.

Exercise Title: Network Log Analysis for Suspicious Activity

Objective

To help learners identify, analyze, and interpret network log data to detect indicators of compromise (IoCs), unauthorized access, or policy violations.

Scenario

You are a cybersecurity analyst for an organization that recently noticed unusual network slowdowns. You have been asked to review a set of sample network logs to determine whether any suspicious activity is occurring.

Provided Data (Example Log Entries)

Tasks

1. Identify Suspicious Behavior
   • Which connections or patterns appear unusual?
   • Are there signs of brute-force attempts or data exfiltration?
2. Determine Possible Indicators of Compromise (IoCs)
   • List any IP addresses, ports, or activities that stand out.
   • What do they suggest (e.g., port scanning, unauthorized access, malware communication)?
3. Analyze Data Transfer Patterns
   • Which logs show unusually high outbound traffic?
   • Could these indicate data exfiltration?
4. Correlate Events
   • Sequence the events — what happened first, and what might it lead to?
   • How do internal and external connections relate?
5. Recommend Actions
   • Immediate containment or monitoring steps.
   • Policy or firewall rule adjustments to prevent recurrence.

Expected Observations

• The SSH traffic to external IP 202.54.1.100 suggests possible brute-force activity.
• The large file transfer over SMB may indicate lateral movement or data staging.
• The persistent outbound HTTP connection to 198.51.100.70 could signal data exfiltration or a C2 (Command and Control) channel.

Follow-up Discussion

• What other logs would you want to review (e.g., authentication, firewall, DNS)?
• How would you validate whether this activity is malicious or legitimate?
• What would your incident report summary include?