This workshop uses Wireshark to investigate Windows-based malware activity. Participants review packet captures (pcaps) of network traffic based on alerts from an Intrusion Detection System (IDS).