[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GWJSW1YPTATS2AXMC9Y9Y3":3,"skill-same:01M6GWJSW1YPTATS2AXMC9Y9Y3":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M6GWJSW1YPTATS2AXMC9Y9Y3","analyzing-command-and-control-communication",null,"Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-command-and-control-communication\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"communication","control","analyzing command and control communication","analyzing","command","data","reverse","protocol reverse","mapping","intelligence","patterns","threat","analysis","cybersecurity","dns","protocol-analysis","command-and-control","malware","infrastructure","threat intelligence","2026-11-10 10:12:30",false,"---\nname: analyzing-command-and-control-communication\ndescription: >\n  Analyzes malware command-and-control (C2) communication protocols to understand beacon\n  patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS,\n  and custom protocol C2 analysis for detection development and threat intelligence.\n  Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse\n  engineering, or command-and-control infrastructure mapping.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags: [malware, C2, command-and-control, beacon, protocol-analysis]\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Analyzing Command-and-Control Communication\n\n## When to Use\n\n- Reverse engineering a malware sample has revealed network communication that needs protocol analysis\n- Building network-level detection signatures for a specific C2 framework (Cobalt Strike, Metasploit, Sliver)\n- Mapping C2 infrastructure including primary servers, fallback domains, and dead drops\n- Analyzing encrypted or encoded C2 traffic to understand the command set and data format\n- Attributing malware to a threat actor based on C2 infrastructure patterns and tooling\n\n**Do not use** for general network anomaly detection; this is specifically for understanding known or suspected C2 protocols from malware analysis.\n\n## Prerequisites\n\n- PCAP capture of malware network traffic (from sandbox, network tap, or full packet capture)\n- Wireshark\u002Ftshark for packet-level analysis\n- Reverse engineering tools (Ghidra, dnSpy) for understanding C2 code in the malware binary\n- Python 3.8+ with `scapy`, `dpkt`, and `requests` for protocol analysis and replay\n- Threat intelligence databases for C2 infrastructure correlation (VirusTotal, Shodan, Censys)\n- JA3\u002FJA3S fingerprint databases for TLS-based C2 identification\n\n## Workflow\n\n### Step 1: Identify the C2 Channel\n\nDetermine the protocol and transport used for C2 communication:\n\n```\nC2 Communication Channels:\n━━━━━━━━━━━━━━━━━━━━━━━━━\nHTTP\u002FHTTPS:     Most common; uses standard web traffic to blend in\n                Indicators: Regular POST\u002FGET requests, specific URI patterns, custom headers\n\nDNS:            Tunneling data through DNS queries and responses\n                Indicators: High-volume TXT queries, long subdomain names, high entropy\n\nCustom TCP\u002FUDP: Proprietary binary protocol on non-standard port\n                Indicators: Non-HTTP traffic on high ports, unknown protocol\n\nICMP:           Data encoded in ICMP echo\u002Freply payloads\n                Indicators: ICMP packets with large or non-standard payloads\n\nWebSocket:      Persistent bidirectional connection for real-time C2\n                Indicators: WebSocket upgrade followed by binary frames\n\nCloud Services: Using legitimate APIs (Telegram, Discord, Slack, GitHub)\n                Indicators: API calls to cloud services from unexpected processes\n\nEmail:          SMTP\u002FIMAP for C2 commands and data exfiltration\n                Indicators: Automated email operations from non-email processes\n```\n\n### Step 2: Analyze Beacon Pattern\n\nCharacterize the periodic communication pattern:\n\n```python\nfrom scapy.all import rdpcap, IP, TCP\nfrom collections import defaultdict\nimport statistics\nimport json\n\npackets = rdpcap(\"c2_traffic.pcap\")\n\n# Group TCP SYN packets by destination\nconnections = defaultdict(list)\nfor pkt in packets:\n    if IP in pkt and TCP in pkt and (pkt[TCP].flags & 0x02):\n        key = f\"{pkt[IP].dst}:{pkt[TCP].dport}\"\n        connections[key].append(float(pkt.time))\n\n# Analyze each destination for beaconing\nfor dst, times in sorted(connections.items()):\n    if len(times) \u003C 3:\n        continue\n\n    intervals = [times[i+1] - times[i] for i in range(len(times)-1)]\n    avg_interval = statistics.mean(intervals)\n    stdev = statistics.stdev(intervals) if len(intervals) > 1 else 0\n    jitter_pct = (stdev \u002F avg_interval * 100) if avg_interval > 0 else 0\n    duration = times[-1] - times[0]\n\n    beacon_data = {\n        \"destination\": dst,\n        \"connections\": len(times),\n        \"duration_seconds\": round(duration, 1),\n        \"avg_interval_seconds\": round(avg_interval, 1),\n        \"stdev_seconds\": round(stdev, 1),\n        \"jitter_percent\": round(jitter_pct, 1),\n        \"is_beacon\": 5 \u003C avg_interval \u003C 7200 and jitter_pct \u003C 25,\n    }\n\n    if beacon_data[\"is_beacon\"]:\n        print(f\"[!] BEACON DETECTED: {dst}\")\n        print(f\"    Interval: {avg_interval:.0f}s +\u002F- {stdev:.0f}s ({jitter_pct:.0f}% jitter)\")\n        print(f\"    Sessions: {len(times)} over {duration:.0f}s\")\n```\n\n### Step 3: Decode C2 Protocol Structure\n\nReverse engineer the message format from captured traffic:\n\n```python\n# HTTP-based C2 protocol analysis\nimport dpkt\nimport base64\n\nwith open(\"c2_traffic.pcap\", \"rb\") as f:\n    pcap = dpkt.pcap.Reader(f)\n\nfor ts, buf in pcap:\n    eth = dpkt.ethernet.Ethernet(buf)\n    if not isinstance(eth.data, dpkt.ip.IP):\n        continue\n    ip = eth.data\n    if not isinstance(ip.data, dpkt.tcp.TCP):\n        continue\n    tcp = ip.data\n\n    if tcp.dport == 80 or tcp.dport == 443:\n        if len(tcp.data) > 0:\n            try:\n                http = dpkt.http.Request(tcp.data)\n                print(f\"\\n--- C2 REQUEST ---\")\n                print(f\"Method: {http.method}\")\n                print(f\"URI: {http.uri}\")\n                print(f\"Headers: {dict(http.headers)}\")\n                if http.body:\n                    print(f\"Body ({len(http.body)} bytes):\")\n                    # Try Base64 decode\n                    try:\n                        decoded = base64.b64decode(http.body)\n                        print(f\"  Decoded: {decoded[:200]}\")\n                    except:\n                        print(f\"  Raw: {http.body[:200]}\")\n            except:\n                pass\n```\n\n### Step 4: Identify C2 Framework\n\nMatch observed patterns to known C2 frameworks:\n\n```\nKnown C2 Framework Signatures:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCobalt Strike:\n  - Default URIs: \u002Fpixel, \u002Fsubmit.php, \u002F___utm.gif, \u002Fca, \u002Fdpixel\n  - Malleable C2 profiles customize all traffic characteristics\n  - JA3: varies by profile, catalog at ja3er.com\n  - Watermark in beacon config (unique per license)\n  - Config extraction: use CobaltStrikeParser or 1768.py\n\nMetasploit\u002FMeterpreter:\n  - Default staging URI patterns: random 4-char checksum\n  - Reverse HTTP(S) handler patterns\n  - Meterpreter TLV (Type-Length-Value) protocol structure\n\nSliver:\n  - mTLS, HTTP, DNS, WireGuard transport options\n  - Protobuf-encoded messages\n  - Unique implant ID in communication\n\nCovenant:\n  - .NET-based C2 framework\n  - HTTP with customizable profiles\n  - Task-based command execution\n\nPoshC2:\n  - PowerShell\u002FC# based\n  - HTTP with encrypted payloads\n  - Cookie-based session management\n```\n\n```bash\n# Extract Cobalt Strike beacon configuration from PCAP or sample\npython3 \u003C\u003C 'PYEOF'\n# Using CobaltStrikeParser (pip install cobalt-strike-parser)\nfrom cobalt_strike_parser import BeaconConfig\n\ntry:\n    config = BeaconConfig.from_file(\"suspect.exe\")\n    print(\"Cobalt Strike Beacon Configuration:\")\n    for key, value in config.items():\n        print(f\"  {key}: {value}\")\nexcept Exception as e:\n    print(f\"Not a Cobalt