Example Office Ltd · Incident report

sample-office-network.pcapng

Prepared by: IT Operations
Reference: INC-2026-0142
Capture window: 2026-10-07 08:00:02 UTC → 2026-10-07 08:09:58 UTC
Duration: 9m 56s
Packets / bytes: 1,846 · 446.3 KB
File size: 507.3 KB
Uploaded: 2026-10-08 13:37:17 UTC
Report generated: 2026-10-08 13:50:07 UTC

Executive summary

High risk: 7 critical or high-severity finding(s) need attention.

Network health: poor. DNS: Response time p95 704 ms over 152 lookup(s); slowest resolver 192.168.1.2 (p95 889 ms). TCP: Connect time p95 59 ms over 89 connection(s); 2 connection attempt(s) never answered. HTTP: Server response p95 30 ms over 18 request(s); 5 client error(s) (4xx).

Needs attention

Port Scan — Port scan from 192.168.1.66: 61 distinct destination port(s) contacted
Next: Identify the scanning host and whether it's an approved scanner. If not, check that machine for compromise and review what the scanned hosts expose.
Suspicious User-Agent — Suspicious HTTP User-Agent: 5 request(s) from known scanner/attack tools (1 distinct UA string(s))
Next: Check whether a test was scheduled; if not, treat the source host as hostile or compromised and review the targeted server's logs.
Suspicious HTTP Path — Requests to suspicious paths: 4 request(s) to 4 path(s) associated with webshells or exposed files
Next: Check the responses: 404s mean the probe failed; any 200 response to a sensitive path needs immediate investigation of that server.

Checked and found clean: TLS and certificates, Local network (ARP, fragmentation, TTL), Transport reliability, Authentication and Windows services.

Summary

critical

high

medium

info

13 finding(s) across 10 detector type(s). Analyst review: 0 annotated (0 confirmed, 0 false positive).

Key findings

Port Scan — Port scan from 192.168.1.66: 61 distinct destination port(s) contacted
Suspicious User-Agent — Suspicious HTTP User-Agent: 5 request(s) from known scanner/attack tools (1 distinct UA string(s))
Suspicious HTTP Path — Requests to suspicious paths: 4 request(s) to 4 path(s) associated with webshells or exposed files
Incomplete TCP Handshake — Half-open TCP scan: 1 source(s) sent 65 SYN(s) to many targets without completing three-way handshakes
C2 Beaconing — Confirmed C2 beaconing: 192.168.1.22 <-> 203.0.113.50 — 120 packets at 0.20 pkt/s, CoV=0.02 (highly regular inter-arrival timing)
Lateral Movement (Port Scan) — Internal port scan: 192.168.1.66 → 10.0.0.10: 61 distinct low-range ports — likely manual reconnaissance

Findings

highPort ScanNot reviewed

Port scan from 192.168.1.66: 61 distinct destination port(s) contacted

What it means: One host contacted many different ports on other machines in a short time — the pattern of a scanner mapping which services are open.
Often harmless when: Vulnerability scanners, monitoring tools and some inventory or discovery software do this on purpose.
Check next: Identify the scanning host and whether it's an approved scanner. If not, check that machine for compromise and review what the scanned hosts expose.

src ip: 192.168.1.66
distinct dst ports: 61

highSuspicious User-AgentNot reviewed

Suspicious HTTP User-Agent: 5 request(s) from known scanner/attack tools (1 distinct UA string(s))

What it means: HTTP requests carried a user agent belonging to a scanning or attack tool (for example sqlmap, nikto or masscan).
Often harmless when: Authorised penetration tests and vulnerability scans use these tools.
Check next: Check whether a test was scheduled; if not, treat the source host as hostile or compromised and review the targeted server's logs.

tools

user agent	label	count	severity
sqlmap/1.7.2#stable (https://sqlmap.org)	SQLMap (SQL injection scanner)	5	high

highSuspicious HTTP PathNot reviewed

Requests to suspicious paths: 4 request(s) to 4 path(s) associated with webshells or exposed files

What it means: HTTP requests probed paths commonly targeted by attackers, such as admin pages, configuration files or known exploit paths.
Often harmless when: Vulnerability scanners and automated internet noise probe these constantly.
Check next: Check the responses: 404s mean the probe failed; any 200 response to a sensitive path needs immediate investigation of that server.

