Security Decoder

Filters for common reverse shell or C2 tools. Remove -v grep to include all matches.

Shows apache and its child processes. A web server spawning a shell (sh, bash) is a classic webshell indicator.

Crypto miners, brute force tools and active reverse shells typically consume high CPU. Check owner column too — root-owned unknown processes are suspicious.

If exe points to /tmp/, /dev/shm/ or a deleted file (e.g. /tmp/evil (deleted)), that's a strong IOC. Combine with: cat /proc/1337/cmdline | tr '\0' ' '

Reveals full arguments that ps may truncate. Useful for seeing encoded payloads passed as arguments to python, perl, bash etc.

Filters out localhost-only listeners, leaving only externally accessible ports. Unexpected listening ports (e.g. 4444, 31337) = likely backdoor.

Prints remote IP:port + process. Look for connections to unusual IPs on ports like 4444, 1234, 8888 or unexpected outbound 443/80.

Shows established outbound TCP connections. The COMMAND column shows the process name — look for shells, scripting languages or unusual binaries making network calls.

Port 4444 is Metasploit's default. Also check 1234, 31337, 8888, 9001 (Tor). If a process owns an unexpected port, note the PID and trace it with /proc/<PID>/exe.

Attackers may add routes for lateral movement. Check for unexpected host routes or policy routing rules (ip rule show) that redirect traffic.

column -t makes output readable. Look at the 5th column (remote address) — any unexpected public IPs with unusual ports are worth investigating.

Narrow to interesting directories first. New files in /tmp, /var/www, /dev/shm or config changes in /etc are high priority.

-t sorts by modification time, newest first. Executables in these directories are almost always malicious.

Compare output against a known-good baseline. New or unexpected SUID binaries (especially in /tmp or /home) = likely backdoor or privesc tool.

Malware often deletes itself after launch to hide from file system scans while remaining in memory. lsof +L1 reveals these ghost processes.

Replace .php with .jsp, .aspx, .py depending on the web stack. Check content of matches with: grep -l 'eval\|system\|exec\|passthru' <files>

The FROM column shows the originating IP. An unexpected IP or an unusual command in the WHAT column (e.g. bash, nc, python) warrants immediate investigation.

Look for logins at unusual hours, from unknown IPs, or very short sessions (may indicate scripted access). last -F shows full timestamps.

Counts failed attempts per IP address. High counts from a single IP = brute force. Many different IPs = credential stuffing or distributed spray.

Check all users' history. Look for: wget/curl to external IPs, base64-encoded commands, nc/ncat/socat, python -c, privilege escalation commands.

Any UID 0 account other than root is a backdoor. Also check for accounts with no password (empty field 2 in /etc/shadow) or shell set to /bin/bash for service accounts.

Iterates all users' crontabs. Malicious entries often contain curl/wget to a C2, base64-encoded commands, or run scripts from /tmp.

Searches all cron config files for suspicious commands. Any entry pulling a script from the internet or running from /tmp is suspicious.

Look for services with unusual names or those in non-standard paths. Examine suspicious ones with: systemctl cat <service-name>

Check for wget, curl, bash -i or similar. Also check /etc/init.d/ for custom init scripts.

Extracts and counts source IPs. 10+ failures from one IP = brute force. Multiple IPs with few attempts each = credential spray or stuffing attack.

Columns: month day time user source-IP. Cross-reference successful logins against known IPs and expected accounts.

Adding -p warning filters to only show warnings and above (warning, error, critical, alert, emergency). Useful during live incident response to monitor what's happening now.

Adjust the time window to match the suspected incident time. Adding -p err limits to errors. --output=json-pretty for machine-readable output.

Look for unusual commands, especially run by service accounts or web users. Privilege escalation often involves sudo -l then exploiting a permitted command.

Cross-reference the kernel version against exploit databases. Old kernels (Linux 3.x, 4.x without patches) are commonly exploited for privilege escalation.

Look for segfaults (possible exploit attempts), OOM killer events (may indicate resource exhaustion from malware), and unexpected USB device connections.

Filters out System32 processes to focus on non-Microsoft binaries. Processes with no Path are likely system kernel threads. Note processes running from unusual locations like C:\Users\, AppData or Temp.

Searches for common PowerShell attack keywords in command lines. -enc/-encoded = base64 payload, bypass = AMSI/execution policy bypass, IEX/Invoke-Expression = code execution.

/svc shows which Windows services are hosted in each svchost.exe instance. Multiple unusual services under one svchost is a red flag.

Filters out RFC1918 (private) addresses and adds process name. Remaining connections are to public IPs — review any on unusual ports.

findstr filters to established connections. PID in last column — cross-reference with tasklist. Requires elevated (admin) prompt for -b flag.

Type 1 = A records (IPv4). Look for DGA-style domains (random characters), known C2 domains, or unexpected cloud services. Cache survives connection closure.

Sort by port for easier review. Look for: high numbered ports (4444, 1234, 9001) owned by powershell.exe or cmd.exe, or standard ports (80, 443) owned by unexpected processes.

Focus on enabled accounts. A new account with a recent PasswordLastSet and no LastLogon is suspicious. Compare against expected user list.

PrincipalSource shows Local vs. ActiveDirectory. Unexpected local accounts or domain accounts in this group are high-severity findings.

Disc (disconnected) sessions can still be active. An attacker may have a disconnected RDP session. query session shows all sessions including services.

LogonType 3=Network (SMB/file share), 10=RemoteInteractive (RDP), 8=NetworkCleartext (plain-text password over network). Filter for type 10 to find RDP logins.

Groups by target username and counts failures. Many failures against one account = brute force. Few failures across many accounts = password spray.

Filters for LOLBins (Living Off the Land Binaries) — legitimate Windows tools commonly abused by attackers. Focus on unusual parent processes (e.g. Word spawning PowerShell).

