Signatures and Sessions: Malware HTTP Analysis

Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!

In this challenge, you'll import the Trickbot packet capture into Arkime.

In this challenge, you'll dive into evasion patterns of Trickbot: a piece of malware that exfiltrates highly sensitive data (e.g., banking information, account credentials, etc.). In particular, you'll leverage Arkime to inspect Trickbot pcaps and look for suspicious HTTP traffic.

In this challenge, you'll explore alerting mechanisms for Trickbot. In particular, you'll investigate Trickbot through a Signature-based Suricata rule. You'll also use an Suricata/Arkime integration to see the Suricata alerts within Arkime!

In this challenge, you'll explore alerting mechanisms for Trickbot. In particular, you'll investigate Trickbot through a Behavior-based Suricata rule.

This is the last challenge of this lab, and your last chance to experience the environment before clicking finish lab, ending this small little world that flittered into existence just for you.