4.5Protocol headers, artifacts, and regular expressions

Packet headers are a trove of clues for decoding an attack. Knowing what each field means lets you spot a scan type (TCP flags), a suspected C2 (abnormal DNS queries), or spoofing (duplicate ARP) without reading all the content. And extracting the solid traces obtained from analysis—artifacts (IOCs)—and sharing them lets other systems search for and block the same threat. To pick target strings out of massive logs and payloads, regular expressions are indispensable. This section ties together reading major protocol headers, the elements of IOCs, and basic regex as tools for SOC search and surfacing.

4.5.1Major protocol headers and their reading

• L2/L3: Ethernet carries source/destination MAC and EtherType (the first 3 bytes of a MAC, the OUI, hint at the NIC vendor; local segment only). IPv4 has src/dst IP, TTL, protocol number, and flags/fragment (TTL as remaining hops hints at OS/path length). IPv6 has 128-bit addresses, a Next Header, and a Hop Limit. ARP resolves IP<->MAC; multiple MACs for one IP or suspicious gratuitous ARP signals ARP spoofing.
• L4: TCP has src/dst ports, seq/ack, flags (SYN/ACK/FIN/RST/PSH/URG), and a window. The flag pattern indicates a scan type (many SYN-only = SYN scan; frequent RST = closed-port responses). UDP has only src/dst ports and length and is connectionless. ICMP has type/code (echo request/reply, unreachable) and is material for a ping sweep or ICMP tunneling.
• L7: DNS shows domain names in queries/responses; abnormally long random subdomains or many TXT records suggest DNS tunneling/DGA. HTTP (80) exposes Host/URI/User-Agent/method, while HTTPS (443) encrypts the body with TLS, exposing about the SNI only. Email is SMTP (25/587) to send, POP3 (110), IMAP (143) to receive, where From/To/Subject and attachments are key to phishing analysis.

4.5.2Elements of an artifact (IOC)

• An artifact is a solid trace obtained from analysis that uniquely points to a threat. From the network: IPs, domains, URLs, User-Agent; from files: hashes (md5/sha256), filenames, paths; from hosts: registry keys, mutexes, creating users. These are registered and shared as IOCs (indicators of compromise), usable to search or block across other assets.
• A good artifact is specific and reproducible (e.g., a particular sha256, a particular C2 domain); a vague phrase like "a suspicious EXE" is not an IOC. Header/payload analysis -> artifact extraction -> IOC sharing—propagating one analysis result into organization-wide detection—is where a SOC adds value.

4.5.3Basic regular expressions

• A regular expression describes string patterns and is used in SIEM search, grep, and IPS signatures (pcre). Basics: anchors ^ (line start) / $ (line end); character classes [0-9] or \d (digit) / \w (word char); quantifiers * (zero+) / + (one+) / ? (zero or one) / {n} (n times); any single char .; alternation a|b; groups (...).
• Practical examples: to grab IPv4, \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b (the . must be a literal, escaped as \.); to grab a sha256-like 64-hex string, \b[a-f0-9]{64}\b; a rough email extraction, [\w.-]+@[\w.-]+. The key is to escape a metacharacter when searching for it literally (. -> \.); neglecting it turns it into "any single char" and mismatches.

Investigating a suspected phishing case, you are handed a pcap of one email delivery and the proxy logs. The email arrived over SMTP (25), and while its From header spoofs a legitimate domain, the actual delivering IP and Received path are an unrelated overseas host—yielding the clue of a sender-authentication mismatch. A link in the body is http://secure-login.bad.example/verify, which, when a user clicks it, traverses the proxy over HTTP (80), leaving the User-Agent and URL in the log. To pick that URL and similar variants out of massive proxy logs, you search with a regular expression like https?://[\w.-]*bad\.example/\S* (escaping . as \., and s? to cover both http/https). From the hits you extract solid artifacts—the malicious domain bad.example, the full URL, the affected user, and, if there is an attachment, its sha256. Registering these as IOCs lets you sweep proxy/DNS logs for traces of other users reaching the same domain, and if DNS shows abnormally long random subdomains, you can suspect additional tunneling. The key is that knowing which protocol each header field belongs to and what it means determines how fast you extract clues. Misreading the mail protocol—"this is IMAP (143) receiving, so the sender is irrelevant"—would make you miss the core evidence of a forged delivery path. And the extracted traces feed organization-wide detection only once they are distilled into reproducible, specific IOCs (domain, URL, hash) rather than a vague "suspicious email."

4.5.4Section summary

• Headers are a trove of clues: TCP flags for scanning, long random DNS for tunneling/DGA, one IP with many MACs in ARP for spoofing, HTTPS encrypts the body leaving about the SNI; also memorize ports (80/443/53/25/110/143)
• An artifact (IOC) is a specific, reproducible trace (hash, domain, URL, IP); a vague phrase is not an IOC, and extraction -> sharing propagates it into organization-wide detection
• A regex rests on ^ $ [] \d + * ? {n} . | (); escape the metacharacter . as \. when literal (neglecting it turns it into any-single-char and mismatches)