Port scans and bad DNS

Two things worth seeing on the wire

A TCP SYN scan fires a SYN at many ports and never finishes the handshake. Filter to SYN-only packets and look at the destination host and ports:

tshark -r /srv/soc-data/network/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.dst -e tcp.dstport

In the terminal

student@vulntech:~$ tshark -r /srv/soc-data/network/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.dst -e tcp.dstport
10.10.10.5	21
10.10.10.5	22
10.10.10.5	23
10.10.10.5	25
10.10.10.5	80
10.10.10.5	110
10.10.10.5	139
10.10.10.5	143
10.10.10.5	443
10.10.10.5	445
10.10.10.5	3306
10.10.10.5	3389
10.10.10.5	5900
10.10.10.5	8080
10.10.10.5	8443

Captures also reveal DNS lookups — often the first sign of command-and-control, when a host resolves a domain it has no business contacting:

tshark -r /srv/soc-data/network/capture.pcap -Y dns -T fields -e dns.qry.name

In the terminal

student@vulntech:~$ tshark -r /srv/soc-data/network/capture.pcap -Y dns -T fields -e dns.qry.name
sync-updates-cdn.net