[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADR0505HTBJDCSXSAV9YXV":3,"skill-same:01M6ADR0505HTBJDCSXSAV9YXV":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6ADR0505HTBJDCSXSAV9YXV","analyzing-network-traffic-of-malware",null,"Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-of-malware\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"analyzing network traffic of malware","malware","network","analyzing","exfiltration","network-analysis","Zeek","Wireshark","pcap","data","sandbox","c2-detection","malware-analysis","c2","downloads","protocols","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-network-traffic-of-malware\ndescription: 'Analyzes network traffic generated by malware during sandbox execution\n  or live incident response to identify C2 protocols, data exfiltration channels,\n  payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata.\n  Activates for requests involving malware network analysis, C2 traffic decoding,\n  malware PCAP analysis, or network-based malware detection.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- network-analysis\n- PCAP\n- Wireshark\n- C2-detection\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1571\n- T1573\n- T1095\n---\n\n# Analyzing Network Traffic of Malware\n\n## When to Use\n\n- Sandbox execution has captured a PCAP file and the network behavior needs detailed analysis\n- Identifying the C2 protocol structure for writing network detection signatures\n- Determining what data the malware exfiltrates and to which external infrastructure\n- Analyzing DNS tunneling, domain generation algorithms (DGA), or fast-flux behavior\n- Creating Suricata\u002FSnort signatures based on observed malware network patterns\n\n**Do not use** for host-based analysis of malware behavior; use Cuckoo sandbox reports or Volatility memory analysis for process-level activity.\n\n## Prerequisites\n\n- Wireshark 4.x installed for interactive PCAP analysis\n- tshark (Wireshark CLI) for scripted packet extraction\n- Zeek installed for automated metadata generation from PCAPs\n- Suricata with ET Open\u002FET Pro rulesets for signature matching\n- NetworkMiner for file extraction and credential detection from PCAPs\n- Python 3.8+ with `scapy` and `dpkt` for programmatic packet analysis\n\n## Workflow\n\n### Step 1: Initial PCAP Overview\n\nGet a high-level understanding of the network traffic:\n\n```bash\n# Capture statistics\ncapinfos malware.pcap\n\n# Protocol hierarchy\ntshark -r malware.pcap -q -z io,phs\n\n# Endpoint statistics (top talkers)\ntshark -r malware.pcap -q -z endpoints,ip\n\n# Conversation statistics\ntshark -r malware.pcap -q -z conv,tcp\n\n# DNS query summary\ntshark -r malware.pcap -q -z dns,tree\n```\n\n### Step 2: Analyze DNS Activity\n\nExamine DNS queries for DGA, tunneling, or C2 domain resolution:\n\n```bash\n# Extract all DNS queries\ntshark -r malware.pcap -T fields -e frame.time -e dns.qry.name -e dns.a \\\n  -Y \"dns.flags.response == 1\" | sort\n\n# Detect DGA patterns (high entropy domain names)\npython3 \u003C\u003C 'PYEOF'\nimport math\nfrom collections import Counter\n\ndef entropy(s):\n    p = [n\u002Flen(s) for n in Counter(s).values()]\n    return -sum(pi * math.log2(pi) for pi in p if pi > 0)\n\n# Parse DNS queries from tshark output\nimport subprocess\nresult = subprocess.run(\n    [\"tshark\", \"-r\", \"malware.pcap\", \"-T\", \"fields\", \"-e\", \"dns.qry.name\",\n     \"-Y\", \"dns.flags.response == 0\"],\n    capture_output=True, text=True\n)\n\ndomains = set(result.stdout.strip().split('\\n'))\nprint(\"Suspicious DNS queries (high entropy):\")\nfor domain in domains:\n    if domain:\n        subdomain = domain.split('.')