password Spray
      ↓
Successful VPN Login
      ↓
Internal Reconnaissance
      ↓
Sensitive Server Access

🔍 Part 5 — VPN Investigation

For suspicious VPN access collect:

Username
Source IP
Authentication Result
MFA Result
Assigned VPN IP
User Group
Connected Time
Disconnected Time

🧪 Task 14 — Build a VPN Session Record

Field	Value
User
Source IP
VPN Address
Authentication
MFA
Group
Session Start
Session End

🧠 VPN Investigation Question

Ask:

What did the user do after connecting?

Authentication is only the beginning of the investigation.

Search for traffic from the assigned VPN address.

Example:

VPN User
10.50.50.25
      ↓
10.10.20.10:443
      ↓
10.10.30.10:445
      ↓
10.10.40.10:22

🚨 Security Concern

A normal employee VPN user accessing:

database systems
SMB
management SSH

may require explanation.

🔍 Part 6 — Lateral Movement

Lateral movement means an attacker moves from one compromised system to another.

Example:

Compromised User PC
        ↓
Application Server
        ↓
Database Server
        ↓
Management System

🧠 Network Indicators May Include

SMB
RDP
SSH
remote administration
unusual authentication
new inter-segment traffic

🧪 Task 16 — Build a Lateral Movement Map

Create:

HOST-A
  ↓
HOST-B
  ↓
HOST-C

For every hop document:

Source	Destination	Service	Expected?

🧠 Key Question

Ask:

Does the compromised source normally communicate with this destination?

🧪 Task 17 — Compare Against the Traffic Matrix

Use the traffic matrices created in previous labs.

Expected:

Users → Application

Not expected:

Users → Database Admin Service

This is why network documentation helps investigations.

🔍 Part 7 — Firewall Rule Changes

Scenario:

At 11:25 an administrator modifies the firewall.

At 11:27 suspicious traffic begins.

🧪 Task 18 — Create a Change Timeline

Time	Event
11:25	Firewall rule modified
11:27	New traffic path observed
11:30	External connection established

🧠 Ask

Was this an approved change?

Who made it?

Did the rule create the attack path?

🚨 High-Risk Example

New Rule:
ANY
 ↓
Internal Server
 ↓
RDP
 ↓
ALLOW

followed by external connections.

🔍 Part 8 — Denied Traffic Analysis

Denied traffic is useful, but not every deny is important.

An internet-facing firewall may constantly log scans.

🧪 Task 19 — Compare Two Deny Patterns

Pattern A

Thousands of random internet IPs scanning common ports.

Potentially routine background noise.

Pattern B

One external IP repeatedly targets a VPN portal, then successfully authenticates.

Higher investigation value.

🧠 SOC Principle

Prioritize:

behavior + context + impact.

Not raw alert count alone.

🔍 Part 9 — Baseline Normal Traffic

A baseline helps identify unusual behavior.

Examples:

normal destinations
normal ports
normal login times
normal traffic volume

🧪 Task 20 — Create a Simple Baseline

For one endpoint document:

Category	Normal
DNS	Internal resolver
Web	Common approved sites
Internal Access	Business application
Admin Ports	None
VPN	Not applicable

🧠 Why Baselines Matter

You need to know:

what normal looks like

before confidently identifying:

abnormal.

🔍 Part 10 — Build the Master Timeline

Correlate:

firewall
VPN
DNS
authentication
host information

Example:

09:04
Failed VPN Attempts

09:12
Successful VPN Login

09:15
Internal Port Scan

09:20
SMB Connection to Server

09:24
Repeated External Beacon

09:30
SOC Alert

🧪 Task 21 — Create the Investigation Timeline

Time	Source	Event	Evidence	Significance

🧠 Timeline Principle

Your timeline should tell a story.

🔍 Part 11 — Determine Scope

Do not investigate only the original alert.

Ask:

Identities

Which users are affected?

Endpoints

Which systems are involved?

Destinations

Which internal/external addresses?

Network Segments

Which zones were crossed?

