Analyze Network Traffic with Wireshark

Investigate a real malware PCAP, extract IOCs, and publish a SOC report.

Introduction

30 Second Summary

Every time you browse a website or send a message, your computer sends and receives packets of data across the network. SOC analysts use tools like Wireshark to inspect those packets and hunt for signs of malicious activity.

In this project, you will install Wireshark on an Ubuntu VM, capture live network traffic, and investigate a real malware PCAP file. You will extract indicators of compromise and publish a professional incident report to GitHub.

What You'll Build

A professional SOC analyst portfolio entry on GitHub containing a structured network traffic investigation with extracted IOCs and a formal incident report.

By the end of this project, you'll have:

  • A working Wireshark installation on Ubuntu with non-root packet capture configured.
  • A completed investigation of real malware traffic with extracted indicators of compromise (IOCs).
  • A professional incident report pushed to a GitHub portfolio repository.
  • Secret Mission: Map your findings to the MITRE ATT&CK framework and add technique IDs to your report.

Are there any prerequisites?

You should have a basic understanding of networking concepts like IP addresses, DNS, and HTTP. You also need an Ubuntu ARM64 VM with a desktop environment and a GitHub account.

Install Wireshark and Git

Before you can capture packets or push reports to a portfolio, you need the right tools on your machine.

In this step, you will install Wireshark for network traffic analysis and Git for version control.

You will also create a GitHub repository to host your SOC analyst portfolio and clone it to your VM.

In this step, get ready to:
  • Install Wireshark with non-root packet capture enabled.
  • Install and configure Git with your identity.
  • Create and clone your GitHub portfolio repository.
Install Wireshark and enable non-root capture

Wireshark is the industry-standard tool for capturing and analyzing network traffic.

By default, only the root user can capture packets on Linux. You will configure non-root access so you can run Wireshark without sudo every time.

  • Open a terminal on your Ubuntu VM.
  • Update your package list and install Wireshark by running this command:
sudo apt update && sudo apt install wireshark

What does this command do?

  • apt update refreshes your list of available packages so you get the latest version.
  • apt install wireshark downloads and installs Wireshark along with all its dependencies.

A prompt will appear during installation

During installation, a dialog asks: "Should non-superusers be able to capture packets?"

Select Yes. This configures the system to allow users in the wireshark group to capture packets without root privileges.

  • Add your user to the wireshark group by running this command:
sudo usermod -aG wireshark $USER

Why do I need to join this group?

Linux uses groups to control permissions.

The wireshark group has permission to access network interfaces for packet capture. Adding your user to this group means you can run Wireshark normally without sudo.

  • Log out of your Ubuntu session and log back in for the group change to take effect.

Wireshark still says permission denied?

  • Make sure you logged out completely and logged back in. Closing the terminal window alone is not enough.
  • Verify your group membership by running groups in a terminal. You should see wireshark in the output list.
  • If wireshark is not listed, re-run the sudo usermod -aG wireshark $USER command and log out/in again.

Help me fix Wireshark permission errors on Ubuntu

Install Git and set up your GitHub repository

Git tracks changes to your files over time. Combined with GitHub, it gives you a public portfolio that hiring managers can review.

  • Install Git by running this command:
sudo apt install git
  • Configure your Git identity by running these commands:
git config --global user.name "[[YOUR_NAME="your full name"]]"
git config --global user.email "[[YOUR_EMAIL="your email address"]]"

What does this configure?

Every Git commit records who made the change. These commands set the name and email that appear on your commits. Use the same email address you used for your GitHub account.

Now you need a repository on GitHub to host your portfolio.

  • Open your browser and go to github.com.
  • Sign in to your GitHub account.
  • Click the + icon in the top-right corner, then select New repository.
  • Enter soc-portfolio as the repository name.
  • Set the visibility to Public.
  • Check the box for Add a README file.
  • Click Create repository.

Why public?

A public repository is visible to anyone, including potential employers. SOC analyst portfolios that are publicly accessible on GitHub demonstrate your skills directly to hiring managers during job applications.

  • Clone the repository to your VM by running this command:
cd ~
git clone https://github.com/[[YOUR_GITHUB_USERNAME="your GitHub username"]]/soc-portfolio.git

What does git clone do?

git clone downloads your GitHub repository to a local folder on your VM. This creates a folder called soc-portfolio in your home directory, linked to the remote repository on GitHub.

  • Move into the cloned repository and create the project folder structure by running these commands:
cd ~/soc-portfolio
mkdir -p 01-network-traffic-analysis/evidence

What is this folder structure?

The 01-network-traffic-analysis folder holds your first investigation. The evidence subfolder is where you will save screenshots of your Wireshark findings throughout the project.

  • Confirm the folders were created by running:
ls 01-network-traffic-analysis

You should see evidence in the output.

Git clone failed or asked for a password?

  • Double-check that you typed your GitHub username correctly in the clone URL.
  • Make sure the repository name on GitHub is exactly soc-portfolio (case-sensitive).
  • If GitHub asks for authentication, you may need to set up a Personal Access Token or SSH key. Visit GitHub's docs on authentication for your preferred method.

