Use tools to determine malicious activity
Wireshark, packet capture, log analysis, endpoint and email tooling, sandboxing, and the common file/hash analysis utilities.
- Reading time
- 30 min read
- Flashcards
- 18 cards
- Practice questions
- 10 questions · 2 PBQs
1.2 was symptom to diagnosis. This is the toolbox that produces the symptoms — and the exam's question is nearly always which tool answers this question, not what does this tool do.
So the organising idea is: every tool answers one kind of question. Learn the question, and the tool follows.
Network analysis
Wireshark
Full packet capture with a graphical decoder. Answers "what exactly was in this traffic" — protocol fields, payloads, TLS handshake details, reassembled streams. Heavy, and needs the packets to have been captured in the first place.
tcpdump
Command-line capture. Answers the same question as Wireshark but works over SSH on a server with no GUI, which is where you usually are. Capture with tcpdump, analyse in Wireshark.
WHOIS
Registration data for a domain or IP block. Answers "who owns this, and when was it registered". A domain registered eleven days ago is a finding in itself.
AbuseIPDB and reputation services
Community-reported reputation for an IP or domain. Answers "has anyone else seen this being malicious". Useful corroboration, never proof on its own.
| Question you need answered | Tool |
|---|---|
| What was inside that traffic? | Wireshark |
| Capture traffic on a headless server | tcpdump |
| Who registered this domain, and when? | WHOIS |
| Has this IP been reported before? | AbuseIPDB / reputation feeds |
| Which hosts talked to whom, and how much? | Flow data (NetFlow / IPFIX) |
File analysis
Hashing
A file's fingerprint, usually SHA-256. Answers "is this the same file we saw elsewhere" and "is this a known-bad sample". Change one byte and the hash changes entirely — which is why attackers recompile.
strings
Extracts human-readable text from a binary. Answers "what does this thing reference" — URLs, IP addresses, registry keys, error messages. The fastest first look at an unknown sample, and it requires no execution.
VirusTotal
Multi-engine scanning and community intelligence for a file hash or URL. Answers "does anyone recognise this".
Sandboxing
Detonating a sample in an instrumented, isolated environment to observe what it does: files written, registry keys set, network destinations contacted. Answers "what does this actually do", and produces IOCs you can hunt with.
Sandbox evasion is examinable. Malware checks for signs it is being watched — small disk, few running processes, no mouse movement, known VM artefacts, or simply sleeping longer than the analysis window — and behaves benignly if it finds them. A clean sandbox verdict is not proof the file is safe.
Check yourself
An analyst receives a suspicious document from an executive's mailbox in a suspected targeted attack. What is the appropriate first analysis step?
Log and SIEM analysis
SIEM
Central collection, normalisation and correlation of logs, with alerting and search. Answers "what happened across the estate", which no single log source can.
SIEM
- Collects, normalises, correlates, alerts
- Answers what happened
- Output is an alert or a search result
SOAR
- Orchestrates and automates the response
- Answers what to do about it
- Output is an executed playbook
The tellSIEM detects, SOAR responds. If a question asks about automating enrichment or containment steps, it is SOAR territory even when the trigger came from the SIEM.
Search discipline is a tool in its own right. Regular expressions and command-line filtering (grep, cut, sort | uniq -c) turn a million lines into ten. The exam expects you to recognise that pattern recognition and scripting are analyst skills, not developer skills.
Endpoint tooling
EDR
Continuous endpoint telemetry — process creation with full lineage, file writes, registry changes, network connections — plus the ability to isolate a host remotely. Answers "what happened on this machine, and can I stop it now".
Remote isolation matters more than it looks. It contains a host while keeping it powered on and reachable to you, so evidence in memory survives — which pulling the network cable, or powering off, destroys.
Email analysis
Email is the commonest delivery vector, so its tooling is examined in detail.
Header analysis
The Received: chain, read bottom to top, shows the path a message actually took. The From: header is display text and can say anything; the envelope sender and the Received chain are the evidence.
- SPF — is this sending IP authorised to send for that domain? Publishes authorised senders in DNS.
- DKIM — is the message cryptographically signed and unmodified in transit?
- DMARC — given SPF and DKIM results, what should the receiver do (none, quarantine, reject), and where should reports go? DMARC also enforces alignment: the domain that passed SPF or DKIM must match the visible
From:domain.
That alignment requirement is the point of DMARC. Without it, an attacker passes SPF for a domain they control while displaying a From: of your bank.
Impersonation techniques
Display-name spoofing (From: "IT Helpdesk" <attacker@gmail.com>), lookalike domains (rn for m, paypa1.com), and compromised legitimate accounts — the last defeats all three authentication checks, because the mail genuinely is from that domain.
Check yourself
A phishing email passes SPF, DKIM and DMARC. What is the most likely explanation?