[0]\n        ent = entropy(subdomain)\n        if ent > 3.5 and len(subdomain) > 10:\n            print(f\"  {domain} (entropy: {ent:.2f})\")\nPYEOF\n\n# Detect DNS tunneling (large TXT responses)\ntshark -r malware.pcap -T fields -e dns.qry.name -e dns.txt \\\n  -Y \"dns.resp.type == 16 and dns.resp.len > 100\"\n```\n\n### Step 3: Analyze HTTP\u002FHTTPS C2 Communication\n\nExamine web-based command-and-control traffic:\n\n```bash\n# Extract HTTP requests\ntshark -r malware.pcap -T fields \\\n  -e frame.time -e ip.src -e ip.dst -e http.host \\\n  -e http.request.method -e http.request.uri -e http.user_agent \\\n  -Y \"http.request\"\n\n# Extract HTTP response bodies (potential payload downloads)\ntshark -r malware.pcap -T fields \\\n  -e http.host -e http.request.uri -e http.content_type -e tcp.len \\\n  -Y \"http.response and tcp.len > 1000\"\n\n# Extract POST data (potential exfiltration)\ntshark -r malware.pcap -T fields \\\n  -e http.host -e http.request.uri -e http.file_data \\\n  -Y \"http.request.method == POST\"\n\n# TLS analysis (SNI, JA3 fingerprints)\ntshark -r malware.pcap -T fields \\\n  -e tls.handshake.extensions_server_name \\\n  -e tls.handshake.ja3 \\\n  -Y \"tls.handshake.type == 1\"\n\n# Extract TLS certificate details\ntshark -r malware.pcap -T fields \\\n  -e x509ce.dNSName -e x509af.serialNumber \\\n  -e x509sat.utf8String \\\n  -Y \"tls.handshake.type == 11\"\n\n# Export HTTP objects (downloaded files)\ntshark -r malware.pcap --export-objects http,exported_files\u002F\n```\n\n### Step 4: Detect Beaconing Patterns\n\nIdentify regular periodic communication indicating C2 beaconing:\n\n```python\n# Beacon detection from PCAP\nfrom scapy.all import rdpcap, IP, TCP\nfrom collections import defaultdict\nimport statistics\n\npackets = rdpcap(\"malware.pcap\")\n\n# Group connections by destination IP:port\nconnections = defaultdict(list)\nfor pkt in packets:\n    if IP in pkt and TCP in pkt:\n        if pkt[TCP].flags & 0x02:  # SYN flag\n            dst = f\"{pkt[IP].dst}:{pkt[TCP].dport}\"\n            connections[dst].append(float(pkt.time))\n\n# Analyze timing intervals for beaconing\nprint(\"Beacon Analysis:\")\nfor dst, times in connections.items():\n    if len(times) >= 5:\n        intervals = [times[i+1] - times[i] for i in range(len(times)-1)]\n        avg = statistics.mean(intervals)\n        stdev = statistics.stdev(intervals) if len(intervals) > 1 else 0\n        jitter = (stdev \u002F avg * 100) if avg > 0 else 0\n\n        if 10 \u003C avg \u003C 3600 and jitter \u003C 30:  # Regular interval with \u003C 30% jitter\n            print(f\"  [!] {dst}: {len(times)} connections\")\n            print(f\"      Interval: {avg:.1f}s ± {stdev:.1f}s (jitter: {jitter:.1f}%)\")\n            print(f\"      Pattern: LIKELY BEACONING\")\n```\n\n### Step 5: Generate Network Detection Signatures\n\nCreate Suricata\u002FSnort rules from observed traffic patterns:\n\n```bash\n# Run Suricata against the PCAP for existing signature matches\nsuricata -r malware.pcap -l suricata_output\u002F -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n\n# Review alerts\ncat suricata_output\u002Ffast.log\n\n# Create custom Suricata rule from observed patterns\ncat \u003C\u003C 'EOF' > custom_malware.rules\n# C2 beacon detection based on observed URI pattern\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX C2 Beacon\";\n    flow:established,to_server;\n    http.method; content:\"POST\";\n    http.uri; content:\"\u002Fgate.php?id=\";\n    http.user_agent; content:\"Mozilla\u002F5.0 (compatible; MSIE 10.0)\";\n    sid:9000001; rev:1;\n)\n\n# DNS query for known C2 domain\nalert dns $HOME_NET any -> any any (\n    msg:\"MALWARE MalwareX C2 DNS Query\";\n    dns.query; content:\"update.malicious.com\";\n    sid:9000002; rev:1;\n)\n\n# JA3 hash match for malware TLS client\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX JA3 Match\";\n    ja3.hash; content:\"a0e9f5d64349fb13191bc781f81f42e1\";\n    sid:9000003; rev:1;\n)\nEOF\n```\n\n### Step 