Network Detection and Forensics

Why network evidence matters when endpoint evidence is gone, encrypted, or lying. The five network evidence types, the NSM philosophy, the investigation methodology, the toolchain, and the Northgate Engineering scenarios that thread through this course.

Build the Zeek and Suricata network security monitoring sensor you'll use for the entire course. SPAN port vs TAP deployment, Zeek installation and configuration, Suricata rule management, the Zeek log directory structure, BPF capture filters, sensor validation, and your first investigation queries against live data.

Full-packet capture with tcpdump and dumpcap: capture strategies, rolling captures with file rotation, BPF filter syntax for targeted investigation, PCAP file management with editcap and mergecap, evidence-grade capture procedures, and forensic acquisition from network devices and cloud environments.

DNS investigation methodology using Zeek dns.log: query pattern analysis, domain reputation, DNS tunnelling detection, passive DNS investigation, DGA detection, DNS-over-HTTPS challenges, and the DNS trail from the INC-NE-2026-0227 AiTM phishing campaign.

Investigate web-based attacks through Zeek http.log and ssl.log. HTTP request analysis, file extraction from streams, TLS fingerprinting with JA3/JA4+, certificate analysis, TLS inspection architecture, and the HTTP redirect chain from the INC-NE-2026-0227 AiTM proxy attack.

Investigate lateral movement through Windows network protocols. PsExec traffic patterns in SMB, WMI-over-DCOM execution, RDP session forensics, Windows authentication on the wire (NTLM vs Kerberos), and the INC-NE-2026-0418 ransomware lateral movement chain from IT03 to FIN01 and FS01.

Investigate SSH brute force, tunnelling, reverse shells, and encrypted channel abuse from network evidence. Zeek ssh.log analysis, HASSH client fingerprinting, detection without decryption through timing and volume analysis, VPN protocol identification, and the INC-NE-2026-0402 SSH brute force and cryptominer lateral movement investigation.

Investigate phishing campaigns through email-layer network evidence. SMTP traffic analysis with Zeek smtp.log, header extraction from captures, attachment detection, SPF/DKIM/DMARC validation, IMAP-based exfiltration patterns, the M365 visibility gap, and the INC-NE-2026-0227 email delivery reconstruction, the phishing emails that preceded the DNS queries NF3 traced and the HTTP redirects NF4 investigated.

Write, tune, and operate Suricata detection rules at production quality. Rule anatomy and lifecycle, HTTP/DNS/TLS/file detection patterns, performance and false-positive management, rule management at scale with suricata-update, Community ID integration with Zeek, environment-specific tuning, and converting the INC-NE-2026-0227 investigation into deployable detection rules.

Detect command-and-control traffic that signature-based rules miss. Beacon behavior on the wire, statistical detection methodology, long-duration connection analysis, domain fronting, Cobalt Strike malleable C2, DNS-based C2, protocol tunnelling, and the INC-NE-2026-0418 capstone that catches the ransomware campaign's pre-encryption beacons 48 hours earlier.

Detect beaconing, exfiltration, and policy violations when full packet capture isn't available. NetFlow and IPFIX fundamentals, traffic baselines, top-talker analysis, flow-only beacon detection, exfiltration indicators, long-lived connections, egress policy validation, cloud VPC flow logs, and the INC-NE-2026-0418 capstone catching rclone exfil from flow data alone.

Hunt network evidence for attacker activity you haven't built a detection rule for yet. Hypothesis-driven, data-driven, and intelligence-driven hunting across Zeek logs. User-agent hunting, DNS rarity, TLS and JA3 fingerprints, certificate anomalies, long-and-slow connections, LOLBin network signatures, lateral movement hunts, and automating hunts with Zeek scripts.

Integrate network evidence into the incident response workflow. When to pull full PCAP versus when Zeek metadata suffices, correlating Zeek conn.log to Defender XDR DeviceNetworkEvents, network-to-identity correlation against Entra sign-in logs, building the DNS-to-connection-to-transfer investigation timeline, cloud network evidence from VPC flow logs and CDN logs, evidence preservation and chain-of-custody for network artifacts, legal and regulatory posture for network monitoring, and writing the network section of the IR report. Capstone: re-investigating INC-NE-2026-0418 through the IR lens, same ransomware attack, network-evidence-led investigation, deliverable is the IR report section.

Design the network security monitoring architecture that produces the evidence used across NF3-NF12.

The NF course capstone. A multi-stage attack against Northgate Engineering, AiTM credential phishing, Cobalt Strike C2 domain-fronted through a compromised CDN, OAuth persistence, internal lateral movement via SMB and RDP, staging on the engineering file server, and exfiltration via DNS tunnelling. You work the investigation against network evidence only, no endpoint telemetry, no identity logs, no Defender XDR alerts.