Help me fix Git clone authentication issues with GitHub

Verify your installations
  • Confirm Wireshark is installed by running:
wireshark --version

You should see a version number in the output (the exact version depends on your Ubuntu release).

  • Confirm Git is installed by running:
git --version

You should see something like git version 2.x.x in the output.

✔️ Both commands show version numbers

Your tools are ready to go.

ⓧ Command not found for either tool

  • If wireshark --version fails, re-run sudo apt install wireshark and check for error messages.
  • If git --version fails, re-run sudo apt install git and check for error messages.
  • Make sure your internet connection is working. These commands require downloading packages from Ubuntu repositories.

Your tools are installed and your portfolio repository is ready. Next up, you will open Wireshark, capture live traffic from your own machine, and learn the display filters that SOC analysts use every day.

Capture Live Traffic and Learn Wireshark Fundamentals

Your environment is ready to go. Wireshark is installed, Git is configured, and your portfolio repository is waiting for its first investigation.

Before you analyze real malware traffic, you need to understand how Wireshark captures and displays packets. In this step, you'll run a live capture on your own machine and practice the filters that SOC analysts rely on every day.

In this step, get ready to:
  • Capture live network traffic from your machine.
  • Apply display filters to isolate specific protocols.
  • Review traffic statistics and save evidence to your portfolio.
Start a live packet capture

A packet capture records every piece of data flowing through your network interface. This is how SOC analysts collect evidence of suspicious activity on a network.

  • Press the Super key on your keyboard to open the Activities overview.
  • Type Wireshark and press Enter to open it.

You should see the Wireshark welcome screen with a list of available network interfaces.

  • Look for your active network interface in the list. It is likely called enp0s1 or eth0.
  • Double-click your active interface to start capturing packets.

Spot the active interface

The active interface usually shows a small moving sparkline graph next to its name. This indicates traffic is already flowing through that interface.

Wireshark is now recording every packet that passes through your network interface. You'll notice packets appearing in real time, but the capture might look quiet if your machine isn't doing much.

  • Open a new terminal window while keeping Wireshark running.
  • Generate some HTTP and DNS traffic by running these commands:
curl http://example.com
nslookup google.com

What do these commands do?

curl http://example.com sends an HTTP request to a web server and downloads the response. This creates TCP and HTTP packets in your capture.

nslookup google.com asks a DNS server to resolve a domain name into an IP address. This creates UDP and DNS packets in your capture.

  • Wait about 30 seconds to let any background traffic accumulate.
  • In Wireshark, click the red Stop button (square icon) in the top toolbar to stop the capture.

Your packet list should now contain several hundred packets from the traffic you generated plus any background activity.

Not seeing any packets?

If your capture shows zero packets, you likely selected an inactive interface. Close the capture, return to the welcome screen, and try a different interface from the list.

If no interfaces appear at all, your user may not be in the wireshark group yet. Make sure you logged out and back in after running sudo usermod -aG wireshark $USER in the previous step.

Help me troubleshoot why Wireshark shows no packets or no interfaces on my Ubuntu VM

Practice essential display filters

A raw packet capture contains everything from DNS lookups to background system traffic. Display filters let you narrow down to exactly the protocol or conversation you care about.

  • Click the filter bar at the top of the Wireshark window (it says "Apply a display filter").
  • Type dns and press Enter.

The packet list now shows only DNS traffic. You should see your nslookup google.com query and its response.

  • Right-click any DNS packet in the list.
  • Select Follow, then UDP Stream.

What is Follow Stream?

Following a stream reassembles all packets in a single conversation into a readable view. DNS uses UDP, so you follow the UDP stream. HTTP uses TCP, so you follow the TCP stream.

SOC analysts use this constantly to read the full contents of a suspicious connection.

  • Close the stream window by clicking Close.
  • Clear the current filter by clicking the X button on the right side of the filter bar.
  • Type http in the filter bar and press Enter.

You should now see only HTTP packets, including your curl http://example.com request and the server's response.

  • Right-click the HTTP packet that shows GET / HTTP/1.1 in the Info column.
  • Select Follow, then TCP Stream.

You should see the full HTTP conversation: your request in red and the server's HTML response in blue. This is exactly how analysts read suspicious web traffic during an investigation.

  • Close the stream window.
  • Clear the filter bar again.
  • Type tcp.port == 443 and press Enter to see HTTPS traffic.

This filter shows all encrypted web traffic. You can't read the contents (it's encrypted), but you can still see which external IPs your machine communicated with.

Three filters every SOC analyst knows

  • dns shows domain lookups. Useful for spotting malware calling home to suspicious domains.
  • http.request shows only outbound HTTP requests. Useful for finding downloads and data exfiltration.
  • tcp.port == 443 shows HTTPS connections. Useful for identifying which servers a host is communicating with.
Review traffic statistics and save evidence

Display filters show individual packets, but sometimes you need a high-level overview of an entire capture. Wireshark's Statistics menu gives you exactly that.

  • Clear any active filter so all packets are visible.
  • Click Statistics in the top menu bar.
  • Select Protocol Hierarchy.

