Step 14: Conduct Wireshark Packet Capture Analysis

It is time to help the CISO with the network intrusion. Your role here is to assume responsibility of analyzing a network packet capture file that was created during the network attack. You will conduct packet sniffing with Wireshark to gather information about the attacker, determine the resources that may have been compromised during the attack, and how the attacker compromised the resources.

The CISO and response team believe there were attempts to scan the network for vulnerabilities and that an attacker may have discovered and exploited a vulnerability on one of the network servers. The attack may involve a brute-force password attack followed by a data breach where the attacker was able to download and read one or more files from a compromised server.

Your objectives are to identify the attacker, identify the compromised server and service, identify the vulnerability that was exploited, and determine what data was breached or stolen.

Your task is to enter Workspace and complete the Wireshark Packet Capture Analysis. Complete the lab report, including all answers to questions in the instructions linked below.

Complete This Lab

Resources

• Accessing the Virtual Lab Environment: Navigating UMGC Virtual Labs and Lab Setup
• Self-Help Guide (Workspace): Getting Started and Troubleshooting
• Link to the Virtual Lab Environment: https://vdi.umgc.edu/

Lab Instructions

• Wireshark Packet Capture Analysis

Getting Help

To obtain lab assistance, fill out the support request form.

Make sure you fill out the fields on the form as shown below:

• Case Type: UMGC Virtual Labs Support
• Customer Type: Student (Note: faculty should choose Staff/Faculty)
• SubType: ELM-Cyber (CST/DFC/CBR/CYB)
• SubType Detail: Pick the category that best fits the issue you are experiencing
• Email: The email that you currently use for classroom communications

In the form’s description box, provide information about the issue. Include details such as steps taken, system responses, and add screenshots or supporting documents.