What Happened on Tuesday? Incident Triage from a Packet Capture

<p>At Saffron Health Diagnostics, a fictional pathology lab chain in Hyderabad, a lab workstation "went slow on Tuesday afternoon". The network team captured its traffic. You are the on-call security analyst, and the capture is all you have.</p><p>In five lessons you learn an analyst's triage method, find how the infection arrived, recognise a domain generation algorithm (DGA) in DNS, measure a command-and-control beacon's interval, turn what you found into indicators of compromise (IOCs) and choose containment steps in the right order. You finish by writing the incident report in the Word lab, reviewed against a rubric the way a security lead would read it.</p><p>Everything runs in Bartman's in-browser Packet Lab (Wireshark-style) and Word lab. The capture is simulated and generated for you, so your hosts, domains, times and counts differ from everyone else's; nothing in it is functional malware. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).</p>

Tools: Incident response, Packet analysis, DNS, Threat hunting, IOCs, Incident reporting