In this chapter, we saw how to decode encoded payloads for Metasploit and make sense of the evidence captured from the network itself. We saw how an attacker migrates from a normal reverse shell to a Meterpreter shell on the packet level. We looked at a variety of techniques to decrypt encrypted Meterpreter communication. We also saw how Empire works and learned its indicators of compromise while applying it to a real-world case study. In this chapter, we relied on pcap-enabled data.
In the next chapter, we will look at how we can use log-based data to solve real-world cases.