suspicious paths

path	pattern	count	src ips
/.env	/.env	1	192.168.1.66
/.git/config	/.git/	1	192.168.1.66
/admin/config.php	/config.php	1	192.168.1.66
/phpmyadmin/	/phpmyadmin	1	192.168.1.66

highIncomplete TCP HandshakeNot reviewed

Half-open TCP scan: 1 source(s) sent 65 SYN(s) to many targets without completing three-way handshakes

What it means: Many TCP connections were started but never completed.
Often harmless when: Clients giving up on a slow server, or firewalls silently dropping traffic, cause this.
Check next: Check Network health for the destinations that never answered: a service that is down, a firewall rule, or a scan are the usual causes.

scanners

src ip	syn count	distinct targets	synack received	completion ratio
192.168.1.66	65	61	5	0.077

highC2 BeaconingNot reviewed

Confirmed C2 beaconing: 192.168.1.22 <-> 203.0.113.50 — 120 packets at 0.20 pkt/s, CoV=0.02 (highly regular inter-arrival timing)

What it means: A host contacted the same destination at very regular intervals — the heartbeat pattern of malware checking in with its control server.
Often harmless when: Software update checks, monitoring agents, NTP and messaging apps also poll on a timer.
Check next: Identify the destination: if it's a known vendor service it's likely benign; an unknown external address on a steady timer warrants examining the source host.

pair: 192.168.1.22 <-> 203.0.113.50
packets: 120
pps: 0.201
duration s: 595.6
cov: 0.023

highLateral Movement (Port Scan)Not reviewed

Internal port scan: 192.168.1.66 → 10.0.0.10: 61 distinct low-range ports — likely manual reconnaissance

What it means: One internal host probed many ports on another internal host — reconnaissance from inside the network.
Often harmless when: Internal vulnerability scanners do this when scheduled.
Check next: Confirm whether an internal scan was planned; otherwise treat the source host as possibly compromised.

src ip: 192.168.1.66
dst ip: 10.0.0.10
distinct dst ports: 61

highKnown Malicious PortNot reviewed

Traffic to high-risk port 4444: 16 packet(s)

What it means: Traffic used a port commonly associated with malware, backdoors or attack tools (for example 4444 or 31337).
Often harmless when: Some legitimate applications happen to use these ports.
Check next: Check which program on the host owns the connection; an unexplained process talking on these ports should be investigated.

port: 4,444
packet count: 16

mediumHigh NXDOMAIN RatioNot reviewed

High NXDOMAIN ratio: 70 of 152 DNS responses (46.1%) — possible DGA or subdomain enumeration

What it means: A large share of DNS lookups failed because the name doesn't exist (NXDOMAIN).
Often harmless when: Typos, stale configuration and browsers probing for local names cause some NXDOMAINs.
Check next: Find the host making most failed lookups: many random-looking failed names can indicate malware searching for its control server (a domain-generation algorithm).

total responses: 152
nxdomain count: 70
ratio: 0.461
example domains: 4fciv0dbrq7n5b.example.com, pvlj5qz1t84u3z.example.com, td5k8bnffd8pbp.example.com, m0o4t6g2rtn647.example.com, nocab2rt1ajdxr.example.com

mediumHTTP Credential LeakNot reviewed

Unencrypted credentials in plain HTTP: 1 request(s) transmit passwords or Basic auth over unencrypted HTTP

What it means: A password or similar credential was sent over plain (unencrypted) HTTP, readable by anyone on the network path.
Often harmless when: Rarely benign — at most an internal test system.
Check next: Move the login to HTTPS, and treat the exposed credentials as compromised: change the password.

example requests

src ip	url
192.168.1.21	http://intranet.example.local/login

mediumTraffic Volume SpikeNot reviewed

Traffic volume spike at 08:03:20 UTC: 40 packets (3.6σ above mean of 8 pkts/bucket)

What it means: Traffic volume jumped well above the capture's normal level for a period.
Often harmless when: Backups, software updates, video calls and large downloads cause spikes.
Check next: Find which hosts and conversations made up the spike; an unexpected transfer to an external host may be data exfiltration.

timestamp: 2026-10-07 08:03:20 UTC
packets in bucket: 40
mean packets per bucket: 8.0
std dev: 8.9
sigmas above mean: 3.57

mediumTraffic Volume SpikeNot reviewed

Traffic volume spike at 08:05:54 UTC: 38 packets (3.3σ above mean of 8 pkts/bucket)

