Network traffic is the one data source an attacker can't easily fake once they're on the wire. Five real malware pcaps from malware-traffic-analysis.net, each fully investigated: C2 identification, exfiltration timelines, MITRE ATT&CK mapping, Sigma rules, and IOC exports — using Wireshark, tcpdump, Zeek, and NetworkMiner.
This is a SOC-analyst-style body of work built entirely on real packet captures: one baseline of my own "normal" traffic, and five real malware samples pulled from malware-traffic-analysis.net, each fully investigated end-to-end using the same four tools a SOC actually runs.
Real correlation, not staged
Two independent cases in this lab (a C2 beacon and a NetSupport RAT install) turned out to share a byte-for-byte identical C2 beacon protocol despite different dates, IPs, and victim environments — a real cross-case correlation discovered during investigation, not something written into the plan.
Walkthrough
Step 1 — Establish a baseline of normal traffic
Before hunting malware, 25 seconds of my own real traffic were captured (dumpcap -i 1 -a duration:25) while browsing GitHub/Python.org/Cloudflare and running DNS lookups — 11,430 packets. This gives every malware case something to be compared against.
TLS/HTTPS-dominant, real DNS, QUIC, NTP, ARP, 3 benign plain-HTTP requests. No suspicious domains, no C2-shaped traffic — the "normal" against which every case below stands out.
51,181 packets, real HTTP/TLS/Kerberos/LDAP/SMB traffic — a full small-office AD environment captured mid-infection.
Step 3-4 — Conversations, then filter to the suspicious one
One conversation stands out: 10.1.21.58 ↔ 153.92.1.49, plain HTTP, non-Microsoft/non-cloud IP — the first real lead.ip.addr==153.92.1.49 && http isolates 12 packets: bot-registration + exfiltration pattern, repeated once per browser.
Step 5 — Follow HTTP Stream
Request goes to Host: whitepepper.su. The response fingerprints the browser (navigator.platform, hardwareConcurrency, deviceMemory) before the harvesting POST — reading the full stream instead of assuming "just an ack" is what caught this.
Step 6-7 — Cross-verify with NetworkMiner, tcpdump, and Zeek
Independently reconstructs the infected host: hostname DESKTOP-ES9F3ML, MAC, OS fingerprint, TTL.875 files carved from the pcap, including the actual harvested-data artifacts exchanged with whitepepper.su.Real WSL Ubuntu terminal session: tcpdump for raw TCP verification, Zeek 8.2.1 for full protocol logging. Zeek's http.log independently reproduces all 6 C2 requests — three tools, one conclusion.
Four more real, independent cases
Same methodology, applied to four more real samples covering different techniques.
C2 beacon (2026-02-28) — the case that revealed the correlation
The malware's HTTP client identifies as User-Agent: NetSupport Manager/1.3, C2 panel responds Server: NetSupport Gateway/1.92 — not a coincidence given the identical protocol shared with the 2024-11-26 case below.Same cross-tool verification: raw TCP session to 45.131.214.85, Zeek log set, http.log grep confirming all 5 fakeurl.htm POST beacons.
Multi-domain C2 via Cloudflare Tunnel abuse (2025-06-13)
Filter across three rotating C2 domains — 64 matching packets. A PowerShell User-Agent hits a typosquatted eventtime-microsoft.org host. *.trycloudflare.com fronts part of the infrastructure specifically because Cloudflare's shared IP space defeats naive IP-based blocking.
PowerShell-delivered RAT via TeamViewer abuse (2025-01-22)
594 matching packets: a PowerShell loader fetched first, then TeamViewer RAT components staged through the same generic file-get API — TeamViewer, a legitimate remote-access tool, deployed for attacker control.
NetSupport RAT install (2024-11-26) — the other half of the correlation
Real NetSupport Manager check-in followed by the same fakeurl.htm CMD=POLL/CMD=ENCD beacon loop seen in the 2026-02-28 case above — the cross-case correlation confirmed from both directions.
Every finding turned into a reusable Sigma rule
7 Sigma rules total across the 5 cases, tested against a real Sigma engine (Zircolite) including a zero-false-positive check against the baseline — the difference between "I know what to look for" and "here's a rule a SIEM could run today."
Findings summary
Case
Technique
Key IOC
Lumma Stealer infostealer
Browser fingerprinting + credential exfil
whitepepper.su
Periodic C2 beacon
NetSupport-style CMD=POLL protocol
45.131.214.85
Multi-domain C2
Cloudflare Tunnel abuse, typosquatting
eventtime-microsoft.org, *.trycloudflare.com
PowerShell RAT deployment
TeamViewer component abuse
5.252.153.241
NetSupport RAT install
Same beacon protocol as case 2
194.180.191.64
Full per-case reports, IOC exports (CSV/JSON), and Sigma rules are in the repository. Every export deliberately separates true threat indicators (blocklist-worthy) from incident observables (victim-environment facts, for internal correlation) and contextual infrastructure (legitimate vendor endpoints that happen to appear because a legitimate tool was abused) — none of it is a maintained production feed, and it says so.