Time

How long has the activity existed?

🧪 Task 22 — Build an Affected Asset Matrix

Asset	Role	Evidence	Affected?
USER-PC01	User Endpoint
APP-SRV01	Application
DB-SRV01	Database
VPN User	Identity

🧠 Blast Radius

Use:

Compromised Identity
        +
Network Access
        +
Permitted Services
        +
Trust Relationships
        =
Potential Blast Radius

🔍 Part 12 — Incident Classification

Classify:

False Positive
Benign Positive
Suspicious
Confirmed Malicious

🧠 False Positive

Detection logic incorrectly flagged legitimate behavior.

🧠 Benign Positive

The event occurred as detected, but it was approved and legitimate.

Example:

An authorized vulnerability scanner triggered a port-scan detection.

🧠 Suspicious

Evidence indicates unusual behavior, but malicious intent is not yet confirmed.

🧠 Confirmed Malicious

Evidence demonstrates unauthorized or malicious activity.

🧪 Task 23 — Write an Analyst Assessment

Use:

Assessment:

Evidence Supporting Assessment:

Evidence Against Malicious Interpretation:

Confidence:

Next Action:

🔍 Part 13 — Severity Assessment

Use:

Threat Confidence
+
Privilege
+
Network Reachability
+
Asset Criticality
+
Business Impact
=
Severity

🔴 Critical

Examples:

confirmed privileged remote compromise
active lateral movement into critical systems

🟠 High

Examples:

successful unauthorized VPN access
compromised production server
suspicious lateral movement

🟡 Medium

Examples:

reconnaissance with limited impact
suspicious beaconing not yet confirmed

🔵 Low

Examples:

benign scan requiring documentation
low-impact anomaly

🔍 Part 14 — Containment Decisions

Containment should be proportionate and authorized.

Possible actions include:

disable compromised VPN account
block malicious IP
isolate endpoint
restrict firewall traffic
revoke temporary access
quarantine network segment

⚠️ Important

Do not automatically block an IP without understanding:

whether it belongs to a legitimate provider
whether business services depend on it
whether blocking only the IP actually addresses the threat

🧪 Task 24 — Create a Containment Plan

Document:

Action	Reason	Impact	Approval

🧠 Containment Principle

Contain:

enough to stop further harm

while preserving:

evidence and business continuity where possible.

🔍 Part 15 — Evidence Preservation

Preserve relevant:

firewall logs
VPN logs
DNS logs
authentication logs
timeline evidence
network captures where authorized

🧪 Task 25 — Build an Evidence Register

Evidence ID	Source	Time	Description
EV-001	Firewall
EV-002	VPN
EV-003	DNS

🧠 Evidence Quality

Evidence should be:

timestamped
attributable
preserved
clearly documented

🔍 Part 16 — Root Cause Analysis

Do not confuse:

detection source

with:

root cause.

🚫 Weak Root Cause

Firewall alert

✅ Better Root Cause Example

Compromised VPN credentials were successfully used from an external source, and the account had excessive internal network access.

🧪 Task 26 — Document Root Cause

Use:

Initial Access:

Root Cause:

Contributing Factors:

Detection Source:

Security Control Failure:

🔍 Part 17 — Security Findings

🚨 Finding 1 — Excessive VPN Access

Finding ID:
NTI-001

Title:
Remote VPN User Had Excessive Internal Network Reachability

Severity:
High

Observation:
A remote-access user could connect directly to sensitive server and management networks.

Risk:
Compromise of the VPN account could provide broad lateral movement opportunities.

Recommendation:
Implement role-based VPN authorization and restrict remote users to required applications and networks.

🚨 Finding 2 — Missing Detection for Internal Scan

Finding ID:
NTI-002

Title:
Internal Port Scanning Was Not Detected Promptly

Severity:
Medium / High

Observation:
An internal host probed multiple systems and services without generating a timely SOC alert.

Risk:
Reconnaissance preceding lateral movement may remain unnoticed.

Recommendation:
Develop and tune detection for suspicious internal scanning while excluding approved security scanners.

