Network and Memory Forensics

Network forensics captures and analyzes network traffic to reconstruct attacker communications, identify lateral movement, and detect data exfiltration. Unlike endpoint forensics, which examines evidence that may have been tampered with on a compromised host, network evidence is harder for attackers to alter after the fact — they cannot retroactively delete packets already captured by a network tap or flow monitoring system. Network forensics complements endpoint forensics to provide a complete attack picture.

Packet capture (PCAP) records all network traffic at the packet level, including full payload content. Tools include Wireshark (GUI-based, widely used), tcpdump (command-line, scriptable), and Zeek (formerly Bro, produces protocol-level logs from PCAP). Full packet capture is storage-intensive; high-speed networks may require purpose-built capture appliances. PCAP analysis can reveal: credentials in cleartext protocols, C2 beaconing patterns, exfiltrated data, and lateral movement connections.

NetFlow (and its open-source equivalent IPFIX) records metadata about network conversations without capturing payload content: source/destination IP, source/destination port, protocol, byte count, packet count, and timestamps. NetFlow is far more storage-efficient than full PCAP and is suitable for long-term retention (90-365 days). During forensics, NetFlow can identify: which systems communicated during the incident window, data exfiltration (large outbound byte counts), and C2 beaconing (regular small connections to external IPs).

DNS query logs are a powerful forensic source because most C2 communications and malware downloads require DNS resolution. Indicators of malicious DNS activity include: queries to newly registered or low-reputation domains, high-volume queries to a single domain (DGA malware trying many generated names), DNS tunneling (unusually long or high-entropy subdomain names used to exfiltrate data), and queries to domains associated with known malware families. DNS is often logged even when HTTP traffic inspection is limited.

Command and Control (C2) channels between attacker-controlled servers and compromised systems have characteristic patterns. Beaconing produces regular periodic connections (e.g., every 30 seconds) that are identifiable in NetFlow as many small packets to the same external IP on a regular interval. Jitter adds randomization to beacon intervals to evade detection. Analysts look for statistical regularity in connection timing to identify beaconing among the noise of normal web traffic.

Memory forensics analyzes RAM dumps to extract evidence of malicious activity that may not be present on disk. The Volatility Framework (open source) is the industry-standard tool for memory analysis. Key capabilities: listing running processes and their parent-child relationships, identifying injected code in legitimate processes, extracting network connections open at the time of acquisition, recovering registry hive content from memory, and extracting encryption keys held in RAM.

Malware in memory exhibits specific patterns that Volatility plugins identify. Process injection (code injected into a legitimate process like svchost.exe) shows up as memory regions with execute permissions in a process that normally wouldn't have them. Hollow processes (legitimate process shells with malicious code replacing the original) show inconsistencies between the process name and the actual code in memory. Kernel rootkits may hide processes from the process list, but Volatility can detect them by comparing the running process list against the kernel's raw process structure list.

Memory forensics is particularly powerful for credential recovery. Windows stores credentials in LSASS (Local Security Authority Subsystem Service) process memory for Single Sign-On purposes. Tools like Mimikatz exploit this by reading LSASS memory to extract plaintext passwords and NTLM hashes. Forensically, Volatility can extract the same information from a memory dump acquired for investigation — revealing what credentials were cached on the compromised system, which informs the scope of potential lateral movement.

The most powerful forensic analysis combines network and memory evidence. Memory shows what processes were running and what code they contained; network forensics shows what those processes communicated with. A process visible in Volatility memory analysis that has a network connection visible in PCAP, connecting to a domain flagged in DNS logs, and corresponding to an external IP in NetFlow — this convergence provides high-confidence attribution of malicious activity and supports a complete attack narrative.

Accurate timestamps are essential for correlating network and endpoint forensic evidence. If a server's clock is drifted by 15 minutes relative to the firewall's clock, correlating events by timestamp produces false timelines. Network forensics evidence is only as reliable as the time synchronization of the devices generating logs. Organizations must configure consistent NTP (Network Time Protocol) across all security-relevant devices and document any known time discrepancies discovered during an investigation.

Most modern C2 communications use TLS encryption, preventing network forensics analysts from reading payload content directly. However, even encrypted traffic reveals metadata: connection timing patterns (beaconing), certificate anomalies (self-signed certs from attacker infrastructure, mismatched CN fields), JA3 fingerprints (TLS client fingerprinting that can identify specific malware families regardless of destination), and unusual TLS handshake characteristics. Tools like Zeek extract JA3 fingerprints automatically from TLS connections, enabling detection of known malware without decrypting traffic.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: packet captures and NetFlow provide complementary network evidence — PCAP shows full content while NetFlow shows metadata at scale, C2 beaconing appears as regular periodic connections detectable through statistical analysis of connection timing, and Volatility Framework analyzes RAM dumps to detect process injection, extract network connections, and identify malware hiding in legitimate processes. Congratulations on completing the forensics modules — next up is risk management and security frameworks.