You should see a tree view showing every protocol in your capture with percentage breakdowns. This tells you at a glance what kind of traffic dominates the capture.

Why Protocol Hierarchy matters

In a real investigation, Protocol Hierarchy is the first thing analysts check. If a capture from a web server shows 90% DNS traffic, something is wrong. Unusual protocol distributions are often the first sign of compromise.

  • Take a screenshot of the Protocol Hierarchy window. Press the Print Screen key, or use the screenshot tool in your Ubuntu applications menu.
  • Save the screenshot to your evidence folder by running this command in a terminal:
cp ~/Pictures/Screenshot*.png ~/soc-portfolio/01-network-traffic-analysis/evidence/protocol-hierarchy.png

What does this command do?

Ubuntu saves screenshots to ~/Pictures/ by default. This command copies the most recent screenshot to your evidence folder with a descriptive name.

If your screenshot saved to a different location, adjust the source path in the command accordingly.

  • Confirm the file was saved by running:
ls ~/soc-portfolio/01-network-traffic-analysis/evidence/

You should see protocol-hierarchy.png listed in the output.

Screenshot not in ~/Pictures?

Different Ubuntu versions may save screenshots to different locations. Check your ~/Desktop/ or ~/ home directory for the screenshot file.

You can also take the screenshot directly to your evidence folder using the terminal:

gnome-screenshot -f ~/soc-portfolio/01-network-traffic-analysis/evidence/protocol-hierarchy.png

Help me find where my screenshot was saved on Ubuntu so I can move it to my evidence folder

  • Close the Protocol Hierarchy window in Wireshark.
  • Click Statistics in the top menu bar again.
  • Select Conversations.

The Conversations window shows every pair of hosts that communicated during your capture. Each row shows the source and destination addresses, the number of packets exchanged, and the total bytes transferred.

How analysts use Conversations

During an investigation, analysts sort conversations by bytes to find the biggest data transfers. Large outbound transfers to unknown IPs can indicate data exfiltration.

  • Close the Conversations window.

You now have a solid foundation in Wireshark's core features. Next up, you'll put these skills to work by investigating a real malware PCAP from a professional training resource.

Download and Investigate a Malware PCAP

In the previous step, you captured live traffic from your own machine and practiced essential Wireshark filters. That was your training ground. Now it is time to apply those skills to a real investigation.

SOC analysts rarely capture traffic themselves. Instead, they receive PCAP files from network sensors and must determine what happened. In this step, you will download a real malware traffic exercise created by a professional threat researcher and investigate it like a SOC analyst would on the job.

In this step, get ready to:
  • Download a malware traffic exercise from malware-traffic-analysis.net.
  • Open the PCAP in Wireshark and identify all hosts on the network.
  • Investigate suspicious connections and document your findings.
Download the malware PCAP exercise

The site malware-traffic-analysis.net is the gold-standard resource used by professional SOC analysts for PCAP training. Each exercise provides a real-world scenario, a password-protected PCAP, and an answer key for self-verification.

  • Open your browser and navigate to the exercise page:
https://www.malware-traffic-analysis.net/2024/07/30/index.html
  • Read the scenario at the top of the page. This exercise is called "You dirty rat!" and simulates a compromised Windows host on a 172.16.1.0/24 LAN.
  • Note the network details provided: the domain controller is at 172.16.1.4 and the gateway is at 172.16.1.1.
  • Download the PCAP zip file (2024-07-30-traffic-analysis-exercise.pcap.zip, about 10.8 MB) by clicking the download link on the page.

The zip file is password-protected. You need to find the password on the site's About page.

  • Open the About page in a new tab:
https://www.malware-traffic-analysis.net/about.html
  • Look for the password scheme described on the About page. The site uses a date-based password format.
  • Extract the zip file using the password you found. You can do this in your terminal by navigating to your Downloads folder and running:
cd ~/Downloads
unzip -P infected_20240730 2024-07-30-traffic-analysis-exercise.pcap.zip

What does this command do?

The -P flag passes the password directly to unzip so it can decrypt the archive in one step.

The password format for this site is typically infected followed by an underscore and the exercise date (YYYYMMDD). If this password does not work, double check the About page for any updated scheme.

  • Confirm the PCAP file was extracted by running:
ls

You should see a .pcap file in your Downloads folder alongside the original zip.

Getting a password error?

The site occasionally updates its password scheme. Visit the About page again and look carefully for the current password format. It may be displayed as an image rather than text.

If unzip is not installed, install it by running sudo apt install unzip first.

Help me extract the password-protected PCAP zip file

Why use malware-traffic-analysis.net?

This site is maintained by Brad Duncan, a professional threat researcher. SOC teams use these exercises for training because they contain realistic malware traffic with structured answer keys.

Including this resource in your portfolio demonstrates you know where real analysts train. Hiring managers recognize this site immediately.

Open the PCAP and identify hosts on the network

Before hunting for malicious traffic, a SOC analyst always starts with the big picture. You need to understand what is normal on the network before you can spot what is abnormal.