6: Extract Files and Artifacts from Traffic\n\nRecover transferred files and embedded data:\n\n```bash\n# Extract files using Zeek\nzeek -r malware.pcap \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fpolicy\u002Fframeworks\u002Ffiles\u002Fextract-all-files.zeek\nls extract_files\u002F\n\n# Extract files using NetworkMiner (GUI)\n# Or use tshark for specific protocol exports\ntshark -r malware.pcap --export-objects http,http_objects\u002F\ntshark -r malware.pcap --export-objects smb,smb_objects\u002F\ntshark -r malware.pcap --export-objects tftp,tftp_objects\u002F\n\n# Hash all extracted files\nsha256sum http_objects\u002F* smb_objects\u002F* 2>\u002Fdev\u002Fnull\n\n# Generate Zeek logs for comprehensive metadata\nzeek -r malware.pcap\n# Output: conn.log, dns.log, http.log, ssl.log, files.log, etc.\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Beaconing** | Regular periodic connections from malware to C2 server, identifiable by consistent time intervals and packet sizes |\n| **JA3\u002FJA3S** | TLS fingerprinting method creating a hash from ClientHello\u002FServerHello parameters to uniquely identify malware TLS implementations |\n| **DGA (Domain Generation Algorithm)** | Algorithm generating pseudo-random domain names that malware queries to locate C2 servers, evading static domain blocklists |\n| **DNS Tunneling** | Encoding data in DNS queries and responses to establish a C2 channel or exfiltrate data through DNS infrastructure |\n| **Fast Flux** | DNS technique rapidly rotating IP addresses for a domain to avoid takedown and distribute C2 across many compromised hosts |\n| **SNI (Server Name Indication)** | TLS extension revealing the hostname the client is connecting to; visible even in encrypted HTTPS connections |\n| **Network Signature** | Suricata\u002FSnort rule matching specific patterns in network traffic (headers, payloads, timing) to detect malicious communications |\n\n## Tools & Systems\n\n- **Wireshark**: Open-source packet analyzer for deep interactive inspection of network traffic at the protocol level\n- **Zeek**: Network analysis framework generating structured metadata logs (conn, dns, http, ssl) from live or captured traffic\n- **Suricata**: High-performance network IDS\u002FIPS for signature-based detection with Lua scripting for custom detection logic\n- **NetworkMiner**: Network forensic analysis tool for extracting files, images, and credentials from PCAP files\n- **Scapy**: Python packet manipulation library for programmatic packet analysis, beacon detection, and protocol decoding\n\n## Common Scenarios\n\n### Scenario: Decoding a Custom Binary C2 Protocol\n\n**Context**: Malware communicates with its C2 server using a custom binary protocol over TCP port 8443. Standard HTTP analysis yields no results. The protocol structure needs to be reverse engineered from the PCAP.\n\n**Approach**:\n1. Filter the PCAP for TCP port 8443 conversations and follow the TCP stream\n2. Identify the message framing (length prefix, delimiter, fixed-size headers)\n3. Compare multiple messages to identify static header fields vs variable data fields\n4. Cross-reference with reverse engineering findings from Ghidra (if the binary was analyzed)\n5. Write a Wireshark dissector or Scapy parser for the custom protocol\n6. Create Suricata rules matching the static header bytes for network detection\n7. Document the full protocol specification for threat intelligence sharing\n\n**Pitfalls**:\n- Analyzing only the first few packets; some C2 protocols change behavior after initial handshake\n- Not decrypting TLS traffic when the sandbox has MITM capabilities\n- Confusing legitimate CDN or cloud traffic with C2 (validate destination IPs)\n- Missing C2 traffic that uses DNS or ICMP instead of TCP\u002FUDP\n\n## Output Format\n\n```\nMALWARE NETWORK