Strike beacon or parse error: {e}\")\nPYEOF\n```\n\n### Step 5: Map C2 Infrastructure\n\nDocument the full C2 infrastructure and failover mechanisms:\n\n```python\n# Infrastructure mapping\nimport requests\nimport json\n\nc2_indicators = {\n    \"primary_c2\": \"185.220.101.42\",\n    \"domains\": [\"update.malicious.com\", \"backup.evil.net\"],\n    \"ports\": [443, 8443],\n    \"failover_dns\": [\"ns1.malicious-dns.com\"],\n}\n\n# Enrich with Shodan\ndef shodan_lookup(ip, api_key):\n    resp = requests.get(f\"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F{ip}?key={api_key}\")\n    if resp.status_code == 200:\n        data = resp.json()\n        return {\n            \"ip\": ip,\n            \"ports\": data.get(\"ports\", []),\n            \"os\": data.get(\"os\"),\n            \"org\": data.get(\"org\"),\n            \"asn\": data.get(\"asn\"),\n            \"country\": data.get(\"country_code\"),\n            \"hostnames\": data.get(\"hostnames\", []),\n            \"last_update\": data.get(\"last_update\"),\n        }\n    return None\n\n# Enrich with passive DNS\ndef pdns_lookup(domain):\n    # Using VirusTotal passive DNS\n    resp = requests.get(\n        f\"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Fdomains\u002F{domain}\u002Fresolutions\",\n        headers={\"x-apikey\": VT_API_KEY}\n    )\n    if resp.status_code == 200:\n        data = resp.json()\n        resolutions = []\n        for r in data.get(\"data\", []):\n            resolutions.append({\n                \"ip\": r[\"attributes\"][\"ip_address\"],\n                \"date\": r[\"attributes\"][\"date\"],\n            })\n        return resolutions\n    return []\n```\n\n### Step 6: Create Network Detection Signatures\n\nBuild detection rules based on analyzed C2 characteristics:\n\n```bash\n# Suricata rules for the analyzed C2\ncat \u003C\u003C 'EOF' > c2_detection.rules\n# HTTP beacon pattern\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX C2 HTTP Beacon\";\n    flow:established,to_server;\n    http.method; content:\"POST\";\n    http.uri; content:\"\u002Fgate.php\"; startswith;\n    http.header; content:\"User-Agent: Mozilla\u002F5.0 (compatible; MSIE 10.0)\";\n    threshold:type threshold, track by_src, count 5, seconds 600;\n    sid:9000010; rev:1;\n)\n\n# JA3 fingerprint match\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX TLS JA3 Fingerprint\";\n    ja3.hash; content:\"a0e9f5d64349fb13191bc781f81f42e1\";\n    sid:9000011; rev:1;\n)\n\n# DNS beacon detection (high-entropy subdomain)\nalert dns $HOME_NET any -> any any (\n    msg:\"MALWARE Suspected DNS C2 Tunneling\";\n    dns.query; pcre:\"\u002F^[a-z0-9]{20,}\\.\u002F\";\n    threshold:type threshold, track by_src, count 10, seconds 60;\n    sid:9000012; rev:1;\n)\n\n# Certificate-based detection\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX Self-Signed C2 Certificate\";\n    tls.cert_subject; content:\"CN=update.malicious.com\";\n    sid:9000013; rev:1;\n)\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Beaconing** | Periodic check-in communication from malware to C2 server at regular intervals, often with jitter to avoid pattern detection |\n| **Jitter** | Randomization applied to beacon interval (e.g., 60s +\u002F- 15%) to make the timing pattern less predictable and harder to detect |\n| **Malleable C2** | Cobalt Strike feature allowing operators to customize all aspects of C2 traffic (URIs, headers, encoding) to mimic legitimate services |\n| **Dead Drop** | Intermediate location (paste site, cloud storage, social media) where C2 commands are posted for the malware to retrieve |\n| **Domain Fronting** | Using a trusted CDN domain in the TLS SNI while routing to a different backend, making C2 traffic appear to go to a legitimate service |\n| **Fast Flux** | Rapidly changing DNS records for C2 domains to distribute across many IPs and resist takedown efforts |\n| **C2 Framework** | Software toolkit providing C2 server, implant generator, and operator interface (Cobalt Strike, Metasploit, Sliver, Covenant) |\n\n## Tools & Systems\n\n- **Wireshark**: Packet analyzer for detailed C2 protocol analysis at the packet level\n- **RITA (Real Intelligence Threat Analytics)**: Open-source tool analyzing Zeek logs for beacon detection and DNS tunneling\n- **CobaltStrikeParser**: Tool extracting Cobalt Strike beacon configuration from samples and memory dumps\n- **JA3\u002FJA3S**: TLS fingerprinting method for identifying C2 frameworks by their TLS implementation characteristics\n- **Shodan\u002FCensys**: Internet scanning platforms for mapping C2 infrastructure and identifying related servers\n\n## Common Scenarios\n\n### Scenario: Reverse Engineering a Custom C2 Protocol\n\n**Context**: A malware sample communicates with its C2 server using an unknown binary protocol over TCP port 8443. The protocol needs to be decoded to understand the command set and build detection signatures.\n\n**Approach**:\n1. Filter PCAP for TCP port 8443 conversations and extract the TCP streams\n2. Analyze the first few exchanges to identify the handshake\u002Fauthentication mechanism\n3. Map the message structure (length prefix, type field, payload encoding)\n4. Cross-reference with Ghidra disassembly of the send\u002Freceive functions in the malware\n5. Identify the command dispatcher and document each command code's function\n6. Build a protocol decoder in Python for ongoing traffic analysis\n7. Create Suricata rules matching the protocol handshake or static header bytes\n\n**Pitfalls**:\n- Assuming the protocol is static; some C2 frameworks negotiate encryption during the handshake\n- Not capturing enough traffic to see all command types (some commands are rare)\n- Missing fallback C2 channels (DNS, ICMP) that activate when the primary channel fails\n- Confusing encrypted payload data with the protocol framing structure\n\n## Output Format\n\n```\nC2 COMMUNICATION ANALYSIS REPORT\n===================================\nSample:           malware.exe (SHA-256: e3b0c44...)\nC2 Framework:     Cobalt Strike 4.9\n\nBEACON CONFIGURATION\nC2 Server:        hxxps:\u002F\u002F185.220.101[.]42\u002Fupdates\nBeacon Type:      HTTPS (reverse)\nSleep:            60 seconds\nJitter:           15%\nUser-Agent:       Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64)\nURI (GET):        \u002Fdpixel\nURI (POST):       \u002Fsubmit.php\nWatermark:        1234567890\n\nPROTOCOL ANALYSIS\nTransport:        HTTPS (TLS 1.2)\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nCertificate:      CN=Microsoft Update (self-signed)\nEncoding:         Base64 with XOR key 0x69\nCommand Format:   [4B length][4B command_id][payload]\n\nCOMMAND SET\n0x01 - Sleep          Change beacon interval\n0x02 - Shell          Execute cmd.exe command\n0x03 - Download       Transfer file from C2\n0x04 - Upload         Exfiltrate file to C2\n0x05 - Inject         Process injection\n0x06 - Keylog         Start keylogger\n0x07 - Screenshot     Capture screen\n\nINFRASTRUCTURE\nPrimary:          185.220.101[.]42 (AS12345, Hosting Co, NL)\nFailover:         91.215.85[.]17 (AS67890, VPS Provider, RU)\nDNS:              update.malicious[.]com -> 185.220.101[.]42\nRegistrar:        NameCheap\nRegistration:     2025-09-01\n\nDETECTION SIGNATURES\nSID 9000010:      HTTP beacon pattern\nSID 9000011:      JA3 TLS fingerprint\nSID 9000013:      C2 certificate match\n```\n","# Analyzing Command-and-Control Communication\n\n## When to Use\n\n- Reverse engineering a malware sample has revealed network communication that needs protocol analysis\n- Building network-level detection signatures for a specific C2 framework (Cobalt Strike, Metasploit, Sliver)\n- Mapping C2 infrastructure including primary servers, fallback domains, and dead drops\n- Analyzing encrypted or encoded C2 traffic to understand the command set and data format\n- Attributing malware to a threat actor based on C2 infrastructure patterns and tooling\n\n**Do not use** for general network anomaly detection; this is specifically for understanding known or suspected C2 protocols from malware analysis.