# Case 01: The recurring connection

An entirely synthetic portfolio exercise. All hosts, process events, domains and
packet contents are fictional. No traffic was captured from a real system. The
capture contains readable HTTP and DNS, with harmless text payloads only; it
contains no malware, executable downloads, credentials or employer data.

## Guided walkthrough

A fictional workstation, LAB-WS01 (192.0.2.10), made recurring outbound connections.
Explore what happened between 09:00:00 and 09:01:40.100 UTC on 1 October 2026.
The provided host-log timestamps and capture timestamps share the same clock.
This is a curated exercise, not an exhaustive endpoint recording.

1. Verify the supplied SHA-256 hashes before examining working copies.
2. Open case-01.pcap in Wireshark. Set View > Time Display Format to UTC Date and
   Time of Day. Inspect Statistics > Conversations, then filter with `dns` and
   `http.request`.
3. Separate routine traffic from the recurring connection. Which destination,
   hostname and request path recur? What is the interval?
4. Identify the file upload. Right-click its request and choose Follow > TCP
   Stream. What data left the workstation? Count only the HTTP body bytes.
5. Correlate the source ports and timestamps with host-events.csv. Which process
   is associated with those connections? What additional host event is relevant?
6. Write a short conclusion separating observations, hypotheses and missing
   evidence. Do these artifacts alone prove malware, unauthorized activity or a
   particular initial-access mechanism?

## Useful display filters

```text
dns
http.request
ip.addr == 203.0.113.80
http.request.method == "POST"
```

To recover the upload, inspect the POST request body in Follow TCP Stream. The
CSV uses LF line endings, including a final LF. Hash the body only, excluding
HTTP headers and server responses. The website walkthrough contains the expected
byte count and SHA-256 for comparison. Do not browse to the fictional domains.

## Evidence handling

For a command-line view using Wireshark's TShark:

```sh
tshark -r case-01.pcap -Y http.request
tshark -r case-01.pcap -q -z follow,tcp,ascii,4
```

The ZIP includes the capture, a normalized fictional host-event CSV, these
instructions and SHA256SUMS.txt. The manifest confirms integrity against this
published exercise; it is not an independently signed provenance record or a
legal chain of custody. Record your tool version, filters and frame references.

PowerShell example: `Get-FileHash ./case-01.pcap -Algorithm SHA256`

## Discussion

HTTP is intentionally unencrypted here so the exercise can be inspected without
TLS keys. Regular timing and a file transfer warrant investigation, but can also
occur in legitimate telemetry and inventory software. Seek authorization records,
process provenance and additional endpoint evidence before assigning intent.

Wireshark guide: https://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowStreamSection.html