https://zviarcyber.github.io/tags/network-forensics/Recent content in Network-Forensics on Blue Team Write-upsHugoen-usFri, 19 Jun 2026 00:00:00 +0000https://zviarcyber.github.io/posts/openwire-cyberdefenders/Fri, 19 Jun 2026 00:00:00 +0000https://zviarcyber.github.io/posts/openwire-cyberdefenders/<h2 id="abstract">Abstract</h2> <p>A network forensics walkthrough of the CyberDefenders <strong>OpenWire</strong> challenge. Starting from a single PCAP and a tier-1 escalation about a public-facing server beaconing to suspicious IPs, I trace an Apache ActiveMQ compromise via <strong>CVE-2023-46604</strong>: from the initial remote code execution on the OpenWire port, through a malicious Spring XML payload that abuses <code>java.lang.ProcessBuilder</code>, down to a dropped reverse shell talking to two separate C2 servers.</p> <h2 id="scenario">Scenario</h2> <blockquote> <p>During your shift as a tier-2 SOC analyst, you receive an escalation from a tier-1 analyst about a public-facing server. The server has been flagged for outbound connections to multiple suspicious IPs. Following the incident response process, the host is isolated from the network and a packet capture is pulled from the NSM sensor. Your task is to analyse the PCAP and assess for signs of malicious activity.</p>