Throughout this book, we've covered most of the manual techniques to uncover network evidence. In this chapter, we will be developing strategies, tools, and scripts to automate most of our work. Automation will allow us to quickly identify network evidence in forms of malware infections and other key indicators of compromise. Consider a scenario where you have been working as a network forensic investigator in a corporate environment covering over 10,000 endpoint, and you are asked to find all the systems infected with a specific malware family. Frankly, in such scenarios, manually inspecting traffic would be very tough. Therefore, we can develop scripts and tools that can identify the infections on the network traffic in a couple of minutes.
In this chapter, we will cover the following topics:
- Automation using Python and Scapy...