TRAFFIC ANALYSIS\n===================================\nPCAP File:        malware_sandbox.pcap\nDuration:         300 seconds\nTotal Packets:    12,847\nTotal Bytes:      4.2 MB\n\nDNS ACTIVITY\nTotal Queries:    47\nDGA Detected:     Yes (23 high-entropy queries to .com TLD)\nTunneling:        No\nResolved C2:      update.malicious[.]com -> 185.220.101[.]42\n\nC2 COMMUNICATION\nProtocol:         HTTPS (TLS 1.2)\nServer:           185.220.101[.]42:443\nSNI:              update.malicious[.]com\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nBeacon Interval:  60.2s ± 6.8s (11.3% jitter)\nTotal Sessions:   237\nData Sent:        147 MB\nData Received:    2.3 MB\nCertificate:      CN=update.malicious[.]com (self-signed, expired)\n\nPAYLOAD DOWNLOADS\nGET \u002Fpayload.dll from compromised-site[.]com\n  Size: 98,304 bytes\n  SHA-256: abc123def456...\n  Content-Type: application\u002Foctet-stream\n\nEXFILTRATION\nMethod:           HTTPS POST to \u002Fgate.php\nContent-Type:     application\u002Foctet-stream\nAverage Size:     15,432 bytes per request\nTotal Volume:     147 MB over 4 hours\n\nSURICATA ALERTS\n[1:2028401] ET MALWARE Generic C2 Beacon Pattern\n[1:2028500] ET POLICY Self-Signed Certificate\n\nGENERATED SIGNATURES\nSID 9000001: MalwareX HTTP beacon pattern\nSID 9000002: MalwareX DNS C2 domain\nSID 9000003: MalwareX JA3 TLS fingerprint\n```\n","# Analyzing Network Traffic of Malware\n\n## When to Use\n\n- Sandbox execution has captured a PCAP file and the network behavior needs detailed analysis\n- Identifying the C2 protocol structure for writing network detection signatures\n- Determining what data the malware exfiltrates and to which external infrastructure\n- Analyzing DNS tunneling, domain generation algorithms (DGA), or fast-flux behavior\n- Creating Suricata\u002FSnort signatures based on observed malware network patterns\n\n**Do not use** for host-based analysis of malware behavior; use Cuckoo sandbox reports or Volatility memory analysis for process-level activity.\n\n## Prerequisites\n\n- Wireshark 4.x installed for interactive PCAP analysis\n- tshark (Wireshark CLI) for scripted packet extraction\n- Zeek installed for automated metadata generation from PCAPs\n- Suricata with ET Open\u002FET Pro rulesets for signature matching\n- NetworkMiner for file extraction and credential detection from PCAPs\n- Python 3.8+ with `scapy` and `dpkt` for programmatic packet analysis\n\n## Workflow\n\n### Step 1: Initial PCAP Overview\n\nGet a high-level understanding of the network traffic:\n\n```bash\n# Capture statistics\ncapinfos malware.pcap\n\n# Protocol hierarchy\ntshark -r malware.pcap -q -z io,phs\n\n# Endpoint statistics (top talkers)\ntshark -r malware.pcap -q -z endpoints,ip\n\n# Conversation statistics\ntshark -r malware.pcap -q -z conv,tcp\n\n# DNS query summary\ntshark -r malware.pcap -q -z dns,tree\n```\n\n### Step 2: Analyze DNS Activity\n\nExamine DNS queries for DGA, tunneling, or C2 domain resolution:\n\n```bash\n# Extract all DNS queries\ntshark -r malware.pcap -T fields -e frame.time -e dns.qry.name -e dns.a \\\n  -Y \"dns.flags.response == 1\" | sort\n\n# Detect DGA patterns (high entropy domain names)\npython3 \u003C\u003C 'PYEOF'\nimport math\nfrom collections import Counter\n\ndef entropy(s):\n    p = [n\u002Flen(s) for n in Counter(s).values()]\n    return -sum(pi * math.log2(pi) for pi in p if pi > 0)\n\n# Parse DNS queries from tshark output\nimport subprocess\nresult = subprocess.run(\n    [\"tshark\", \"-r\", \"malware.pcap\", \"-T\", \"fields\", \"-e\", \"dns.qry.name\",\n     \"-Y\", \"dns.flags.response == 0\"],\n    capture_output=True, text=True\n)\n\ndomains = set(result.stdout.strip().split('\\n'))\nprint(\"Suspicious DNS queries (high entropy):\")\nfor domain in domains:\n    if domain:\n        subdomain = domain.split('.')