Look for remote access to target from internet or DMZ address(es), could be RDP, VNC, SSH.Look for file transfer to/from suspect address(es) over SMB, FTP, SFTP, FTPS, SCP, HTTP, HTTPS, etc.Look for internet or DMZ sessions with the suspect address(es).Apply interesting conversations as filter.Use statistics – conversations – limit to display filter: to see what other conversations are initiated from suspect source.Note any meaningful text in message flow.These can be determined by by looking at Statistics – Protocol Hierarchy, then Statistics – Flow Graph Load pcap file into Wireshark, Determine if protocol in question is identified in Wireshark, Filter traffic on IP / MAC Addresses involved in alert.Make note of specific IP / MAC addresses involved.Utilize data mining to determine what types of conversations the suspect device has had.Utilize properties in Devices Map to determine if the device has multiple alerts.Review type of alert to understand the cause for concern.Any examples used would be scrubbed and addresses anonymized. This initial sequence will be used for all the investigations.Īs the blog progresses, if you have an alert of concern and you are willing to provide a pcap, we can follow this process for your alert. We will follow a basic sequence to start the analysis. We will take specific Microsoft Defender for IoT alerts and try to understand what initiated the alert and if the issue is one needing further investigation or remediation or not. This blog will be one in a series of blogs to discuss the above topic.

Wireshark ip location map