  • Open the extracted PCAP file in Wireshark. You can do this by double-clicking the .pcap file in your file manager, or by going to File > Open inside Wireshark and navigating to your Downloads folder.
  • Go to Statistics > Conversations in the top menu bar.
  • Click the IPv4 tab in the Conversations window.
  • Identify all internal IP addresses on the 172.16.1.0/24 network. You already know 172.16.1.4 is the domain controller and 172.16.1.1 is the gateway. Any other internal IP is a potential victim.
  • Write down the victim's IP address. You will need it throughout the investigation.

How do I spot the victim IP?

In the Conversations window, look for an internal IP (starting with 172.16.1.) that is NOT 172.16.1.1 (gateway) or 172.16.1.4 (domain controller). This is the compromised host you are investigating.

Now apply filters to narrow down suspicious activity.

  • Close the Conversations window.
  • Type http.request in the display filter bar at the top of Wireshark and press Enter. This shows every outbound HTTP request the victim made.
  • Scan the results. Look for connections to external IP addresses (anything outside 172.16.1.0/24) and note any unusual domain names in the Host column.
  • Clear the filter and type dns in the display filter bar. Press Enter. This reveals every DNS query the victim made, showing you which domains it tried to reach.
  • Look for domain names that seem random, misspelled, or unrelated to normal business activity. These are likely malicious.

Sort by frequency

In the DNS results, look for domains that appear many times. Malware often "beacons" back to its command-and-control server at regular intervals, creating repeated DNS queries to the same suspicious domain.

Investigate suspicious traffic and document findings

You have identified suspicious domains and external IPs. Now you need to dig deeper into those connections to understand what data was exchanged. This is where you follow the TCP streams just like you practiced in the previous step.

  • Apply the http.request filter again.
  • Find an HTTP request to a suspicious external IP or domain that you noted earlier.
  • Right-click on that packet and select Follow > TCP Stream.

The TCP Stream window shows the full conversation between the victim and the remote server. Red text is what the victim sent. Blue text is what the server responded with.

  • Look for these signs of malicious activity in the stream:
  • File downloads with an MZ signature at the start of the response. This indicates a Windows executable was downloaded.
  • Unusual User-Agent strings that do not match standard browsers (like random characters or tool names).
  • POST requests sending data outbound. This can indicate data exfiltration or command-and-control callbacks.

What is an MZ signature?

Every Windows executable (.exe, .dll) starts with the bytes MZ. When you see this in a TCP stream response, it means the victim downloaded a program from that server. In a malware investigation, this is almost always the payload delivery.

  • Close the TCP Stream window.
  • Repeat the process for other suspicious HTTP connections. Right-click each one and follow the TCP stream.
  • As you investigate, write down every suspicious finding in a text file or on paper:
  • External IP addresses that the victim connected to.
  • Domain names resolved by suspicious DNS queries.
  • Full URLs from HTTP GET or POST requests.
  • Any file names or executables that were downloaded.

What are IOCs?

The suspicious IPs, domains, and URLs you are collecting are called Indicators of Compromise (IOCs). These are the digital fingerprints of an attack. Security teams share IOCs across organizations so everyone can block the same threats.

Finally, save evidence screenshots of your key findings.

  • Take a screenshot of the most suspicious TCP stream you found (the one showing malware delivery or C2 communication).
  • Take a screenshot of the DNS filter showing suspicious domain queries.
  • Save both screenshots to your evidence folder by running:
cp ~/Pictures/*.png ~/soc-portfolio/01-network-traffic-analysis/evidence/

What does this command do?

This copies all PNG screenshots from your Pictures folder (the default screenshot save location on Ubuntu) into your project evidence folder. If your screenshots saved elsewhere, adjust the source path accordingly.

  • Confirm the screenshots are in the evidence folder by running:
ls ~/soc-portfolio/01-network-traffic-analysis/evidence/

You should see your Protocol Hierarchy screenshot from the previous step alongside your new malware investigation screenshots.

Screenshots not in the Pictures folder?

On some Ubuntu configurations, screenshots save to ~/Screenshots or to the Desktop. Check your recent files to find where they were saved, then update the cp command with the correct source path.

You can also take screenshots directly from within Wireshark by going to File > Export Packet Dissections > As Plain Text for a text-based record of your findings.

Help me save my Wireshark investigation screenshots to my evidence folder

You have now completed your initial investigation of the malware PCAP. You have identified the victim host, found suspicious external connections, examined TCP streams for signs of malware delivery, and saved evidence screenshots. Next up, you will extract formal IOCs from these findings and identify the victim's hostname and username.

Extract IOCs and Identify the Victim

You've followed TCP streams, spotted suspicious domains, and noted external IPs that don't belong. Now it's time to formalize those findings into structured documentation that another analyst could act on.

In a real SOC, the next step after spotting suspicious traffic is always the same: identify who got hit and compile every indicator of compromise into a single reference. That's exactly what you'll do here.

In this step, get ready to:
  • Identify the victim machine's hostname, IP, MAC address, and Windows username using Wireshark filters.
  • Compile all suspicious indicators into a structured IOC document.
  • Verify your findings against the official exercise answers.
Identify the victim machine

Knowing which machine was compromised is just as important as knowing what the malware did. SOC reports always include victim details so the IT team knows exactly which device to isolate and reimage.