🚨 Finding 3 — Insufficient Firewall Logging

Finding ID:
NTI-003

Title:
Firewall Logging Was Insufficient for Complete Investigation

Severity:
Medium

Observation:
Relevant firewall events did not contain sufficient detail or were not retained long enough for analysis.

Risk:
Security teams may be unable to reconstruct attacker activity accurately.

Recommendation:
Review logging requirements, retention, and centralized monitoring for high-value traffic.

🚨 Finding 4 — Unrestricted Lateral Access

Finding ID:
NTI-004

Title:
User Network Could Access Sensitive Administrative Services

Severity:
High

Observation:
Standard user endpoints could directly communicate with privileged management services.

Risk:
A compromised workstation could be used to attempt lateral movement toward network or server administration.

Recommendation:
Restrict administrative services to approved management networks.

🚨 Finding 5 — Weak VPN Authentication

Finding ID:
NTI-005

Title:
VPN Authentication Relied on Password-Only Access

Severity:
High

Risk:
Credential theft or password spraying could result in unauthorized remote access.

Recommendation:
Implement stronger authentication controls such as MFA where appropriate.

🔍 Part 18 — Create the Incident Report

Recommended structure:

1. Incident Summary
2. Detection Source
3. Initial Severity
4. Affected Identity
5. Affected Hosts
6. Network Evidence
7. DNS Evidence
8. VPN Evidence
9. Investigation Timeline
10. Scope
11. Analyst Assessment
12. Containment
13. Root Cause
14. Findings
15. Remediation
16. Lessons Learned

📄 Example Executive Summary

Incident ID:
NTI-2026-001

Severity:
High

Summary:
Security monitoring identified repeated failed VPN authentication attempts from an external source followed by a successful login.

Post-authentication network activity included internal scanning and unexpected access attempts toward sensitive systems.

The affected VPN account had broader internal reachability than required.

Immediate containment focused on restricting the account and validating potentially affected systems.

Longer-term remediation should strengthen VPN authentication, reduce remote-access scope, improve internal segmentation, and expand detection for suspicious network reconnaissance.

🔍 Part 19 — Threat Hunting Exercise

Start with a hypothesis:

A compromised system may be making periodic outbound connections to an unusual external destination.

🧪 Task 27 — Hunt Across Firewall Data

Search for:

repeated external destinations
similar timing intervals
one-to-many connections
unusual ports

🧠 Hunting Flow

Hypothesis
   ↓
Network Data
   ↓
Identify Pattern
   ↓
Find Hosts
   ↓
Validate
   ↓
Expand Scope

🧪 Task 28 — Hunt for Lateral Movement

Search for:

RDP
SMB
SSH
administrative services

originating from endpoints that do not normally use them.

🧪 Task 29 — Hunt for Suspicious VPN Activity

Look for:

unusual source countries/locations
repeated failures
first-time source IPs
privileged VPN users
long sessions
activity outside expected hours

🧠 Rare Does Not Mean Malicious

Use rarity as:

a reason to investigate

not:

proof.

🔍 Part 20 — Detection Engineering Connection

If your investigation identifies a reliable pattern, document a detection concept.

Example:

Threat:
Password Spray Against VPN

Telemetry:
VPN Authentication Logs

Logic:
Multiple usernames
+
Same external source
+
Repeated failures
+
Short time window

Priority:
High if followed by successful login

🧠 Hunt-to-Detection

Threat Investigation
        ↓
Repeatable Pattern
        ↓
Detection Logic
        ↓
Continuous Monitoring

🎤 Network Threat Investigation Interview Questions

Practise without notes.

