Incident investigation · Security Onion, 2026
Tracing a cryptominer back to the exploit kit that dropped it
The capture showed a workstation going from a drive-by exploit kit landing page to actively mining Monero for someone else in under seven minutes. Getting the timeline right meant treating no single log source as sufficient on its own: the IDS alerts said something happened, but only cross-referencing Zeek’s file and connection logs against the raw packet capture confirmed exactly what was transferred and when.
The detail that mattered most wasn’t in any alert. The malware server’s HTTP response carried a date header reading seven years earlier than the actual capture date, a deliberate anti-forensics trick meant to throw off automated threat-intel tooling. Catching that discrepancy said more about the adversary’s sophistication than any single IOC did.
Approach
Phase 1
Triage the alerts
Thirteen distinct Sguil alert signatures scoped the incident into three phases: exploit kit delivery, malware download, and cryptocurrency mining check-in.
Phase 2
Reconstruct the download byte by byte
Wireshark rebuilt the TCP session for the malware download and confirmed the transferred object was a genuine Windows executable from its raw bytes, not just its stated content type.
Phase 3
Correlate every log source against the alerts
Zeek's connection, HTTP, file, DNS, SSL, and PE logs were cross-referenced against the Sguil alerts to build one single timeline with no gaps.
Phase 4
Map to threat-intel frameworks
The full chain was mapped against the Diamond Model, the Cyber Kill Chain, and MITRE ATT&CK, then translated into business risk and framework-aligned remediation for a non-technical audience.
7 min
From initial exploit to active cryptomining
12
MITRE ATT&CK techniques mapped across 7 tactics
1
Deliberately backdated timestamp caught as the key anti-forensics tell