Investigating the security incident

Now that we have the vector of compromise, we can continue our investigation by looking for evidence about what happened after the initial compromise. Proceed as follows:

1. Go to the Alerts panel on Security Onion.
2. On the Options menu, click to open the list and select Acknowledged and Escalated to see an alert regarding the malware, as shown in the following screenshot:

Figure 14.31 – Filtering to show cases created from alerts

3. To see details about this alert, click on the rule.name column and select Actions then Hunt (remember to filter by date, as you did before).

You will see a list of events associated with this alert again; because we already analyzed traffic related to port 9000 communication, we can now try to investigate traffic related to port 445.

4. Click on the second event that connects from port 445, then Actions, and then click on PCAP, as shown in the following screenshot...