  • In Wireshark's display filter bar at the top, type the following filter and press Enter:
dhcp
  • Look at the DHCP packets in the results. The Host Name option in the DHCP request reveals the victim's hostname. Click on a DHCP packet and expand Dynamic Host Configuration Protocol in the packet details pane to find it.
  • If you don't see DHCP results, try the nbns filter instead. NBNS (NetBIOS Name Service) traffic also broadcasts the hostname.

What is NBNS?

NBNS stands for NetBIOS Name Service. Windows machines use it to announce their hostname on the local network. SOC analysts use nbns and dhcp filters as the go-to way to identify victim hostnames in a PCAP.

  • Now find the Windows username. Type this filter in the display filter bar and press Enter:
kerberos.CNameString
  • Expand the Kerberos section in the packet details pane. The CNameString field shows the Windows username that authenticated on the victim machine.
  • Note the victim's MAC address from the Ethernet header of any packet from the victim's IP. Click on any packet from the victim IP and look at the Ethernet II section in the packet details pane. The Source field shows the MAC address.

What is Kerberos?

Kerberos is the authentication protocol that Windows domain-joined machines use to verify user identity. When a user logs in, their username appears in Kerberos packets as the CNameString field.

This is why the kerberos.CNameString filter is so valuable for incident response. It ties network activity directly to a human user account.

You should now have four victim details recorded: IP address, MAC address, hostname, and Windows username.

Not seeing Kerberos traffic?

Some PCAPs may not contain Kerberos packets if the capture started after the user had already authenticated. Try broadening your filter to kerberos to see all Kerberos traffic. If still empty, check for other user-identifying protocols like SMB traffic.

Help me find the Windows username in my PCAP when kerberos.CNameString returns no results

Compile your Indicators of Compromise

An IOC (Indicator of Compromise) is any artifact that identifies malicious activity. IP addresses, domain names, URLs, and file hashes are the most common types.

SOC teams share IOCs so that firewalls, SIEMs, and EDR tools can automatically block or alert on future matches. Your IOC document needs to be structured so other analysts can consume it quickly.

  • Before creating your IOC file, check whether any files were downloaded during the infection. In Wireshark, click File in the top menu bar.
  • Select Export Objects, then click HTTP.
  • Review the list of HTTP objects. Look for files with suspicious names or large sizes. If you see executable files (.exe, .dll) or other suspicious downloads, select them and click Save to export them to your evidence/ folder.

Why export HTTP objects?

Exported files let you calculate SHA256 hashes, which are the most precise IOC type. A hash uniquely identifies a specific malicious file. Security teams use hashes to scan their entire network for the same malware.

  • If you exported any files, generate their SHA256 hashes by running this command in your terminal:
sha256sum ~/soc-portfolio/01-network-traffic-analysis/evidence/*
  • Now create the IOC document. Open a terminal and create iocs.md by running:
nano ~/soc-portfolio/01-network-traffic-analysis/iocs.md
  • Paste the following template into the file, then replace the placeholder values in parentheses with the actual IOCs you noted during your investigation in the previous step:
# Indicators of Compromise

## Network Indicators

### Suspicious IP Addresses

| IP Address | Context | Direction |
|-----------|---------|----------|
| (external IP) | C2 server | Outbound |
| (external IP) | Payload delivery | Outbound |

### Suspicious Domains

| Domain | Resolution | Context |
|--------|-----------|----------|
| (domain) | (IP) | Malware delivery |
| (domain) | (IP) | C2 communication |

### Suspicious URLs

| URL | Method | Context |
|-----|--------|----------|
| (full URL) | GET | Payload download |
| (full URL) | POST | Data exfiltration |

## File Indicators

| SHA256 Hash | Filename | Size | Context |
|-------------|----------|------|----------|
| (hash) | (name) | (size) | Downloaded payload |

## Notes

- Source PCAP: malware-traffic-analysis.net exercise (2024-07-30)
- Analysis performed with Wireshark on Ubuntu ARM64

What does each section capture?

The Suspicious IP Addresses table lists external IPs the victim connected to. The Context column explains what that IP was used for (C2 callback, payload delivery, data exfiltration).

The File Indicators table is only needed if you exported files from Wireshark. If no suspicious files were downloaded in the PCAP, you can remove this section or leave it empty.

  • Replace every placeholder in parentheses with your actual findings. Add or remove table rows as needed to match what you discovered.
  • Save the file by pressing Ctrl+O then Enter, and exit nano by pressing Ctrl+X.
  • Confirm the file was created by running:
ls ~/soc-portfolio/01-network-traffic-analysis/

You should see iocs.md and evidence/ listed in the output.

Don't see iocs.md in the listing?

Make sure you saved the file in nano before exiting. Press Ctrl+O to write the file, confirm the filename with Enter, then Ctrl+X to exit. If you accidentally exited without saving, run the nano command again and re-paste the template.

Help me create my iocs.md file in the correct location

Verify your findings against the official answers

Every malware-traffic-analysis.net exercise includes an answers page so you can check your work. Comparing your findings against the official answers is how you build confidence in your analysis skills.