\n\n## Prerequisites\n\n- PCAP capture of malware network traffic (from sandbox, network tap, or full packet capture)\n- Wireshark\u002Ftshark for packet-level analysis\n- Reverse engineering tools (Ghidra, dnSpy) for understanding C2 code in the malware binary\n- Python 3.8+ with `scapy`, `dpkt`, and `requests` for protocol analysis and replay\n- Threat intelligence databases for C2 infrastructure correlation (VirusTotal, Shodan, Censys)\n- JA3\u002FJA3S fingerprint databases for TLS-based C2 identification\n\n## Workflow\n\n### Step 1: Identify the C2 Channel\n\nDetermine the protocol and transport used for C2 communication:\n\n```\nC2 Communication Channels:\n━━━━━━━━━━━━━━━━━━━━━━━━━\nHTTP\u002FHTTPS:     Most common; uses standard web traffic to blend in\n                Indicators: Regular POST\u002FGET requests, specific URI patterns, custom headers\n\nDNS:            Tunneling data through DNS queries and responses\n                Indicators: High-volume TXT queries, long subdomain names, high entropy\n\nCustom TCP\u002FUDP: Proprietary binary protocol on non-standard port\n                Indicators: Non-HTTP traffic on high ports, unknown protocol\n\nICMP:           Data encoded in ICMP echo\u002Freply payloads\n                Indicators: ICMP packets with large or non-standard payloads\n\nWebSocket:      Persistent bidirectional connection for real-time C2\n                Indicators: WebSocket upgrade followed by binary frames\n\nCloud Services: Using legitimate APIs (Telegram, Discord, Slack, GitHub)\n                Indicators: API calls to cloud services from unexpected processes\n\nEmail:          SMTP\u002FIMAP for C2 commands and data exfiltration\n                Indicators: Automated email operations from non-email processes\n```\n\n### Step 2: Analyze Beacon Pattern\n\nCharacterize the periodic communication pattern:\n\n```python\nfrom scapy.all import rdpcap, IP, TCP\nfrom collections import defaultdict\nimport statistics\nimport json\n\npackets = rdpcap(\"c2_traffic.pcap\")\n\n# Group TCP SYN packets by destination\nconnections = defaultdict(list)\nfor pkt in packets:\n    if IP in pkt and TCP in pkt and (pkt[TCP].flags & 0x02):\n        key = f\"{pkt[IP].dst}:{pkt[TCP].dport}\"\n        connections[key].append(float(pkt.time))\n\n# Analyze each destination for beaconing\nfor dst, times in sorted(connections.items()):\n    if len(times) \u003C 3:\n        continue\n\n    intervals = [times[i+1] - times[i] for i in range(len(times)-1)]\n    avg_interval = statistics.mean(intervals)\n    stdev = statistics.stdev(intervals) if len(intervals) > 1 else 0\n    jitter_pct = (stdev \u002F avg_interval * 100) if avg_interval > 0 else 0\n    duration = times[-1] - times[0]\n\n    beacon_data = {\n        \"destination\": dst,\n        \"connections\": len(times),\n        \"duration_seconds\": round(duration, 1),\n        \"avg_interval_seconds\": round(avg_interval, 1),\n        \"stdev_seconds\": round(stdev, 1),\n        \"jitter_percent\": round(jitter_pct, 1),\n        \"is_beacon\": 5 \u003C avg_interval \u003C 7200 and jitter_pct \u003C 25,\n    }\n\n    if beacon_data[\"is_beacon\"]:\n        print(f\"[!] BEACON DETECTED: {dst}\")\n        print(f\"    Interval: {avg_interval:.0f}s +\u002F- {stdev:.0f}s ({jitter_pct:.0f}% jitter)\")\n        print(f\"    Sessions: {len(times)} over {duration:.0f}s\")\n```\n\n### Step 3: Decode C2 Protocol Structure\n\nReverse engineer the message format from captured traffic:\n\n```python\n# HTTP-based C2 protocol analysis\nimport dpkt\nimport base64\n\nwith open(\"c2_traffic.pcap\", \"rb\") as f:\n    pcap = dpkt.pcap.Reader(f)\n\nfor ts, buf in pcap:\n    eth = dpkt.ethernet.Ethernet(buf)\n    if not isinstance(eth.data, dpkt.ip.IP):\n        continue\n    ip = eth.data\n    if not isinstance(ip.data, dpkt.tcp.TCP):\n        continue\n    tcp = ip.data\n\n    if tcp.dport == 80 or tcp.dport == 443:\n        if len(tcp.data) > 0:\n            try:\n                http = dpkt.http.Request(tcp.data)\n                print(f\"\\n--- C2 REQUEST ---\")\n                print(f\"Method: {http.method}\")\n                print(f\"URI: {http.uri}\")\n                