analyzing-network-traffic-of-malware

Featured

Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.

AI & Automation 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Analyzing Network Traffic of Malware ## When to Use - Sandbox execution has captured a PCAP file and the network behavior needs detailed analysis - Identifying the C2 protocol structure for writing network detection signatures - Determining what data the malware exfiltrates and to which external infrastructure - Analyzing DNS tunneling, domain generation algorithms (DGA), or fast-flux behavior - Creating Suricata/Snort signatures based on observed malware network patterns **Do not use** for host-based analysis of malware behavior; use Cuckoo sandbox reports or Volatility memory analysis for process-level activity. ## Prerequisites - Wireshark 4.x installed for interactive PCAP analysis - tshark (Wireshark CLI) for scripted packet extraction - Zeek installed for automated metadata generation from PCAPs - Suricata with ET Open/ET Pro rulesets for signature matching - NetworkMiner for file extraction and credential detection from PCAPs - Python 3.8+ with `scapy` and `dpkt` for programmatic packet analysis ## Workflow ### Step 1: Initial PCAP Overview Get a high-level understanding of the network traffic: ```bash # Capture statistics capinfos malware.pcap # Protocol hierarchy tshark -r malware.pcap -q -z io,phs # Endpoint statistics (top talkers) tshark -r malware.pcap -q -z endpoints,ip # Conversation statistics tshark -r malware.pcap -q -z conv,tcp # DNS query summary tshark -r malware.pcap -q -z dns,tree ``` ### Step 2: Analyze DNS Activity Examine DNS queries...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

Data & Documents Solid

ctf-malware

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.

2,227 Updated 4 weeks ago
ljagiello
AI & Automation Featured

analyzing-command-and-control-communication

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.

12,642 Updated today
mukul975
AI & Automation Featured

analyzing-network-traffic-for-incidents

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.

12,642 Updated today
mukul975
AI & Automation Featured

analyzing-network-covert-channels-in-malware

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.

12,642 Updated today
mukul975
AI & Automation Featured

analyzing-network-traffic-with-wireshark

Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.

12,642 Updated today
mukul975