  • Go back to the exercise page at https://www.malware-traffic-analysis.net/2024/07/30/index.html in your browser.
  • Scroll to the bottom of the page and click the link to the answers page.
  • Compare your victim details (hostname, IP, MAC, username) against the official answers.
  • Compare your IOC list (IPs, domains, URLs, file hashes) against the official answers.
  • If you missed any indicators, go back to Wireshark and try to find them. Use the official answers as guidance for what filters or streams to investigate.
  • Update your iocs.md with any IOCs you missed, then save the file.

Missing indicators is normal

Professional analysts miss things too. The point of checking answers is not to get a perfect score. It's to learn which traffic patterns and filter techniques you need to practice more. Every missed IOC teaches you something about how to look next time.

✔️ Awesome, I've got everything!

Great. Double check you've saved your iocs.md file with all your findings filled in.

ⓧ I'd like to double check the full code

Here's what your complete iocs.md should look like (with your actual findings replacing the placeholders):

# Indicators of Compromise

## Network Indicators

### Suspicious IP Addresses

| IP Address | Context | Direction |
|-----------|---------|----------|
| (external IP) | C2 server | Outbound |
| (external IP) | Payload delivery | Outbound |

### Suspicious Domains

| Domain | Resolution | Context |
|--------|-----------|----------|
| (domain) | (IP) | Malware delivery |
| (domain) | (IP) | C2 communication |

### Suspicious URLs

| URL | Method | Context |
|-----|--------|----------|
| (full URL) | GET | Payload download |
| (full URL) | POST | Data exfiltration |

## File Indicators

| SHA256 Hash | Filename | Size | Context |
|-------------|----------|------|----------|
| (hash) | (name) | (size) | Downloaded payload |

## Notes

- Source PCAP: malware-traffic-analysis.net exercise (2024-07-30)
- Analysis performed with Wireshark on Ubuntu ARM64

Your IOC document and victim identification are complete. Next up, you'll write a professional incident report and push your entire investigation to GitHub as a portfolio entry.

Write Your Incident Report and Push to GitHub

You have identified the victim, compiled your IOCs, and verified your findings against the official answers. The investigation work is done.

Now you need to turn those findings into a professional deliverable. In a real SOC, every investigation ends with a structured report that other analysts, managers, and incident responders can act on. You will write that report and push your entire portfolio to GitHub so it is publicly visible to hiring managers.

In this step, get ready to:
  • Write a structured incident report documenting your investigation findings.
  • Create a portfolio README that introduces your SOC analyst work.
  • Push all files to GitHub and verify your repository is published.
Create your incident report

A SOC incident report follows a consistent structure so that anyone reading it can quickly understand what happened, who was affected, and what indicators to block. Your report will include all the standard sections that professional SOC teams use.

  • Open your file manager or text editor.
  • Create a new file called report.md inside your ~/soc-portfolio/01-network-traffic-analysis/ folder.
  • Paste the following template into the file, then fill in the placeholder sections with the actual findings from your investigation:
# Network Traffic Analysis Investigation

## Case Overview

Investigation of a suspicious network traffic capture from a Windows host on the 172.16.1.0/24 network. The goal is to identify malicious activity, determine the scope of compromise, and extract indicators of compromise for blocking and detection.

## Victim Details

- **Hostname**: (identified from NBNS/DHCP traffic)
- **IP Address**: (identified from conversations)
- **MAC Address**: (identified from Ethernet headers)
- **Windows User Account**: (identified from Kerberos traffic)

## Investigation Steps

1. Opened the PCAP in Wireshark and reviewed Statistics > Conversations to identify all hosts
2. Filtered for HTTP requests (`http.request`) to identify external connections
3. Filtered for DNS queries (`dns`) to identify suspicious domain lookups
4. Followed TCP streams on suspicious connections to examine payloads
5. Used File > Export Objects > HTTP to extract any downloaded files
6. Identified victim host details using DHCP/NBNS/Kerberos filters

## Key Findings

(Document what happened in chronological order based on timestamps in the PCAP)

1. [Timestamp] - Victim made DNS query for [suspicious domain]
2. [Timestamp] - HTTP GET request to [suspicious URL]
3. [Timestamp] - Downloaded executable file ([hash if extracted])
4. [Timestamp] - Post-infection callback traffic to [C2 IP]

## Indicators of Compromise

See [iocs.md](./iocs.md) for the complete list.

## Conclusion

(State whether the host was compromised, what type of malware was involved, and what the impact was)

## Tools Used

- Wireshark (packet analysis)
- malware-traffic-analysis.net (PCAP source)

What does this report structure do?

Each section serves a specific audience. Case Overview gives managers the 30-second context. Victim Details tells the IT team which machine to isolate. Key Findings provides the timeline for other analysts to verify.

The Indicators of Compromise section references your separate iocs.md file so that detection engineers can quickly pull IPs and domains to block without reading the full narrative.

