Hey everyone! 👋 As a cybersecurity student diving into Blue Team operations, one of the first concepts you learn is the Cyber Kill Chain.

  • Before an adversary can exploit a system, they need to perform reconnaissance.

¿What is one of the most classic techniques? A port scan.

  • Think of it as a digital burglar walking down a street, rattling every single doorknob to see which house left a door unlocked.

🧪 1. The Lab Setup: Simulating the Scan

  • To understand the telemetry, we need real data. In a controlled home lab environment:
  1. The Attacker: 🐉 A machine running Kali Linux.
  2. The Target: 💻 A local test virtual machine.
  3. The Action: ⚡ Executing a basic SYN stealth scan using Nmap:

nmap -sS -p 1-100 <TARGET_IP>

🌐 2. The Network View: Wireshark & The Handshake Trick

  • If you capture the traffic passing through your network interface, regular traffic l*ooks peaceful.*

  • During a port scan, however, the TCP Three-Way Handshake gets weird:

  1. Normal Flow: Client sends SYN ➡️ Server replies with SYN-ACK ➡️ Client replies with ACK
  2. The Port Scan Flow: The scanner sends a SYN packet. If the port is open, the target replies with SYN-ACK. But instead of completing the handshake with an ACK, the scanner instantly slams the brakes with a RST.

💡 ¿Why do this? Attackers use this trick to avoid leaving full connection logs in the application layer. But network monitors spot this rapid-fire burst of SYN -> RST.

🖥️ 3. The Operating System View: ¿What Do the Logs Say?

  • Depending on the operating system target, the system logs will catch the sudden spike in connection attempts:

🖥 In Windows (Event Viewer):

  • If Windows Defender Firewall with Advanced Security is logging dropped/allowed packets, you'll spot a flood of security events.

🐧 In Linux (Syslog / Kernel Logs):

  • If you inspect kernel logs or packet filtering logs (iptables / nftables), you'll notice a massive wave of incoming packets targeting closed ports, triggering kernel warnings about unhandled connection drops.

🚨 4. How SOCs Detect This Automatically

  • In a real-world Security Operations Center (SOC), analysts don't manually sift through thousands of event viewer lines. Instead, SIEM tools process these logs and trigger automated alerts.

🎯 Final Thoughts

Understanding how offensive tools leave footprints in defensive logs is the core of becoming a solid Blue Team analyst 🛡️. Bridging the gap between how an attack is executed and how it is logged is the ultimate superpower for threat detection! 🌟