Crossing the Line: Unit 42 Wireshark Quiz for Red Line Stealer
Summary: Unit 42 published a Wireshark quiz built on a packet capture of a RedLine Stealer infection from July 2023 in an Active Directory environment, letting participants analyze the traffic and determine what specific data was stolen from an infected Windows host. The pcap is available in Unit 42's GitHub repository as a ZIP archive named 2023-07-Unit42-Wireshark-quiz.pcap.zip, unlocked with the password "infected", and the answers appear in a separate post.
What you should know: RedLine Stealer harvests login credentials and other sensitive data from Windows hosts, and this capture shows that theft as it appears on the wire - the same traffic a defender would need to recognize during an active infection. Unit 42 also shared the file samples and indicators of compromise with Cyber Threat Alliance members so protections could be deployed to their customers.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026