  • Replace every placeholder in parentheses with your actual findings from the investigation. Use the victim details you recorded from DHCP, NBNS, and Kerberos filters. Fill in Key Findings with real timestamps and events from the PCAP.
  • Save report.md.

Use Wireshark timestamps for Key Findings

Go back to your Wireshark PCAP and look at the Time column for each suspicious packet you identified. Copy the actual timestamps into your Key Findings section. Real incident reports always include precise times so other analysts can correlate events.

Not sure what to write in the Conclusion?

Refer back to the answers page you checked on malware-traffic-analysis.net. Your conclusion should state: was the machine compromised (yes/no), what type of malware or attack was involved, and what actions the attacker took after initial compromise.

Help me write a conclusion for my incident report

Create your portfolio README

A portfolio README is the landing page of your GitHub repository. Hiring managers will see this first, so it needs to clearly communicate what skills you are demonstrating and link to each investigation.

  • Create a new file called README.md in the root of your ~/soc-portfolio/ folder (not inside the 01-network-traffic-analysis subfolder).
  • Paste the following content into the file:
# SOC Analyst Portfolio

Hands-on SOC investigation portfolio demonstrating practical skills in network traffic analysis, threat detection, and incident reporting.

## Investigations

| # | Title | Skills | Tools |
|---|-------|--------|-------|
| 01 | [Network Traffic Analysis](./01-network-traffic-analysis/report.md) | PCAP analysis, IOC extraction, incident reporting | Wireshark |

## Skills Demonstrated

- PCAP analysis using Wireshark
- Network traffic investigation
- Suspicious IP/domain identification
- DNS and HTTP traffic analysis
- IOC identification and extraction
- Incident reporting
- Git version control

## About

This portfolio documents hands-on security investigations completed as part of my SOC analyst training. Each investigation follows a consistent methodology: triage, investigate, extract IOCs, and document findings.

What does this README do?

The Investigations table gives a quick overview of every project in your portfolio. As you complete more investigations, you will add rows to this table. The link in the Title column points directly to your report so readers can jump straight to your analysis.

The Skills Demonstrated section is what recruiters scan for when filtering candidates. It maps directly to the keywords in SOC analyst job postings.

  • Save README.md.
  • Confirm your folder structure looks correct by running this command from inside ~/soc-portfolio/:
ls -R

You should see README.md at the top level, and inside 01-network-traffic-analysis/ you should see report.md, iocs.md, and the evidence/ folder with your screenshots.

Missing files in the output?

Make sure you are running ls -R from inside the ~/soc-portfolio/ directory. If you see only one file, double check that you saved README.md in the root folder and report.md inside 01-network-traffic-analysis/.

Help me fix my folder structure

Push your portfolio to GitHub

Your files are ready locally. Now you need to commit them to Git and push them to your remote repository on GitHub so they are publicly visible.

  • Open a terminal and navigate to your repository folder by running:
cd ~/soc-portfolio
  • Stage all your files for commit by running:
git add .
  • Create a commit with a descriptive message by running:
git commit -m "Add network traffic analysis investigation"
  • Push your commit to GitHub by running:
git push origin main

What do these commands do?

  • git add . stages every new and modified file in the current directory for the next commit.
  • git commit -m saves a snapshot of all staged files with a message describing what changed.
  • git push origin main uploads your local commits to the main branch on GitHub so others can see them.

You should see output showing your files being uploaded, ending with a line like main -> main.

  • Open your browser and navigate to your repository at https://github.com/YOUR-USERNAME/soc-portfolio (replace YOUR-USERNAME with your GitHub username).
  • Verify that the README.md renders on the repository homepage with the SOC Analyst Portfolio heading and your Investigations table.
  • Click into the 01-network-traffic-analysis folder and confirm report.md, iocs.md, and the evidence/ folder are all visible.

Push rejected or authentication failed?

If you see an authentication error, GitHub no longer accepts passwords for Git operations. You need to use a Personal Access Token (PAT) or SSH key. Go to GitHub > Settings > Developer settings > Personal access tokens > Generate new token. Use the token as your password when prompted.

If you see "rejected - non-fast-forward", it means your remote has commits that are not on your local branch. Run git pull origin main --rebase first, then try pushing again.

Help me push my code to GitHub

✔️ Awesome, I've got everything!

Great. Double check that you have saved both files and that your GitHub repository shows the full portfolio.

ⓧ I'd like to double check the full code

Here is the complete content for each file in your repository.

# SOC Analyst Portfolio

Hands-on SOC investigation portfolio demonstrating practical skills in network traffic analysis, threat detection, and incident reporting.

## Investigations

| # | Title | Skills | Tools |
|---|-------|--------|-------|
| 01 | [Network Traffic Analysis](./01-network-traffic-analysis/report.md) | PCAP analysis, IOC extraction, incident reporting | Wireshark |

## Skills Demonstrated

- PCAP analysis using Wireshark
- Network traffic investigation
- Suspicious IP/domain identification
- DNS and HTTP traffic analysis
- IOC identification and extraction
- Incident reporting
- Git version control

## About

This portfolio documents hands-on security investigations completed as part of my SOC analyst training. Each investigation follows a consistent methodology: triage, investigate, extract IOCs, and document findings.
# Network Traffic Analysis Investigation

## Case Overview

Investigation of a suspicious network traffic capture from a Windows host on the 172.16.1.0/24 network. The goal is to identify malicious activity, determine the scope of compromise, and extract indicators of compromise for blocking and detection.

