Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Identifying Hosts and Users

Summary: Unit 42's Wireshark tutorial shows how to identify a compromised host and its user from packet captures by correlating MAC, IP, and hostname data across DHCP, NBNS, HTTP User-Agent, Kerberos, and LDAP traffic. The tutorial, first published in March 2019 and updated for 2023, uses five sample pcaps and notes that browser User-Agent reduction has frozen Windows reporting at Windows NT 10.0 and macOS at Catalina, making that method increasingly unreliable.

What's compelling: The tutorial's own caveats matter: MAC addresses can be anonymized or spoofed, User-Agent lines can be altered by extensions, cURL, or malware, and HTTPS hides the headers entirely - so the identifiers responders lean on during an incident are exactly the ones an adversary can change.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related