[0]\n        ent = entropy(subdomain)\n        if ent > 3.5 and len(subdomain) > 10:\n            print(f\"  {domain} (entropy: {ent:.2f})\")\nPYEOF\n\n# Detect DNS tunneling (large TXT responses)\ntshark -r malware.pcap -T fields -e dns.qry.name -e dns.txt \\\n  -Y \"dns.resp.type == 16 and dns.resp.len > 100\"\n```\n\n### Step 3: Analyze HTTP\u002FHTTPS C2 Communication\n\nExamine web-based command-and-control traffic:\n\n```bash\n# Extract HTTP requests\ntshark -r malware.pcap -T fields \\\n  -e frame.time -e ip.src -e ip.dst -e http.host \\\n  -e http.request.method -e http.request.uri -e http.user_agent \\\n  -Y \"http.request\"\n\n# Extract HTTP response bodies (potential payload downloads)\ntshark -r malware.pcap -T fields \\\n  -e http.host -e http.request.uri -e http.content_type -e tcp.len \\\n  -Y \"http.response and tcp.len > 1000\"\n\n# Extract POST data (potential exfiltration)\ntshark -r malware.pcap -T fields \\\n  -e http.host -e http.request.uri -e http.file_data \\\n  -Y \"http.request.method == POST\"\n\n# TLS analysis (SNI, JA3 fingerprints)\ntshark -r malware.pcap -T fields \\\n  -e tls.handshake.extensions_server_name \\\n  -e tls.handshake.ja3 \\\n  -Y \"tls.handshake.type == 1\"\n\n# Extract TLS certificate details\ntshark -r malware.pcap -T fields \\\n  -e x509ce.dNSName -e x509af.serialNumber \\\n  -e x509sat.utf8String \\\n  -Y \"tls.handshake.type == 11\"\n\n# Export HTTP objects (downloaded files)\ntshark -r malware.pcap --export-objects http,exported_files\u002F\n```\n\n### Step 4: Detect Beaconing Patterns\n\nIdentify regular periodic communication indicating C2 beaconing:\n\n```python\n# Beacon detection from PCAP\nfrom scapy.all import rdpcap, IP, TCP\nfrom collections import defaultdict\nimport statistics\n\npackets = rdpcap(\"malware.pcap\")\n\n# Group connections by destination IP:port\nconnections = defaultdict(list)\nfor pkt in packets:\n    if IP in pkt and TCP in pkt:\n        if pkt[TCP].flags & 0x02:  # SYN flag\n            dst = f\"{pkt[IP].dst}:{pkt[TCP].dport}\"\n            connections[dst].append(float(pkt.time))\n\n# Analyze timing intervals for beaconing\nprint(\"Beacon Analysis:\")\nfor dst, times in connections.items():\n    if len(times) >= 5:\n        intervals = [times[i+1] - times[i] for i in range(len(times)-1)]\n        avg = statistics.mean(intervals)\n        stdev = statistics.stdev(intervals) if len(intervals) > 1 else 0\n        jitter = (stdev \u002F avg * 100) if avg > 0 else 0\n\n        if 10 \u003C avg \u003C 3600 and jitter \u003C 30:  # Regular interval with \u003C 30% jitter\n            print(f\"  [!] {dst}: {len(times)} connections\")\n            print(f\"      Interval: {avg:.1f}s ± {stdev:.1f}s (jitter: {jitter:.1f}%)\")\n            print(f\"      Pattern: LIKELY BEACONING\")\n```\n\n### Step 5: Generate Network Detection Signatures\n\nCreate Suricata\u002FSnort rules from observed traffic patterns:\n\n```bash\n# Run Suricata against the PCAP for existing signature matches\nsuricata -r malware.pcap -l suricata_output\u002F -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n\n# Review alerts\ncat suricata_output\u002Ffast.log\n\n# Create custom Suricata rule from observed patterns\ncat \u003C\u003C 'EOF' > custom_malware.rules\n# C2 beacon detection based on observed URI pattern\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX C2 Beacon\";\n    flow:established,to_server;\n    http.method; content:\"POST\";\n    http.uri; content:\"\u002Fgate.php?id=\";\n    http.user_agent; content:\"Mozilla\u002F5.0 (compatible; MSIE 10.0)\";\n    sid:9000001; rev:1;\n)\n\n# DNS query for known C2 domain\nalert dns $HOME_NET any -> any any (\n    msg:\"MALWARE MalwareX C2 DNS Query\";\n    dns.query; content:\"update.malicious.com\";\n    sid:9000002; rev:1;\n)\n\n# JA3 hash match for malware TLS