The Stuxnet Discovery (2010) — Network Forensics & SCADA Analysis

Researchers found anomalous ICMP traffic from Iranian nuclear facilities. Network forensic analysis revealed P2P commands within the LAN manipulating PLC controllers.

## Background

Researchers found anomalous ICMP traffic from Iranian nuclear facilities. Network forensic analysis revealed P2P commands within the LAN manipulating PLC controllers.

## Learning Objective
Analyze packet captures (PCAPs) and proxy logs to reconstruct network sessions and data exfiltration routes.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: The Stuxnet Discovery (2010) — Network Forensics & SCADA Analysis
- Year: 2010
- Domain: Cyber Forensics
- Difficulty: Expert

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-stuxnet-discovery

## Investigation Questions

1. What made the Stuxnet network traffic anomalous?
2. How did deep packet inspection reveal the C2 protocol?
3. Why were ICMP packets used for command and control?
4. How would you use tshark to filter for the malicious packets?
5. What distinguishes SCADA/industrial network forensics from traditional IT forensics?

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
Follow the TCP Stream is your best friend. Reassemble the packets to see what the attacker actually typed.

## Forensic Takeaway
Network forensics involves deep packet inspection. The data payload inside the network packet told the story of the most sophisticated cyber-weapon ever deployed.