Windows Legacy Host Attack Analysis
Tools Used: Wireshark, Event Viewer, SNORT, NetworkMiner
June 2022
- Investigated a multi-stage intrusion using Wireshark, Snort, NetworkMiner, and Event Viewer; rebuilt the attacker/victim timeline and scoped impact
- Identified ACK-flood DoS and TCP RST manipulation; correlated SMB/DCERPC print-spooler enumeration against a legacy Windows host (XP/2000)
- Cross-validated findings across tools, flagged NTP/time-sync gaps and logging blind spots, and delivered a screenshot-backed report with clear remediation steps.