client\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX JA3 Match\";\n    ja3.hash; content:\"a0e9f5d64349fb13191bc781f81f42e1\";\n    sid:9000003; rev:1;\n)\nEOF\n```\n\n### Step 6: Extract Files and Artifacts from Traffic\n\nRecover transferred files and embedded data:\n\n```bash\n# Extract files using Zeek\nzeek -r malware.pcap \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fpolicy\u002Fframeworks\u002Ffiles\u002Fextract-all-files.zeek\nls extract_files\u002F\n\n# Extract files using NetworkMiner (GUI)\n# Or use tshark for specific protocol exports\ntshark -r malware.pcap --export-objects http,http_objects\u002F\ntshark -r malware.pcap --export-objects smb,smb_objects\u002F\ntshark -r malware.pcap --export-objects tftp,tftp_objects\u002F\n\n# Hash all extracted files\nsha256sum http_objects\u002F* smb_objects\u002F* 2>\u002Fdev\u002Fnull\n\n# Generate Zeek logs for comprehensive metadata\nzeek -r malware.pcap\n# Output: conn.log, dns.log, http.log, ssl.log, files.log, etc.\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Beaconing** | Regular periodic connections from malware to C2 server, identifiable by consistent time intervals and packet sizes |\n| **JA3\u002FJA3S** | TLS fingerprinting method creating a hash from ClientHello\u002FServerHello parameters to uniquely identify malware TLS implementations |\n| **DGA (Domain Generation Algorithm)** | Algorithm generating pseudo-random domain names that malware queries to locate C2 servers, evading static domain blocklists |\n| **DNS Tunneling** | Encoding data in DNS queries and responses to establish a C2 channel or exfiltrate data through DNS infrastructure |\n| **Fast Flux** | DNS technique rapidly rotating IP addresses for a domain to avoid takedown and distribute C2 across many compromised hosts |\n| **SNI (Server Name Indication)** | TLS extension revealing the hostname the client is connecting to; visible even in encrypted HTTPS connections |\n| **Network Signature** | Suricata\u002FSnort rule matching specific patterns in network traffic (headers, payloads, timing) to detect malicious communications |\n\n## Tools & Systems\n\n- **Wireshark**: Open-source packet analyzer for deep interactive inspection of network traffic at the protocol level\n- **Zeek**: Network analysis framework generating structured metadata logs (conn, dns, http, ssl) from live or captured traffic\n- **Suricata**: High-performance network IDS\u002FIPS for signature-based detection with Lua scripting for custom detection logic\n- **NetworkMiner**: Network forensic analysis tool for extracting files, images, and credentials from PCAP files\n- **Scapy**: Python packet manipulation library for programmatic packet analysis, beacon detection, and protocol decoding\n\n## Common Scenarios\n\n### Scenario: Decoding a Custom Binary C2 Protocol\n\n**Context**: Malware communicates with its C2 server using a custom binary protocol over TCP port 8443. Standard HTTP analysis yields no results. The protocol structure needs to be reverse engineered from the PCAP.\n\n**Approach**:\n1. Filter the PCAP for TCP port 8443 conversations and follow the TCP stream\n2. Identify the message framing (length prefix, delimiter, fixed-size headers)\n3. Compare multiple messages to identify static header fields vs variable data fields\n4. Cross-reference with reverse engineering findings from Ghidra (if the binary was analyzed)\n5. Write a Wireshark dissector or Scapy parser for the custom protocol\n6. Create Suricata rules matching the static header bytes for network detection\n7. Document the full protocol specification for threat intelligence sharing\n\n**Pitfalls**:\n- Analyzing only the first few packets; some C2 protocols change behavior after initial handshake\n- Not decrypting TLS traffic when the sandbox has MITM capabilities\n- Confusing legitimate CDN or cloud traffic