Vlad Guliakin - Case 001Case 001

It’s probably nothing.Investigating anyway.

Case 001NetSupport RAT check-ins from a Windows client

NetSupport Manager RAT signatures fired for 45.131.214[.]85 on TCP port 443, from 2026-02-28 19:55 UTC.

In plain words: A Windows computer on the network kept asking a remote-control server outside the network for orders: 264 times in this capture.

Evidence so far

Exhibit A Suricata alerts in Zui The alerts in the pcap, counted by signature. Enlarge Exhibit B Wireshark, Follow TCP Stream, stream 40 One check-in and the server's answer, word by word. Enlarge Exhibit C Zeek HTTP log in Zui The Windows internet check behind one alert. Enlarge

Read the case

Optional. Make the call yourself first, then compare it with mine.

Exhibit ASuricata alerts in Zui

Original, unedited

Zui: Suricata alerts counted by signature. NetSupport Remote Admin Checkin 264, HTTP traffic on port 443 (POST) 264, NetSupport Remote Admin Response 2, two others 1 each. — Showing: original evidence, unedited.

What it is

Suricata alerts in Zui, counted by signature. By source, destination and port, 528 of them (264 + 264) go from 10.2.28[.]88 to 45.131.214[.]85 on port 443. The two single alerts are the domain controller (10.2.28[.]2) and the Windows connection test in Exhibit C.

My marks and my read of this exhibit stay hidden until you open my assessment.

Log text, original. Select it or copy it.

event_type=="alert" | count() by alert.signature | sort -r count

{signature: ET INFO NetSupport Remote Admin Checkin} 264

{signature: ET POLICY HTTP traffic on port 443 (POST)} 264

{signature: ET INFO NetSupport Remote Admin Response} 2

{signature: SURICATA Applayer Detect protocol only one direction} 1

{signature: ET INFO Microsoft Connection Test} 1

OriginalScreenshot and log text exactly as captured

Exhibit BWireshark, Follow TCP Stream, stream 40

Original, unedited

Wireshark Follow TCP Stream: a NetSupport Manager/1.3 client POSTs CMD=POLL to /fakeurl.htm, and the server answers as NetSupport Gateway/1.92 with encoded data. — Showing: original evidence, unedited.

What it is

Wireshark filter ip.addr == 45.131.214[.]85, then Follow, TCP Stream, stream 40. The full stream holds 264 client packets and 2 server packets.

My marks and my read of this exhibit stay hidden until you open my assessment.

Log text, original. Select it or copy it.

POST hxxp://45.131.214[.]85/fakeurl.htm HTTP/1.1

User-Agent: NetSupport Manager/1.3

Content-Type: application/x-www-form-urlencoded

Content-Length: 22

Host: 45.131.214[.]85

Connection: Keep-Alive

CMD=POLL

INFO=1

ACK=1

HTTP/1.1 200 OK

Server: NetSupport Gateway/1.92 (Windows NT)

Content-Type: application/x-www-form-urlencoded

Content-Length: 69

Connection: Keep-Alive

CMD=ENCD

ES=1

DATA=(encoded bytes)

OriginalScreenshot and log text exactly as captured

Exhibit CZeek HTTP log in Zui

Original, unedited

Zui: one HTTP request at 19:55:09 UTC from 10.2.28.88 to www.msftconnecttest.com for /connecttest.txt, user agent Microsoft NCSI. — Showing: original evidence, unedited.

What it is

Zeek's HTTP log in Zui, for the server of the one Microsoft Connection Test alert (23.47.50[.]182).

My marks and my read of this exhibit stay hidden until you open my assessment.

Log text, original. Select it or copy it.

_path=="http" id.resp_h==23.47.50.182 | cut ts, id.orig_h, host, uri, user_agent

ts: 2026-02-28T19:55:09.772238Z

id.orig_h: 10.2.28[.]88

host: www.msftconnecttest[.]com

uri: /connecttest.txt

user_agent: Microsoft NCSI

OriginalScreenshot and log text exactly as captured

3 exhibitsMy assessment: hidden

About Vlad Guliakin

Vlad Guliakin

Open to SOC analyst and network administration roles · Miami, FL

AV Technical Specialist · Miami-Dade County

4 years in IT support and network operations

Résumé PDF Portfolio summary Email

Certificates

CompTIA Security+ · 2026Verify

Cisco CCNA · 2024Verify

Education: Associate's Degree, Network and System Administration, 2020

Miami-Dade County courts · 4 years

Mar 2025 – now AV Technical Specialist
Aug 2023 Computer Technician II
Sep 2022 Computer Technician I

Configured switches (including Juniper), VLANs and IP addressing for NDI, Dante and AVB multicast networks.
Identified network-stack crash failure modes across a large WolfVision Cynap deployment.
Deploys updates across six courtroom locations under change control, with risk assessment and rollback plans.
Root-cause analysis and Jira records for 50+ incidents; triage and SLA escalation for 1,000+ endpoints.

Full experience on the résumé

Projects

QR ScevioApp StoreAn iPhone app that inspects decoded QR content locally before you choose what to open.Token DamagenpmPrices what AI coding agents used, on one local receipt.JobHoundTelegramFiltered job alerts in one Telegram chat, never sent twice.

Portfolio summary

Back to the desk

Vlad Guliakin

Open to SOC analyst and network administration roles, remote or on-site. Miami, FL.

Résumé PDF Email vguliakin@pm.me LinkedIn GitHub

Cases

001NetSupport RAT check-ins from a Windows clientReal threat

INCIDENT, a SOC console game

M1Port 4444PowerShell, Windows M2Knock knockLinux, bash M3Spray and prayMicrosoft Sentinel, KQL

Experience

Miami-Dade County, Eleventh Judicial Circuit · 4 years

AV Technical Specialist

Mar 2025 to present

Configured switches (including Juniper), VLANs and IP addressing for NDI, Dante and AVB multicast networks.
Troubleshot failures across a large WolfVision Cynap deployment and identified its network-stack crash failure modes.
Deploys firmware, software and configuration updates across six courtroom locations under change control, with risk assessment and rollback plans.

Computer Technician II

Aug 2023 to Mar 2025

Completed root-cause analysis and documented 50+ incidents in Jira.
Triaged and escalated high-impact incidents per procedure.
Supported 15+ upgrades a year under change control, with validation before release and verification after.

Computer Technician I

Sep 2022 to Aug 2023

Managed ITSM tickets, documenting troubleshooting steps and resolutions.
Delivered L1 technical support for Windows endpoints and Microsoft 365.

Skills

Each skill, and where on this desk you can see it used

Certificates

CompTIA Security+

SY0-701 · active 2026-10-06 to 2029-10-06

Verify

Cisco CCNA

active 2024-02-07 to 2027-02-07

Verify

Projects

QR Scevio An iPhone app that inspects decoded QR content locally before you choose what to open. On the App Store.Token Damage Command-line tool that prices what AI coding agents used, on one local receipt. On npm.JobHound Telegram bot that sends filtered job alerts and never sends one twice.

Education

Associate's Degree, Network and System Administration, 2020

Portfolio summary2 certificates · 3 projects

Case 001

Vlad Guliakin - Case 001Case 001

Case 001NetSupport RAT check-ins from a Windows client

Evidence so far

Exhibit ASuricata alerts in Zui

Exhibit BWireshark, Follow TCP Stream, stream 40

Exhibit CZeek HTTP log in Zui

Projects

Portfolio summary

Vlad Guliakin

Cases

INCIDENT, a SOC console game

Experience

Skills

Certificates

Projects

Education

System Properties

Display Properties

Shut Down