Question 1: File Type of Exfiltrated Document#

Task: What was the file type of the exfiltrated document?

Answer: Excel spreadsheet (.xls)

Discovery Method:

• Analyzed file upload messages in the PCAP
• Found sensitive_customer_list.xls with MIME type application/vnd.ms-excel
• File size: 6656 bytes
• Located in packet 21222 (internal upload) and packet 27162 (rogue upload)

Question 2: User Who Uploaded to Rogue Workspace#

Task: Which user uploaded the sensitive file to the rogue workspace?

Answer: James Brown

Discovery Method:

• Searched for user_change and user_profile_changed events in PCAP
• Found user profile in packet 26916:

  1
  {
  2
    "id": "U09KRBDV8S1",
  3
    "name": "jamesb",
  4
    "real_name": "james brown"
  5
  }
  

• Confirmed upload to rogue workspace in packet 27162
• Rogue workspace: secret-ops-workspace.slack.com (Team ID: T09KSNJU27Q)

Question 3: GMT Time File Was Shared Internally#

Task: At what GMT time was the sensitive file shared internally, within the legitimate company?

Answer: 2025-10-10 11:51:36 GMT

Discovery Method:

• Distinguished between file upload and file share events
• File uploaded: timestamp 1760097092 = 2025-10-10 11:51:32 GMT (packet 21222)
• File shared to channel: file_shared event at timestamp 1760097096.001600 (packet 21237)
• The share event is when it became accessible to the team

Key Evidence:

1
{
2
  "type": "file_shared",
3
  "file_id": "F09KYB2DERJ",
4
  "user_id": "U09KA40P3F0",
5
  "channel_id": "C09L7LPF4Q1",
6
  "ts": "1760097096.001600"
7
}

Question 4: Internal User Who Shared the Document#

Task: Which internal user initially shared the sensitive document?

Answer: Ava

Discovery Method:

• User ID U09KA40P3F0 uploaded the file (packet 21222)
• No full user profile found in PCAP for this user
• Found context in conversation messages:
  • “thanks for sharing, Ava” (User U09KAAYFSBY thanking Ava)
  • “thank you Emma and Ava” (User U09KLC2V202 acknowledging Ava)
• Confirmed Ava = U09KA40P3F0 based on conversation context
• File shared with message: “no worries, here’s the latest customer”

Question 5: Rogue Server FQDN#

Task: What domain hostname FQDN is associated with the rogue server?

Answer: secret-ops-workspace.slack.com

Discovery Method:

• Analyzed all Slack workspace domains in PCAP
• Legitimate workspace: team-megacorp.slack.com (Team ID: T09KR3R0PFB)
• Rogue workspace found in packet 27162:

  1
  Workspace: secret-ops-workspace.slack.com
  2
  Team ID: T09KSNJU27Q
  3
  Channel: C09KSNR5F6J (secret-ops-collaboration)
  

• Confirmed exfiltration when James Brown uploaded the same file to this rogue workspace

Question 6: File Uploaded Before Sensitive One#

Task: Which file was uploaded right before the sensitive one?

Answer: meeting-minutes_2025-10-09.pdf

Discovery Method:

• Extracted chronological file upload timeline from PCAP:

• The file uploaded immediately before the sensitive file was meeting-minutes_2025-10-09.pdf

Question 7: Last Customer Email Address#

Task: What is the email address of the last customer listed in the sensitive file?

Answer: carol@novaenergy.com

Discovery Method:

• Extracted the Excel file from PCAP (packet 21194 contained file data)
• Parsed sensitive_customer_list.xls using pandas
• Found 3 customers in the spreadsheet:

• Last customer (row 3): Nova Energy with email carol@novaenergy.com

PCAP Statistics#

• Total Packets: 234,337
• Capture Duration: ~22 minutes (1760096413 to 1760097734)
• HTTP Packets: 1,184
• Slack API Requests: 446

Key Packet Numbers#

• Packet 12662-12664: Channel company_documents created by U09KA40P3F0
• Packet 21194: Excel file data in multipart/form-data
• Packet 21222: Internal file upload to MegaCorp workspace
• Packet 21237: file_shared event (file shared to channel)
• Packet 26916: James Brown user profile data
• Packet 27162: Rogue workspace upload by James Brown

Timeline of Events#

1. 11:44:57 GMT - company_documents channel created
2. 11:46:58 GMT - architecture_diagram.png uploaded
3. 11:47:16 GMT - onboarding_checklist.docx uploaded
4. 11:47:25 GMT - meeting-minutes_2025-10-09.pdf uploaded
5. 11:51:32 GMT - sensitive_customer_list.xls uploaded by Ava
6. 11:51:36 GMT - File shared to channel (file_shared event)
7. 11:57:48 GMT - Same file exfiltrated to rogue workspace by James Brown

1. analyze_slack_exfiltration.py#

A comprehensive PCAP analysis tool for Slack forensics.

Features:

• Loads PCAP using Scapy
• Searches for file upload events
• Extracts JSON payloads from HTTP packets
• Identifies user profiles and conversation messages
• Converts Unix timestamps to GMT format

Key Functions:

• rdpcap() - Load PCAP file
• re.findall() - Extract patterns from payloads
• Timestamp conversion (Unix GMT)
• JSON parsing for Slack API responses

2. find_exfiltration.py#

Focused script for detecting data exfiltration events in PCAP.

Features:

• Searches for file upload events to rogue workspaces
• Identifies suspicious file transfer patterns
• Extracts exfiltration timestamps and user information

Key Functions:

• Packet filtering for suspicious Slack traffic
• JSON event parsing for rogue workspace uploads
• Timestamp conversion and validation

3. question.txt#

Challenge questions file containing the 7 investigation questions.

Python Script: analyze_slack_exfiltration.py