1. How do you investigate suspicious network traffic?

2. What information is useful in a firewall log?

3. What is beaconing?

4. Does regular outbound traffic prove malware?

5. What is port scanning?

6. Vertical vs horizontal scanning?

7. What is password spraying?

8. Brute force vs password spray?

9. What is lateral movement?

10. Why is DNS useful during investigations?

11. Why are VPN logs important?

12. What is an incident timeline?

13. How do you determine incident scope?

14. False positive vs benign positive?

15. How do you prioritize network alerts?

16. Why is network baselining useful?

17. What information would you preserve as evidence?

19. Why is blocking an IP not always sufficient?

20. How do network segmentation controls help incident response?

🚨 Scenario Interview Question 1

One workstation connects to the same external IP every 60 seconds.

A strong response should include:

Identify Host
   ↓
Destination Context
   ↓
Timing Pattern
   ↓
DNS
   ↓
Host/Application Context
   ↓
Other Hosts
   ↓
Decision

Do not immediately declare malware.

🚨 Scenario Interview Question 2

One IP attempts 100 usernames on the VPN and eventually succeeds with one.

Investigate:

source IP
successful identity
MFA
VPN session
assigned network access
post-login activity
other attempted accounts

🚨 Scenario Interview Question 3

An internal workstation scans hundreds of ports across production servers.

Ask:

approved scanner?
user/device owner?
maintenance window?
subsequent access?
other unusual behavior?

🚨 Scenario Interview Question 4

A server begins using SMB to connect to systems it has never contacted before.

Investigate:

source identity
destinations
authentication
timing
expected business function
other lateral movement

🚨 Scenario Interview Question 5

Firewall logs show a suspicious IP was blocked. Is the incident complete?

No.

Ask:

was traffic previously allowed?
are other destinations involved?
did the source use other IPs/domains?
was an internal host already compromised?

🚨 Scenario Interview Question 6

A VPN user accesses the database and network-device management interfaces.

Discuss:

user role
authorization
business requirement
potential compromise
excessive VPN scope
segmentation

🧠 Investigation Interview Framework

Use:

Alert
 ↓
Validate
 ↓
Source
 ↓
Destination
 ↓
Identity
 ↓
Traffic Pattern
 ↓
Timeline
 ↓
Scope
 ↓
Contain
 ↓
Remediate

💬 Interview Tip

Avoid:

“I would block the IP.”

A stronger answer is:

“I would first identify the source system and user, review the destination and traffic pattern, correlate firewall, VPN, DNS, and authentication evidence, determine whether the activity is expected, identify any related systems or successful access, establish the scope, and then recommend containment based on the evidence.”

That sounds like a Network Security Analyst.

📁 Portfolio Evidence

After completing this lab, create a sanitized investigation package.

Include:

1. Incident Intake

Document:

alert
source
destination
severity

2. Network Evidence

Include:

firewall records
VPN activity
DNS events

3. Incident Timeline

Show the full chronology.

4. Attack Path

Example:

External Source
      ↓
VPN Account
      ↓
Internal Scan
      ↓
Application Server
      ↓
Sensitive Network

5. Scope Assessment

Document affected:

users
endpoints
servers
network segments

6. Security Findings

Create at least 3–5 findings.

7. Remediation Plan

Separate:

Immediate
Short Term
Strategic

📝 Resume Examples

Instead of:

Network threat investigation experience.

Use:

Investigated simulated network-security incidents by correlating firewall, VPN, DNS, authentication, and traffic evidence to identify suspicious external connections, scanning, and lateral movement.

Or:

Built incident timelines and scope assessments for simulated VPN credential compromise and internal reconnaissance scenarios, with documented containment and remediation recommendations.

Or:

Performed threat-hunting exercises across network telemetry to identify repeated outbound beaconing patterns, unusual administrative traffic, and suspicious authentication behavior.

⭐ Job-Readiness Check

After this lab, you should be able to:

interpret firewall events
review VPN authentication
analyze DNS evidence
identify repeated traffic patterns
recognize scanning behavior
recognize password-spray patterns
investigate successful login after failures
analyze lateral movement
correlate multiple telemetry sources
build incident timelines
determine incident scope
distinguish benign from suspicious activity
recommend containment
document findings professionally

If your investigation still means:

suspicious IP → block it → close ticket

repeat the correlation and scope sections.