Suspicious paths: services in C:\Users\, C:\Windows\Temp, C:\ProgramData. PsExec installs PSEXESVC. Check the account — LocalSystem is standard but unexpected accounts are suspicious.

ID 1102 = Security log cleared. ID 104 = System log cleared. The event captures WHO cleared the log (user account). Any log clearing during an incident is highly suspicious.

Check task names for suspicious patterns. Correlate with Get-ScheduledTask to see current state. Attackers often use random or system-like names to blend in.

Check both HKLM (all users) and HKCU (current user). Look for entries pointing to %TEMP%, AppData, unusual paths or with encoded commands.

PowerShell version filters for services running from suspicious paths. Legitimate services run from System32, Program Files or well-known vendor paths.

Filters out standard Windows paths to reveal non-Microsoft services. Any service running from a user directory or temp folder is immediately suspicious.

CSV output is easier to parse. Focus on tasks running as SYSTEM or Administrator with unusual commands. Look for PowerShell with encoded commands or scripts in temp directories.

Adding && ip removes non-IP traffic too. Apply this first when opening any PCAP — it typically removes 30-60% of packets instantly and makes real threats visible.

Adding !dns removes DNS traffic so you can focus on application connections. Use ip.src == X.X.X.X or ip.dst == X.X.X.X to restrict to one direction.

Shows all traffic in both directions between the two hosts. Apply on top of the noise reduction filter for cleaner results.

Look at Statistics > Conversations to see the volume. A single source sending SYN to hundreds of ports/hosts in seconds = active reconnaissance. The source IP is your attacker.

NULL scans are stealthier than SYN scans but still visible in packet captures. Most modern IDS/IPS detect them. Response of RST = port closed; no response = filtered or open.

XMAS scans don't work against Windows systems (Windows responds to all probes). If you see these, the attacker is targeting Linux/Unix systems or using a tool that doesn't adapt.

Adjust the RFC1918 exclusions to match your network. Remaining SYN packets to public IPs on ports like 4444, 1234, 4000, 8080 are high-priority IOCs.

Legitimate HTTPS is always TLS. Any TCP 443 traffic that doesn't start with a TLS ClientHello is suspicious — could be raw HTTP, a custom protocol or a misconfigured C2.

Very few legitimate IRC users remain. Any traffic on these ports from a corporate or server environment is almost certainly botnet C2. Look at the payload for JOIN/PRIVMSG commands.

1400 bytes is near maximum TCP segment size. Sustained large segments to an external IP indicate bulk data transfer. Check Statistics > Endpoints to see total bytes per destination.

DNS tunneling tools like dnscat2 or iodine encode data in subdomain labels. A legitimate FQDN rarely exceeds 50 chars total. 80+ characters = almost certainly tunneling.

ICMP type 8 = Echo Request (ping). Tools like ptunnel or icmptunnel can tunnel TCP over ICMP. Look for sustained ICMP traffic with identical payload sizes or sequential data.

Follow the TCP stream of any matches (right-click > Follow > TCP Stream) to see the full request including username. These are definitive credential exposures.

Shows both username (USER) and password (PASS) commands. FTP should never be used — if you see it in a capture, credentials are compromised and protocol needs to be replaced with SFTP.

NTLM hashes in captures can be cracked offline or relayed. If you see NTLM auth to external IPs or unexpected hosts, it may be an NTLM relay attack or credential coercion (Responder/PetitPotam).

Filter out expected file servers. Unexpected SMB connections between workstations (east-west) are a major lateral movement indicator. Check Statistics > Conversations for volume.

PSEXESVC in the filename confirms PsExec usage. ADMIN$ and C$ access from unexpected sources indicates lateral movement. IPC$ alone is normal (used for RPC).

RDP should only originate from known admin jump hosts or IT subnets. Workstation-to-workstation RDP is almost always lateral movement.

Look at the URI and POST body. Common webshell parameters: cmd, exec, command, c, shell, run. Follow TCP stream to see full interaction and extract the webshell.

Case-insensitive match against common scanning tool signatures. Custom tools may use fake legitimate UAs — correlate with request patterns (many 404s, sequential URIs) to confirm scanning.

404s are normal scanning noise. Focus on 500 (server errors), 403 (forbidden — may indicate successful path traversal to protected resources), and 401 (unauthorized — brute force).

Timestamp in filename prevents overwrites if you run multiple captures. Use -C 100 to rotate files at 100MB, -G 3600 to rotate hourly. Always save to a separate volume if possible.

-s0 captures full packet size (default may truncate). Useful on multi-homed hosts or when you don't know which interface the traffic is on.

src host = only traffic FROM the host. dst host = only traffic TO the host. Adding not dst port 22 excludes SSH (your own session) to avoid capture noise.

Capturing HTTP/HTTPS traffic. If you see plaintext data on port 443 (should be encrypted TLS), that's immediately suspicious.

Also excludes DNS and ARP to reduce noise. This is a good default starting filter for most triage captures via SSH.

-c 500 captures 500 packets then stops. High rate of SYN packets from a single source = port scan. From many sources to same port = DDoS/scan campaign.

Apply same BPF filter syntax as live capture. Useful for quick CLI analysis when Wireshark is not available.

The complex filter shows only packets with data payload (not empty ACKs). -A prints ASCII, -X prints hex+ASCII side-by-side. Useful for spotting plaintext credentials or commands.

The grep filters for domain names longer than 50 characters — a reliable DNS tunneling indicator. Alternatively, save as PCAP and analyze DNS query lengths in Wireshark.

icmp-echo = ping requests. Rapid pings to many hosts = network discovery/sweep. Large ICMP payloads (> 100 bytes) = possible ICMP tunneling.