print(f\"Headers: {dict(http.headers)}\")\n                if http.body:\n                    print(f\"Body ({len(http.body)} bytes):\")\n                    # Try Base64 decode\n                    try:\n                        decoded = base64.b64decode(http.body)\n                        print(f\"  Decoded: {decoded[:200]}\")\n                    except:\n                        print(f\"  Raw: {http.body[:200]}\")\n            except:\n                pass\n```\n\n### Step 4: Identify C2 Framework\n\nMatch observed patterns to known C2 frameworks:\n\n```\nKnown C2 Framework Signatures:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCobalt Strike:\n  - Default URIs: \u002Fpixel, \u002Fsubmit.php, \u002F___utm.gif, \u002Fca, \u002Fdpixel\n  - Malleable C2 profiles customize all traffic characteristics\n  - JA3: varies by profile, catalog at ja3er.com\n  - Watermark in beacon config (unique per license)\n  - Config extraction: use CobaltStrikeParser or 1768.py\n\nMetasploit\u002FMeterpreter:\n  - Default staging URI patterns: random 4-char checksum\n  - Reverse HTTP(S) handler patterns\n  - Meterpreter TLV (Type-Length-Value) protocol structure\n\nSliver:\n  - mTLS, HTTP, DNS, WireGuard transport options\n  - Protobuf-encoded messages\n  - Unique implant ID in communication\n\nCovenant:\n  - .NET-based C2 framework\n  - HTTP with customizable profiles\n  - Task-based command execution\n\nPoshC2:\n  - PowerShell\u002FC# based\n  - HTTP with encrypted payloads\n  - Cookie-based session management\n```\n\n```bash\n# Extract Cobalt Strike beacon configuration from PCAP or sample\npython3 \u003C\u003C 'PYEOF'\n# Using CobaltStrikeParser (pip install cobalt-strike-parser)\nfrom cobalt_strike_parser import BeaconConfig\n\ntry:\n    config = BeaconConfig.from_file(\"suspect.exe\")\n    print(\"Cobalt Strike Beacon Configuration:\")\n    for key, value in config.items():\n        print(f\"  {key}: {value}\")\nexcept Exception as e:\n    print(f\"Not a Cobalt Strike beacon or parse error: {e}\")\nPYEOF\n```\n\n### Step 5: Map C2 Infrastructure\n\nDocument the full C2 infrastructure and failover mechanisms:\n\n```python\n# Infrastructure mapping\nimport requests\nimport json\n\nc2_indicators = {\n    \"primary_c2\": \"185.220.101.42\",\n    \"domains\": [\"update.malicious.com\", \"backup.evil.net\"],\n    \"ports\": [443, 8443],\n    \"failover_dns\": [\"ns1.malicious-dns.com\"],\n}\n\n# Enrich with Shodan\ndef shodan_lookup(ip, api_key):\n    resp = requests.get(f\"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F{ip}?key={api_key}\")\n    if resp.status_code == 200:\n        data = resp.json()\n        return {\n            \"ip\": ip,\n            \"ports\": data.get(\"ports\", []),\n            \"os\": data.get(\"os\"),\n            \"org\": data.get(\"org\"),\n            \"asn\": data.get(\"asn\"),\n            \"country\": data.get(\"country_code\"),\n            \"hostnames\": data.get(\"hostnames\", []),\n            \"last_update\": data.get(\"last_update\"),\n        }\n    return None\n\n# Enrich with passive DNS\ndef pdns_lookup(domain):\n    # Using VirusTotal passive DNS\n    resp = requests.get(\n        f\"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Fdomains\u002F{domain}\u002Fresolutions\",\n        headers={\"x-apikey\": VT_API_KEY}\n    )\n    if resp.status_code == 200:\n        data = resp.json()\n        resolutions = []\n        for r in data.get(\"data\", []):\n            resolutions.append({\n                \"ip\": r[\"attributes\"][\"ip_address\"],\n                \"date\": r[\"attributes\"][\"date\"],\n            })\n        return resolutions\n    return []\n```\n\n### Step 6: Create Network Detection Signatures\n\nBuild detection rules based on analyzed C2 characteristics:\n\n```bash\n# Suricata rules for the analyzed C2\ncat \u003C\u003C 'EOF' > c2_detection.rules\n# HTTP beacon pattern\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX C2 HTTP Beacon\";\n    flow:established,to_server;\n    http.method; content:\"POST\";\n    http.uri; content:\"\u002Fgate.php\"; startswith;\n    http.header; content:\"User-Agent: Mozilla\u002F5.0 (compatible; MSIE 10.0)\";\n    threshold:type threshold, track by_src, count 5, seconds 600;\n    sid:9000010; rev:1;\n)\n\n# JA3 fingerprint match\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX TLS JA3 Fingerprint\";\n    ja3.hash; content:\"a0e9f5d64349fb13191bc781f81f42e1\";\n    sid:9000011; rev:1;\n)\n\n# DNS beacon detection (high-entropy subdomain)\nalert dns $HOME_NET any -> any any (\n    msg:\"MALWARE Suspected DNS C2 Tunneling\";\n    dns.query; pcre:\"\u002F^[a-z0-9]{20,}\\.