Vlad Guliakin: skills

Vlad Guliakin - Case 001Case 001

It’s probably nothing.Investigating anyway.

Case 001NetSupport RAT check-ins from a Windows client

NetSupport Manager RAT signatures fired for 45.131.214[.]85 on TCP port 443, from 2026-02-28 19:55 UTC.

In plain words: A Windows computer on the network kept asking a remote-control server outside the network for orders: 264 times in this capture.

Evidence so far

Exhibit A Suricata alerts in Zui The alerts in the pcap, counted by signature. Enlarge Exhibit B Wireshark, Follow TCP Stream, stream 40 One check-in and the server's answer, word by word. Enlarge Exhibit C Zeek HTTP log in Zui The Windows internet check behind one alert. Enlarge

Read the case

Optional. Make the call yourself first, then compare it with mine.

Exhibit ASuricata alerts in Zui

Original, unedited

Zui: Suricata alerts counted by signature. NetSupport Remote Admin Checkin 264, HTTP traffic on port 443 (POST) 264, NetSupport Remote Admin Response 2, two others 1 each. — Showing: original evidence, unedited.

What it is

Suricata alerts in Zui, counted by signature. By source, destination and port, 528 of them (264 + 264) go from 10.2.28[.]88 to 45.131.214[.]85 on port 443. The two single alerts are the domain controller (10.2.28[.]2) and the Windows connection test in Exhibit C.

My marks and my read of this exhibit stay hidden until you open my assessment.

Log text, original. Select it or copy it.

event_type=="alert" | count() by alert.signature | sort -r count

{signature: ET INFO NetSupport Remote Admin Checkin} 264

{signature: ET POLICY HTTP traffic on port 443 (POST)} 264

{signature: ET INFO NetSupport Remote Admin Response} 2

{signature: SURICATA Applayer Detect protocol only one direction} 1

{signature: ET INFO Microsoft Connection Test} 1

OriginalScreenshot and log text exactly as captured

Exhibit BWireshark, Follow TCP Stream, stream 40

Original, unedited

Wireshark Follow TCP Stream: a NetSupport Manager/1.3 client POSTs CMD=POLL to /fakeurl.htm, and the server answers as NetSupport Gateway/1.92 with encoded data. — Showing: original evidence, unedited.

What it is

Wireshark filter ip.addr == 45.131.214[.]85, then Follow, TCP Stream, stream 40. The full stream holds 264 client packets and 2 server packets.

My marks and my read of this exhibit stay hidden until you open my assessment.

Log text, original. Select it or copy it.

POST hxxp://45.131.214[.]85/fakeurl.htm HTTP/1.1

User-Agent: NetSupport Manager/1.3

Content-Type: application/x-www-form-urlencoded

Content-Length: 22

Host: 45.131.214[.]85

Connection: Keep-Alive

CMD=POLL

INFO=1

ACK=1

HTTP/1.1 200 OK

Server: NetSupport Gateway/1.92 (Windows NT)

Content-Type: application/x-www-form-urlencoded

Content-Length: 69

Connection: Keep-Alive

CMD=ENCD

ES=1

DATA=(encoded bytes)

OriginalScreenshot and log text exactly as captured

Exhibit CZeek HTTP log in Zui

Original, unedited

Zui: one HTTP request at 19:55:09 UTC from 10.2.28.88 to www.msftconnecttest.com for /connecttest.txt, user agent Microsoft NCSI. — Showing: original evidence, unedited.

What it is

Zeek's HTTP log in Zui, for the server of the one Microsoft Connection Test alert (23.47.50[.]182).

My marks and my read of this exhibit stay hidden until you open my assessment.

Log text, original. Select it or copy it.

_path=="http" id.resp_h==23.47.50.182 | cut ts, id.orig_h, host, uri, user_agent

ts: 2026-02-28T19:55:09.772238Z

id.orig_h: 10.2.28[.]88

host: www.msftconnecttest[.]com

uri: /connecttest.txt

user_agent: Microsoft NCSI

OriginalScreenshot and log text exactly as captured

3 exhibitsMy assessment: hidden

About Vlad Guliakin

Vlad Guliakin

Open to SOC analyst and network administration roles · Miami, FL

AV Technical Specialist · Miami-Dade County

4 years in IT support and network operations

Résumé PDF Portfolio summary Email

Certificates

CompTIA Security+ · 2026Verify

Cisco CCNA · 2024Verify

Education: Associate's Degree, Network and System Administration, 2020

Miami-Dade County courts · 4 years

Mar 2025 – now AV Technical Specialist
Aug 2023 Computer Technician II
Sep 2022 Computer Technician I

Configured switches (including Juniper), VLANs and IP addressing for NDI, Dante and AVB multicast networks.
Identified network-stack crash failure modes across a large WolfVision Cynap deployment.
Deploys updates across six courtroom locations under change control, with risk assessment and rollback plans.
Root-cause analysis and Jira records for 50+ incidents; triage and SLA escalation for 1,000+ endpoints.

Full experience on the résumé

Projects

QR ScevioApp StoreAn iPhone app that inspects decoded QR content locally before you choose what to open.Token DamagenpmPrices what AI coding agents used, on one local receipt.JobHoundTelegramFiltered job alerts in one Telegram chat, never sent twice.

Skills

Back to the desk

Skills, and where on this desk you can see them used.

Skill	Where it is shown	Open it
Incident triage and investigation	Case 001: NetSupport RAT check-ins from a Windows client	Open
Wireshark, Zeek, Suricata (Zui)	Case 001, Exhibits A to C	Open
Detection rules (Sigma)	Case 001, Detection	Open
PowerShell, Windows	INCIDENT, Mission 1: Port 4444	Play
Linux, bash	INCIDENT, Mission 2: Knock knock	Play
Microsoft Sentinel, KQL	INCIDENT, Mission 3: Spray and pray	Play
Juniper switching, VLANs, multicast (NDI, Dante, AVB)	At work: AV Technical Specialist (résumé)	Open
Change control: risk assessment, rollback plans	At work: AV Technical Specialist (résumé)	Open
Root-cause analysis, Jira	At work: Computer Technician II (résumé)	Open
CompTIA Security+	Credly	Verify
Cisco CCNA	Credly	Verify
Swift, SwiftUI	QR Scevio	Open
TypeScript, Node.js	Token Damage	Open
Python, SQLite, Telegram Bot API	JobHound	Open

Skills14 skills

Case 001

Vlad Guliakin - Case 001Case 001

Case 001NetSupport RAT check-ins from a Windows client

Evidence so far

Exhibit ASuricata alerts in Zui

Exhibit BWireshark, Follow TCP Stream, stream 40

Exhibit CZeek HTTP log in Zui

Projects

Skills

System Properties

Display Properties

Shut Down