This project simulates attacker activity from a Kali Linux machine against a Windows victim machine in an isolated VirtualBox environment. The goal of this lab is to analyze network traffic from a SOC analyst perspective using Wireshark.
The investigation focuses on identifying host discovery, port scanning, service enumeration, SMB enumeration, RDP activity, SSH authentication attempts, and HTTP file transfer activity through packet-level evidence.
This project demonstrates foundational networking knowledge, packet analysis, traffic interpretation, IOC documentation, MITRE ATT&CK mapping, and SOC-style technical reporting.
- Build an isolated two-VM network lab.
- Simulate attacker traffic from Kali Linux to a Windows victim machine.
- Capture network traffic using Wireshark.
- Analyze ICMP, TCP, SMB, RDP, SSH, and HTTP traffic.
- Identify suspicious activity using packet evidence.
- Document indicators of compromise.
- Map observed activity to the MITRE ATT&CK framework.
- Create a technical investigation report suitable for a SOC analyst portfolio.
| Component | Description |
|---|---|
| Attacker Machine | Kali Linux |
| Victim Machine | Windows |
| Hypervisor | VirtualBox |
| Network Type | Host-Only Adapter |
| Packet Analysis Tool | Wireshark |
| Attacker IP | 192.168.37.4 |
| Victim IP | 192.168.37.5 |
This lab was configured using a VirtualBox host-only network. This allowed the attacker and victim machines to communicate with each other while keeping the lab isolated from external networks.
| Tool | Purpose |
|---|---|
| Wireshark | Packet capture and traffic analysis |
| Nmap | Port scanning and service enumeration |
| smbclient | SMB share enumeration |
| SSH | Authentication attempt simulation |
| Python HTTP Server | Hosted files for HTTP download simulation |
| curl | Downloaded files from the attacker-hosted HTTP server |
| VirtualBox | Local virtualization environment |
| Phase | Activity | Source | Destination |
|---|---|---|---|
| 1 | ICMP Host Discovery | Kali | Windows |
| 2 | Nmap SYN Scan | Kali | Windows |
| 3 | Service Enumeration | Kali | Windows |
| 4 | SMB Enumeration | Kali | Windows |
| 5 | RDP Connection Attempts | Kali | Windows |
| 6 | SSH Authentication Attempts | Kali | Windows |
| 7 | HTTP File Download | Windows | Kali |
- ICMP traffic confirmed that the Kali attacker machine identified the Windows victim as reachable.
- Nmap scanning activity showed multiple TCP SYN packets targeting the victim machine.
- Service enumeration identified exposed services including SSH, SMB, and RDP.
- SMB traffic showed share enumeration activity over TCP port
445. - RDP traffic showed remote access exposure and connection metadata over TCP port
3389. - SSH traffic showed repeated authentication attempts over TCP port
22. - HTTP traffic showed the Windows victim downloading dummy executable files from the Kali attacker machine over TCP port
8000.
| Protocol / Traffic Type | Analyst Focus |
|---|---|
| ICMP | Host discovery and reachability |
| TCP | SYN scanning and connection behavior |
| SMB | Share enumeration and Windows file-sharing activity |
| RDP | Remote access exposure and encrypted session metadata |
| SSH | Authentication attempt patterns |
| HTTP | Cleartext file download and suspicious file transfer |
| IOC Type | Value | Description |
|---|---|---|
| Attacker IP | 192.168.37.4 |
Kali Linux attacker VM |
| Victim IP | 192.168.37.5 |
Windows victim VM |
| Port | 22 |
SSH authentication attempts |
| Port | 445 |
SMB enumeration |
| Port | 3389 |
RDP exposure / connection attempts |
| Port | 8000 |
Python HTTP server hosted by attacker |
| File Name | update.exe |
Dummy file downloaded over HTTP |
| File Name | password.exe |
Dummy file downloaded over HTTP |
| Attack Phase | Activity | Technique |
|---|---|---|
| Host Discovery | ICMP Echo Requests | Remote System Discovery - T1018 |
| Port Scanning | Nmap SYN Scan | Network Service Discovery - T1046 |
| Service Enumeration | Nmap Version Detection | Network Service Discovery - T1046 |
| SMB Enumeration | SMB Share Listing | Network Share Discovery - T1135 |
| RDP Discovery | RDP Port Identified | Network Service Discovery - T1046 |
| SSH Attempts | Repeated SSH Authentication Attempts | Brute Force: Password Guessing - T1110.001 |
| HTTP File Download | Files Downloaded from Attacker HTTP Server | Ingress Tool Transfer - T1105 |
| HTTP on Non-Standard Port | HTTP Traffic over TCP 8000 | Non-Standard Port - T1571 |
| Artifact | Description |
|---|---|
| Network Investigation Report | Technical packet analysis report |
| Raw PCAP Files | Packet captures used for analysis |
| Screenshots | Evidence screenshots from Wireshark and terminal output |
This project was performed in a controlled lab environment using simulated attacker activity. No real malware was used. Files such as update.exe and password.exe were harmless dummy files created to generate observable HTTP file transfer traffic.
Encrypted protocols such as SSH and RDP did not reveal session contents in Wireshark. Analysis of those protocols was based on metadata such as source IP, destination IP, destination port, connection timing, and session behavior.
- Network traffic analysis
- Wireshark packet investigation
- TCP/IP fundamentals
- Host discovery analysis
- Port scanning detection
- Service enumeration analysis
- SMB traffic analysis
- SSH and RDP traffic identification
- HTTP file transfer analysis
- IOC documentation
- MITRE ATT&CK mapping
- SOC-style technical reporting
This project reinforced how attacker behavior appears in network traffic and how packet captures can be used to reconstruct an attack timeline. The lab showed the difference between cleartext protocols, such as HTTP, and encrypted protocols, such as SSH and RDP.
The project also demonstrated that SOC analysts must correlate multiple pieces of evidence instead of relying on one event alone. ICMP traffic, Nmap scan patterns, SMB enumeration, authentication attempts, and HTTP file transfers each provided part of the larger investigation.
This lab demonstrated how simulated attacker activity can be captured, analyzed, and documented from a SOC analyst perspective. By investigating ICMP, TCP, SMB, RDP, SSH, and HTTP traffic, this project shows foundational network analysis skills that are directly relevant to entry-level SOC work.
The final investigation report documents the packet evidence, indicators of compromise, protocol behavior, and MITRE ATT&CK mappings used to interpret the simulated attack chain.