\u002F\";\n    threshold:type threshold, track by_src, count 10, seconds 60;\n    sid:9000012; rev:1;\n)\n\n# Certificate-based detection\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX Self-Signed C2 Certificate\";\n    tls.cert_subject; content:\"CN=update.malicious.com\";\n    sid:9000013; rev:1;\n)\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Beaconing** | Periodic check-in communication from malware to C2 server at regular intervals, often with jitter to avoid pattern detection |\n| **Jitter** | Randomization applied to beacon interval (e.g., 60s +\u002F- 15%) to make the timing pattern less predictable and harder to detect |\n| **Malleable C2** | Cobalt Strike feature allowing operators to customize all aspects of C2 traffic (URIs, headers, encoding) to mimic legitimate services |\n| **Dead Drop** | Intermediate location (paste site, cloud storage, social media) where C2 commands are posted for the malware to retrieve |\n| **Domain Fronting** | Using a trusted CDN domain in the TLS SNI while routing to a different backend, making C2 traffic appear to go to a legitimate service |\n| **Fast Flux** | Rapidly changing DNS records for C2 domains to distribute across many IPs and resist takedown efforts |\n| **C2 Framework** | Software toolkit providing C2 server, implant generator, and operator interface (Cobalt Strike, Metasploit, Sliver, Covenant) |\n\n## Tools & Systems\n\n- **Wireshark**: Packet analyzer for detailed C2 protocol analysis at the packet level\n- **RITA (Real Intelligence Threat Analytics)**: Open-source tool analyzing Zeek logs for beacon detection and DNS tunneling\n- **CobaltStrikeParser**: Tool extracting Cobalt Strike beacon configuration from samples and memory dumps\n- **JA3\u002FJA3S**: TLS fingerprinting method for identifying C2 frameworks by their TLS implementation characteristics\n- **Shodan\u002FCensys**: Internet scanning platforms for mapping C2 infrastructure and identifying related servers\n\n## Common Scenarios\n\n### Scenario: Reverse Engineering a Custom C2 Protocol\n\n**Context**: A malware sample communicates with its C2 server using an unknown binary protocol over TCP port 8443. The protocol needs to be decoded to understand the command set and build detection signatures.\n\n**Approach**:\n1. Filter PCAP for TCP port 8443 conversations and extract the TCP streams\n2. Analyze the first few exchanges to identify the handshake\u002Fauthentication mechanism\n3. Map the message structure (length prefix, type field, payload encoding)\n4. Cross-reference with Ghidra disassembly of the send\u002Freceive functions in the malware\n5. Identify the command dispatcher and document each command code's function\n6. Build a protocol decoder in Python for ongoing traffic analysis\n7. Create Suricata rules matching the protocol handshake or static header bytes\n\n**Pitfalls**:\n- Assuming the protocol is static; some C2 frameworks negotiate encryption during the handshake\n- Not capturing enough traffic to see all command types (some commands are rare)\n- Missing fallback C2 channels (DNS, ICMP) that activate when the primary channel fails\n- Confusing encrypted payload data with the protocol framing structure\n\n## Output Format\n\n```\nC2 COMMUNICATION ANALYSIS REPORT\n===================================\nSample:           malware.exe (SHA-256: e3b0c44...)