Hands-On Network Forensics

Summary

In this chapter, we saw how to decode encoded payloads for Metasploit and make sense of the evidence captured from the network itself. We saw how an attacker migrates from a normal reverse shell to a Meterpreter shell on the packet level. We looked at a variety of techniques to decrypt encrypted Meterpreter communication. We also saw how Empire works and learned its indicators of compromise while applying it to a real-world case study. In this chapter, we relied on pcap-enabled data.

In the next chapter, we will look at how we can use log-based data to solve real-world cases.