The goal is:

Understand what happened before, during, and after the network event, determine whether the activity is malicious, identify the full scope, and apply containment based on evidence rather than assumptions.

🏆 Mission Complete

You have now completed the Cisco/network-security lab sequence:

Network Security Fundamentals
        ↓
ACL Security
        ↓
Firewall Security
        ↓
VPN Security
        ↓
Network Threat Investigation

You have progressed through:

Understand Traffic
      ↓
Control Traffic
      ↓
Secure Trust Boundaries
      ↓
Secure Remote Connectivity
      ↓
Investigate Suspicious Traffic

🚀 What’s Next?

You now have the practical skills required to move into structured professional review methodology.

➡️ Next: Network Security Assessment Runbook

In the next runbook, you will systematically assess:

network architecture
asset and subnet inventory
trust boundaries
network segmentation
ACLs
firewall placement
public exposure
management access
VPN architecture
remote-access security
routing
NAT
DNS and network services
security monitoring
logging
findings
risk rating
remediation
executive reporting

Network Threat Investigation Lab

🎯 Mission Information

🏢 Mission Scenario

🎯 Mission Objectives

📚 Prerequisites

🧠 Network Investigation Mental Model

🧠 The Six Questions

1. Who?

2. Where?

3. What?

4. When?

5. Why?

6. What Next?

🧪 Task 1 — Build an Investigation Worksheet

🧪 Task 2 — Review Basic Firewall Logs

🧠 Do Not Stop at “Allowed”

🧪 Task 3 — Determine Asset Ownership

🧠 Investigation Principle

🧪 Task 4 — Investigate Destination Context

🔍 Part 1 — Repeated Outbound Connections

🧠 Why This Is Interesting

🧪 Task 5 — Build a Frequency Table

🧠 Beaconing Question

🧪 Task 6 — Identify Other Hosts Using the Destination

🧠 Interpretation

Many corporate systems

One unusual workstation

🧪 Task 7 — Correlate With DNS

🧠 DNS Helps Answer

🔍 Part 2 — DNS Investigation

🧪 Task 8 — Build a DNS Evidence Table

🧠 DNS Security Principle

🚨 Scenario — High DNS Failure Volume

🔍 Part 3 — Port Scanning

🧠 Possible Interpretation

🧪 Task 9 — Create a Scan Timeline

🧠 Ask

🧪 Task 10 — Compare Vertical vs Horizontal Scan Concepts

Vertical Scan

Horizontal Scan

🧠 Why This Matters

🔍 Part 4 — Brute Force and Password Spray

🧠 Password Spray Pattern

🧪 Task 11 — Build an Authentication Table

🧪 Task 12 — Look for Successful Authentication

🧠 Do Not Focus Only on Failures

🧪 Task 13 — Investigate the Successful User

🚨 Possible Sequence

🔍 Part 5 — VPN Investigation

🧪 Task 14 — Build a VPN Session Record

🧠 VPN Investigation Question

🧪 Task 15 — Review Internal Traffic After VPN Login

🚨 Security Concern

🔍 Part 6 — Lateral Movement

🧠 Network Indicators May Include

🧪 Task 16 — Build a Lateral Movement Map

🧠 Key Question

🧪 Task 17 — Compare Against the Traffic Matrix

🔍 Part 7 — Firewall Rule Changes

🧪 Task 18 — Create a Change Timeline

🧠 Ask

🚨 High-Risk Example

🔍 Part 8 — Denied Traffic Analysis

🧪 Task 19 — Compare Two Deny Patterns

Pattern A

Pattern B

🧠 SOC Principle

🔍 Part 9 — Baseline Normal Traffic

🧪 Task 20 — Create a Simple Baseline

🧠 Why Baselines Matter

🔍 Part 10 — Build the Master Timeline

🧪 Task 21 — Create the Investigation Timeline

🧠 Timeline Principle

🔍 Part 11 — Determine Scope

Identities

Endpoints

Destinations

Network Segments

Time

🧪 Task 22 — Build an Affected Asset Matrix