\nC2 Framework:     Cobalt Strike 4.9\n\nBEACON CONFIGURATION\nC2 Server:        hxxps:\u002F\u002F185.220.101[.]42\u002Fupdates\nBeacon Type:      HTTPS (reverse)\nSleep:            60 seconds\nJitter:           15%\nUser-Agent:       Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64)\nURI (GET):        \u002Fdpixel\nURI (POST):       \u002Fsubmit.php\nWatermark:        1234567890\n\nPROTOCOL ANALYSIS\nTransport:        HTTPS (TLS 1.2)\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nCertificate:      CN=Microsoft Update (self-signed)\nEncoding:         Base64 with XOR key 0x69\nCommand Format:   [4B length][4B command_id][payload]\n\nCOMMAND SET\n0x01 - Sleep          Change beacon interval\n0x02 - Shell          Execute cmd.exe command\n0x03 - Download       Transfer file from C2\n0x04 - Upload         Exfiltrate file to C2\n0x05 - Inject         Process injection\n0x06 - Keylog         Start keylogger\n0x07 - Screenshot     Capture screen\n\nINFRASTRUCTURE\nPrimary:          185.220.101[.]42 (AS12345, Hosting Co, NL)\nFailover:         91.215.85[.]17 (AS67890, VPS Provider, RU)\nDNS:              update.malicious[.]com -> 185.220.101[.]42\nRegistrar:        NameCheap\nRegistration:     2025-09-01\n\nDETECTION SIGNATURES\nSID 9000010:      HTTP beacon pattern\nSID 9000011:      JA3 TLS fingerprint\nSID 9000013:      C2 certificate match\n```\n",{"name":5,"tags":43,"author":46,"domain":31,"license":14,"version":47,"subdomain":48,"description":49},[35,44,34,45,33],"C2","beacon","mahipal","1.0.0","malware-analysis","Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-command-and-control-communication",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add micsapp\u002Fmicstec-skills --skill analyzing-command-and-control-communication",{"tool":63,"command":64},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill analyzing-command-and-control-communication",{"tool":66,"command":67},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill analyzing-command-and-control-communication","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-command-and-control-communication\u002FSKILL.md",true,[71,76,82],{"path":72,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-command-and-control-communication\u002FLICENSE",{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fapi-reference.md","REFERENCE","参考文档",2756,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-command-and-control-communication\u002Freferences\u002Fapi-reference.md",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"scripts\u002Fagent.py","SCRIPT","脚本",7849,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-command-and-control-communication\u002Fscripts\u002Fagent.py",[89,127,156,177,197,221],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":106,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[96,101],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":141,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[133,134,137,140],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},{"categoryNo":135,"categoryName":136,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":138,"categoryName":139,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[142,143,144,145,108,36,146,147,148,149,150,151,116,117,123,152,153,124,154,155],"deployment","apiops deployment","workflows","azure devops","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[162],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},[164,165,166,167,108,111,116,117,168,169,170,171,172,173,174,124,175,176,155,126],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":185,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[183,184],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[186,167,187,116,171,188,108,142,189,190,191,192,117,193,124,194,195,196,125,126],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[204,205,206,144,207,208,209,210,116,211,212,22,213,214,215,216,217,218,219,220],"cli","jira","jira cli","init","tasks","create","issues","common","work","edit","list","view","project","project work","token","line","sprints",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":227,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[223,228,229,230,231,232,233,169,234,235],"npm","js","calculate","node","math","user","compute","errors"]