What it means: Traffic volume jumped well above the capture's normal level for a period.
Often harmless when: Backups, software updates, video calls and large downloads cause spikes.
Check next: Find which hosts and conversations made up the spike; an unexpected transfer to an external host may be data exfiltration.

timestamp: 2026-10-07 08:05:54 UTC
packets in bucket: 38
mean packets per bucket: 8.0
std dev: 8.9
sigmas above mean: 3.35

mediumTraffic Volume SpikeNot reviewed

Traffic volume spike at 08:03:28 UTC: 35 packets (3.0σ above mean of 8 pkts/bucket)

What it means: Traffic volume jumped well above the capture's normal level for a period.
Often harmless when: Backups, software updates, video calls and large downloads cause spikes.
Check next: Find which hosts and conversations made up the spike; an unexpected transfer to an external host may be data exfiltration.

timestamp: 2026-10-07 08:03:28 UTC
packets in bucket: 35
mean packets per bucket: 8.0
std dev: 8.9
sigmas above mean: 3.01

mediumTraffic Volume SpikeNot reviewed

Traffic volume spike at 08:08:17 UTC: 35 packets (3.0σ above mean of 8 pkts/bucket)

What it means: Traffic volume jumped well above the capture's normal level for a period.
Often harmless when: Backups, software updates, video calls and large downloads cause spikes.
Check next: Find which hosts and conversations made up the spike; an unexpected transfer to an external host may be data exfiltration.

timestamp: 2026-10-07 08:08:17 UTC
packets in bucket: 35
mean packets per bucket: 8.0
std dev: 8.9
sigmas above mean: 3.01

Seen in other captures

Indicator	Here as	Also in
192.168.1.66	Lateral Movement (Port Scan)	office-mon.pcapng (port_scan, lateral_movement_port_scan) office-tue.pcapng (port_scan, lateral_movement_port_scan) office-wed.pcapng (port_scan, lateral_movement_port_scan) office-thu.pcapng (port_scan, lateral_movement_port_scan) office-fri.pcapng (port_scan, lateral_movement_port_scan)
192.168.1.22	C2 Beaconing	office-mon.pcapng (beaconing) office-tue.pcapng (beaconing) office-wed.pcapng (beaconing) office-thu.pcapng (beaconing) office-fri.pcapng (beaconing)
203.0.113.50	C2 Beaconing	office-mon.pcapng (beaconing) office-tue.pcapng (beaconing) office-wed.pcapng (beaconing) office-thu.pcapng (beaconing) office-fri.pcapng (beaconing)

Traffic overview

Traffic over time

2026-10-07 08:00:02 UTCpeak 40 packets / bucket2026-10-07 08:09:58 UTC

Protocols

Protocol	Packets
TCP	1,422
UDP	424

Top talkers

Address	Bytes
192.168.1.20	183,769
192.168.1.22	105,338
198.51.100.30	103,358
198.51.100.10	87,183
192.168.1.23	86,348
198.51.100.50	83,646
198.51.100.20	75,706
192.168.1.21	72,140
198.51.100.40	49,238
192.168.1.1	23,292

Destination ports

Port	Packets
443	635
53	153
8443	120
80	90
4444	16
53456	14
49834	9
50613	9
55457	9
56071	9

Top conversations

Pair	Bytes
192.168.1.20 <-> 198.51.100.30	46,691
192.168.1.20 <-> 198.51.100.50	41,517
192.168.1.20 <-> 198.51.100.10	39,144
192.168.1.22 <-> 198.51.100.30	30,760
192.168.1.20 <-> 198.51.100.20	27,096
192.168.1.23 <-> 198.51.100.20	26,570
192.168.1.23 <-> 198.51.100.10	24,493
192.168.1.21 <-> 198.51.100.30	21,917
192.168.1.20 <-> 198.51.100.40	20,548
192.168.1.21 <-> 198.51.100.20	17,289

DNS queries

Name	Queries
cdn.example.net	34
updates.example.org	30
www.example.com	30
mail.example.org	26
intranet.example.local	24
docs.example.com	20
0gsewzfbyb0jz4.example.com	2
0z1co6kshdaupm.example.com	2
12rwo83lwjnzho.example.com	2
1cnaai0b3i6mq1.example.com	2

TLS server names (SNI)

Name	Handshakes
cdn.example.net	17
updates.example.org	15
www.example.com	15
mail.example.org	13
docs.example.com	10

HTTP hosts

Host	Requests
intranet.example.local	18