## Victim Details

- **Hostname**: (identified from NBNS/DHCP traffic)
- **IP Address**: (identified from conversations)
- **MAC Address**: (identified from Ethernet headers)
- **Windows User Account**: (identified from Kerberos traffic)

## Investigation Steps

1. Opened the PCAP in Wireshark and reviewed Statistics > Conversations to identify all hosts
2. Filtered for HTTP requests (`http.request`) to identify external connections
3. Filtered for DNS queries (`dns`) to identify suspicious domain lookups
4. Followed TCP streams on suspicious connections to examine payloads
5. Used File > Export Objects > HTTP to extract any downloaded files
6. Identified victim host details using DHCP/NBNS/Kerberos filters

## Key Findings

(Document what happened in chronological order based on timestamps in the PCAP)

1. [Timestamp] - Victim made DNS query for [suspicious domain]
2. [Timestamp] - HTTP GET request to [suspicious URL]
3. [Timestamp] - Downloaded executable file ([hash if extracted])
4. [Timestamp] - Post-infection callback traffic to [C2 IP]

## Indicators of Compromise

See [iocs.md](./iocs.md) for the complete list.

## Conclusion

(State whether the host was compromised, what type of malware was involved, and what the impact was)

## Tools Used

- Wireshark (packet analysis)
- malware-traffic-analysis.net (PCAP source)
# Indicators of Compromise

## Network Indicators

### Suspicious IP Addresses

| IP Address | Context | Direction |
|-----------|---------|----------|
| (external IP) | C2 server | Outbound |
| (external IP) | Payload delivery | Outbound |

### Suspicious Domains

| Domain | Resolution | Context |
|--------|-----------|--------|
| (domain) | (IP) | Malware delivery |
| (domain) | (IP) | C2 communication |

### Suspicious URLs

| URL | Method | Context |
|-----|--------|--------|
| (full URL) | GET | Payload download |
| (full URL) | POST | Data exfiltration |

## File Indicators

| SHA256 Hash | Filename | Size | Context |
|-------------|----------|------|--------|
| (hash) | (name) | (size) | Downloaded payload |

## Notes

- Source PCAP: malware-traffic-analysis.net exercise (2024-07-30)
- Analysis performed with Wireshark on Ubuntu ARM64

Secret mission

Map Your Findings to the MITRE ATT&CK Framework

Real SOC teams don't just find IOCs. They classify attacker behavior using the MITRE ATT&CK framework to communicate findings in a shared language. Map your investigation to specific technique IDs and elevate your report to hiring-manager quality.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally on your Ubuntu VM, so there are no ongoing costs. Decide whether to keep your resources as they are, pause them to come back later, or delete them entirely.

Resources you used:

  • Wireshark installation on your Ubuntu VM.
  • Git CLI installation and global configuration.
  • Local soc-portfolio repository clone on your VM.
  • GitHub remote repository (soc-portfolio).
  • Downloaded PCAP file from malware-traffic-analysis.net.
  • Evidence screenshots in your evidence/ folder.

Keep everything running

No action needed. Choose this if you plan to continue adding investigations to your SOC portfolio or want to practice more Wireshark analysis.

  • Your Wireshark installation stays ready for future PCAP analysis.
  • Your GitHub repository remains public as a portfolio piece.
  • Your local files stay on disk for reference.

Pause - I'll come back to this later

Keep your installations but clean up temporary files to free disk space.

  • Delete the downloaded PCAP zip file if you still have it (the extracted PCAP is enough).
  • Keep Wireshark and Git installed so you can pick up where you left off.
  • Your GitHub repository stays online as your portfolio.

Delete - I don't want to use this again

Remove all project resources from your VM and GitHub.

  • Delete the local soc-portfolio folder from your VM.
  • Delete the GitHub repository by going to your repository's Settings page, scrolling to the bottom, and clicking Delete this repository.
  • Uninstall Wireshark by running sudo apt remove wireshark in your terminal.
  • Remove your user from the wireshark group by running sudo deluser $USER wireshark.
  • Delete any downloaded PCAP files from your Downloads folder.

Nice Work!

Nice Work!

You just completed your first SOC investigation and published it as a professional portfolio entry on GitHub. This is the exact workflow hiring managers look for when evaluating SOC analyst candidates.

Here's what you accomplished:

  • Investigated a real malware PCAP from malware-traffic-analysis.net and extracted indicators of compromise including suspicious IPs, domains, URLs, and file hashes.
  • Wrote a structured incident report with victim details, investigation steps, key findings, and IOC documentation following SOC analyst standards.
  • Built a professional SOC analyst portfolio on GitHub using Git CLI with a structured repository, evidence screenshots, and clear documentation.
  • Secret Mission: Mapped attacker behavior to the MITRE ATT&CK framework with technique IDs and evidence.

Ready to quiz yourself?