Threat Hunting Labs Introduction

These are a series of labs that cover different types of analysis that can be done on network data when threat hunting. You can do these in any order and you can jump around individual labs to try out the tools or methods that interest you. That being said, here is our suggested order:

1. Long Connections
2. Beacons
3. DNS
4. Outliers

You can use the Basic Tool Usage guide as a reference for common tasks if a tool is unfamiliar to you.

Each of these labs works off the same packet capture. You have several options for downloading this pcap. Each option below has its snaplen set to a different value in order to reduce the file size. However, this means that large packets will have their payload truncated and your results when going through the labs may vary slightly from what is printed. The overall analysis should still remain unchanged.

If you enjoy these labs and are interested in learning more about network threat hunting:

1. Check out our articles on the Active Countermeasures Blog (or Subscribe for email updates)
2. Sign up for our free Webcasts which consists of a series of recorded videos

Thank you for participating!