with C2 (validate destination IPs)\n- Missing C2 traffic that uses DNS or ICMP instead of TCP\u002FUDP\n\n## Output Format\n\n```\nMALWARE NETWORK TRAFFIC ANALYSIS\n===================================\nPCAP File:        malware_sandbox.pcap\nDuration:         300 seconds\nTotal Packets:    12,847\nTotal Bytes:      4.2 MB\n\nDNS ACTIVITY\nTotal Queries:    47\nDGA Detected:     Yes (23 high-entropy queries to .com TLD)\nTunneling:        No\nResolved C2:      update.malicious[.]com -> 185.220.101[.]42\n\nC2 COMMUNICATION\nProtocol:         HTTPS (TLS 1.2)\nServer:           185.220.101[.]42:443\nSNI:              update.malicious[.]com\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nBeacon Interval:  60.2s ± 6.8s (11.3% jitter)\nTotal Sessions:   237\nData Sent:        147 MB\nData Received:    2.3 MB\nCertificate:      CN=update.malicious[.]com (self-signed, expired)\n\nPAYLOAD DOWNLOADS\nGET \u002Fpayload.dll from compromised-site[.]com\n  Size: 98,304 bytes\n  SHA-256: abc123def456...\n  Content-Type: application\u002Foctet-stream\n\nEXFILTRATION\nMethod:           HTTPS POST to \u002Fgate.php\nContent-Type:     application\u002Foctet-stream\nAverage Size:     15,432 bytes per request\nTotal Volume:     147 MB over 4 hours\n\nSURICATA ALERTS\n[1:2028401] ET MALWARE Generic C2 Beacon Pattern\n[1:2028500] ET POLICY Self-Signed Certificate\n\nGENERATED SIGNATURES\nSID 9000001: MalwareX HTTP beacon pattern\nSID 9000002: MalwareX DNS C2 domain\nSID 9000003: MalwareX JA3 TLS fingerprint\n```\n",{"name":5,"tags":47,"author":50,"domain":41,"license":15,"version":51,"nist_csf":52,"subdomain":36,"description":57,"mitre_attack":58},[25,29,48,31,49],"PCAP","C2-detection","mahipal","1.0.0",[53,54,55,56],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.\n",[59,60,61,62],"T1071.001","T1571","T1573","T1095","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-network-traffic-of-malware",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-network-traffic-of-malware",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-network-traffic-of-malware",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-network-traffic-of-malware","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-of-malware\u002FSKILL.md",true,[87,92,98],{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-of-malware\u002FLICENSE",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fapi-reference.md","REFERENCE","参考文档",2928,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-of-malware\u002Freferences\u002Fapi-reference.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",8826,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-of-malware\u002Fscripts\u002Fagent.py",[105,131,155,183,208,235],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":112,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[111],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,116,117,41,40,118,119,120,121,122,123,124,125,126,127,128,129,130],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,127,140,141,117,142,41,119,143,144,145,146,147,148,149,150,151,152,153,154],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[161,164],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,166,167,168,169,41,170,171,143,172,173,174,175,176,177,178,179,180,181,182],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":190,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[189],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[191,192,193,41,194,195,196,197,198,199,200,33,201,202,203,204,146,205,206,207],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[216,217,218,41,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[241],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,243,41,244,245,246,247,248,249,250,251,178,252,179,253,254,255,256,257,258],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]