Exploit Kit Infection Chain Analysis
CyberOps Case 03 write-up covering Security Onion alerts, Kibana analysis, exploit-kit traffic, malware delivery, and C2 communication.
Case 03
Score: 23 / 25
Evidence Provided
- One
pcapnetwork capture
This was the third practical investigation case I completed as part of my CyberOps coursework. The case focused on analyzing a browser-based infection chain by combining packet capture analysis with alerts and event data from Security Onion.
After preparing the analysis environment, I imported the provided PCAP and reviewed the generated alerts. High-severity Suricata findings pointed toward exploit-kit activity, which gave a useful starting point for the investigation timeline.
The traffic showed an initial HTTP request to a suspicious domain, followed by redirects through hidden web content. From there, the victim was led toward exploit-kit infrastructure associated with RIG EK and SunDown EK, where the browser and an outdated Flash component were targeted before a malicious executable was delivered.
After the payload activity, I identified DNS and outbound traffic consistent with command-and-control communication. Correlating Security Onion, Kibana, Suricata alerts, and Wireshark packet evidence helped connect the full sequence from the first web request to malware delivery and later C2 behavior.
This case was especially useful because it required building a complete attack timeline from several analysis views. It also showed how IDS alerts become much more valuable when they are verified against the underlying packet evidence.
Intrusion Analysis
The final submission was prepared as a professional intrusion analysis, focusing on the most relevant findings from the investigation rather than documenting every individual alert or event.
The analysis included a structured timeline of the infection chain, supported the selected evidence from Security Onion, Kibana, and VirusTotal. The goal was to identify the key events, connect them into a coherent sequence, and present enough supporting evidence to clearly explain how the intrusion progressed from the initial activity to malware delivery and command-and-control communication.
The original submission was written in Finnish; the English version below is otherwise similar in content.