Malware › Module 7 › Lesson 4
Lab — Net Proc
Merge $MAL_LAB PCAP and process tree — unified UTC timeline, network-process correlation, IOC candidate list.
Visual · t22_net_proc_lab
Lab: net + proc unified timeline on $MAL_LAB. Original Cyberlium.
Opening
When DNS fired, what process was alive — one timeline answers what static alone cannot.
Using YOUR $MAL_LAB dynamic lab artifacts: (1) import PCAP and proc export; (2) build unified UTC timeline — minimum 10 events alternating net and proc where possible; (3) annotate correlation rows: 'PID 1234 powershell.exe → DNS query evil.example at T+42s'; (4) update process tree if new spawns visible; (5) produce IOC candidate list: hashes, domains, IPs redacted, file paths redacted; (6) chmod 600 pack. No live C2 interaction from host, no stranger PCAP paste as your own, no publishing live samples with IOC list. Stop at literacy proof — revert VM if continuing dynamic, never on daily driver.
1. Timeline merge
Single markdown or spreadsheet: UTC | Source (net/proc) | Detail redacted | IOC Y/N.
First network activity after detonation is high-priority row — link to spawn chain.
Command guide
Try these commands — Timeline merge
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Network + process correlation — https://www.hybrid-analysis.com/ (full dynamic picture literacy) CISA network IOCs — https://www.cisa.gov/stopransomware (defender hunting) VirusTotal relations — https://www.virustotal.com/ (graph literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install tcpdump
Built-in (iproute2)
macOS: Use: netstat
Windows: Use Wireshark or install via WSL Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_HOST=${LAB_HOST:-127.0.0.1}
ss -tulpn 2>/dev/null | tee "$HOME/cyberlium-lab/t22-mal/notes/live-ss.txt" | head -12
ps aux 2>/dev/null | head -10 | tee "$HOME/cyberlium-lab/t22-mal/notes/live-ps.txt"
sudo tcpdump -i lo -c 5 -n 2>/dev/null || echo 'tcpdump: lab lo capture skipped without sudo'Primary tools to practice this lesson: tcpdump, ss. Reference sites: Network + process correlation (https://www.hybrid-analysis.com/); CISA network IOCs (https://www.cisa.gov/stopransomware); VirusTotal relations (https://www.virustotal.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. IOC candidate list
Types: SHA256, domain, IP, URI pattern, file path pattern — confidence and observed/inferred tags.
No live binary attachments in mentor share — hashes and domains through proper channel.
3. Stop conditions
If PCAP missing, document N/A and proc-only timeline — honesty over fiction.
Refuse merging unauthorized capture or production PCAP without scope.
4. What you ship: net/proc lab pack
Unified timeline ≥10 rows + IOC list + process tree update — chmod 600.
5. What you record before the next lesson
Net/proc lab pack path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Attach live malware zip to IOC list on public Slack.
Right
Net/proc lab pack merged from $MAL_LAB. Next: quiz.
Mission: net/proc lab
1) Build unified UTC timeline. 2) Write ≥5 correlation annotations. 3) IOC candidate list ≥4 types. 4) Secure pack chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Missing PCAP — minimum proc-only rows?”
Knowledge Check
APPLY: Net/proc lab merges:
Multiple choice
Knowledge Check
APPLY: True or False: IOC list includes live sample zip casually.
True or False
Knowledge Check
APPLY: Correlation row links:
Multiple choice