[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F3F2F4ADPKVQ72F60B5G2":3,"skill-same:01M71F3F2F4ADPKVQ72F60B5G2":92},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":14,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M71F3F2F4ADPKVQ72F60B5G2","c2-adversary-monitor",null,"Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fc2\u002Fadversary\u002Fmonitor\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"c2","c2 adversary monitor","monitor","data","intelligence","transparency","read","command","de","threat-intelligence","track","threat-actor","dns","analysis","Bash","cybersecurity","map","ip","cm","command-and-control","2026-11-10 10:12:30",false,"---\nname: c2-adversary-monitor\ndescription: Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- infrastructure-tracking\n- passive-dns\n- c2\n- whois\n- threat-actor\n- pivoting\n- threat-intelligence\n- domain-analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1071\n- T1596.002\ncapec: []\n---\n\n# Building Adversary Infrastructure Tracking System\n\n## Overview\n\nAdversary infrastructure tracking uses passive DNS records, certificate transparency logs, WHOIS registration data, and IP enrichment to discover, map, and monitor threat actor command-and-control (C2) networks. Attackers frequently reuse hosting providers, registrars, SSL certificates, and naming patterns across campaigns, enabling analysts to pivot from known indicators to discover new infrastructure. This skill covers building an automated tracking system that identifies infrastructure relationships, detects newly registered domains matching adversary patterns, and maintains a continuously updated map of threat actor networks.\n\n\n## When to Use\n\n- When deploying or configuring building adversary infrastructure tracking system capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `dnspython`, `python-whois`, `shodan`, `networkx` libraries\n- API keys: SecurityTrails, PassiveTotal\u002FRiskIQ, Shodan, VirusTotal\n- Access to passive DNS data sources\n- Understanding of DNS infrastructure, hosting, and domain registration\n- Graph database (Neo4j) or NetworkX for relationship visualization\n\n## Key Concepts\n\n### Passive DNS\n\nPassive DNS captures historical DNS resolution data, recording which domains resolved to which IPs and when. Unlike active DNS queries, passive DNS preserves historical relationships even after records change, enabling analysts to track infrastructure changes, identify shared hosting patterns, and discover related domains that resolved to the same IP addresses over time.\n\n### Infrastructure Pivoting\n\nPivoting identifies related infrastructure by following connections: IP pivot (find all domains on an IP), domain pivot (find all IPs a domain resolved to), WHOIS pivot (find domains with same registrant), certificate pivot (find hosts sharing SSL certificates), and NS\u002FMX pivot (find domains using same name servers or mail servers).\n\n### Adversary Infrastructure Patterns\n\nThreat actors exhibit patterns: preferred registrars (Namecheap, REG.RU, Tucows), preferred hosting (bulletproof hosting providers, cloud services), domain generation algorithms (DGA), consistent naming patterns, and certificate reuse across campaigns.\n\n## Workflow\n\n### Step 1: Passive DNS Infrastructure Discovery\n\n```python\nimport requests\nimport json\nfrom collections import defaultdict\nfrom datetime import datetime\n\nclass InfrastructureTracker:\n    def __init__(self, securitytrails_key=None, vt_key=None, shodan_key=None):\n        self.st_key = securitytrails_key\n        self.vt_key = vt_key\n        self.shodan_key = shodan_key\n        self.infrastructure_graph = defaultdict(lambda: {\"nodes\": set(), \"edges\": []})\n\n    def passive_dns_lookup(self, domain):\n        \"\"\"Query passive DNS for domain resolution history.\"\"\"\n        headers = {\"apikey\": self.st_key}\n        url = f\"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fhistory\u002F{domain}\u002Fdns\u002Fa\"\n        resp = requests.get(url, headers=headers, timeout=30)\n        if resp.status_code == 200:\n            records = resp.json().get(\"records\", [])\n            history = []\n            for record in records:\n                for value in record.get(\"values\", []):\n                    history.append({\n                        \"domain\": domain,\n                        \"ip\": value.get(\"ip\", \"\"),\n                        \"first_seen\": record.get(\"first_seen\", \"\"),\n                        \"last_seen\": record.get(\"last_seen\", \"\"),\n                        \"type\": record.get(\"type\", \"a\"),\n                    })\n            print(f\"[+] Passive DNS for {domain}: {len(history)} records\")\n            return history\n        return []\n\n    def reverse_ip_lookup(self, ip_address):\n        \"\"\"Find all domains hosted on an IP address.\"\"\"\n        headers = {\"apikey\": self.st_key}\n        url = f\"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fips\u002Fnearby\u002F{ip_address}\"\n        resp = requests.get(url, headers=headers, timeout=30)\n        if resp.status_code == 200:\n            blocks = resp.json().get(\"blocks\", [])\n            domains = []\n            for block in blocks:\n                for site in block.get(\"sites\", []):\n                    domains.append(site)\n            print(f\"[+] Reverse IP for {ip_address}: {len(domains)} domains\")\n            return domains\n        return []\n\n    def whois_lookup(self, domain):\n        \"\"\"Get WHOIS registration data for pivoting.\"\"\"\n        headers = {\"apikey\": self.st_key}\n        url = f\"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fdomain\u002F{domain}\u002Fwhois\"\n        resp = requests.get(url, headers=headers, timeout=30)\n        if resp.status_code == 200:\n            data = resp.json()\n            whois_data = {\n                \"domain\": domain,\n                \"registrar\": data.get(\"registrar\", \"\"),\n                \"registrant_org\": data.get(\"registrant_org\", \"\"),\n                \"registrant_email\": data.get(\"registrant_email\", \"\"),\n                \"name_servers\": data.get(\"nameServers\", []),\n                \"created_date\": data.get(\"createdDate\", \"\"),\n                \"updated_date\": data.get(\"updatedDate\", \"\"),\n                \"expires_date\": data.get(\"expiresDate\", \"\"),\n            }\n            return whois_data\n        return {}\n\n    def pivot_from_seed(self, seed_indicator, indicator_type=\"domain\", depth=2):\n        \"\"\"Recursively pivot from a seed indicator to discover infrastructure.\"\"\"\n        discovered = {\"domains\": set(), \"ips\": set(), \"relationships\": []}\n\n        if indicator_type == \"domain\":\n            discovered[\"domains\"].add(seed_indicator)\n            # Get IPs for domain\n            pdns = self.passive_dns_lookup(seed_indicator)\n            for record in pdns:\n                ip = record[\"ip\"]\n                discovered[\"ips\"].add(ip)\n                discovered[\"relationships\"].append({\n                    \"source\": seed_indicator, \"target\": ip,\n                    \"type\": \"resolves_to\",\n                    \"first_seen\": record[\"first_seen\"],\n                    \"last_seen\": record[\"last_seen\"],\n                })\n\n                if depth > 1:\n                    # Reverse lookup on discovered IPs\n                    reverse_domains = self.reverse_ip_lookup(ip)\n                    for rd in reverse_domains[:20]:\n                        discovered[\"domains\"].add(rd)\n                        discovered[\"relationships\"].append({\n                            \"source\": rd, \"target\": ip,\n                            \"type\": \"hosted_on\",\n                        })\n\n        elif indicator_type == \"ip\":\n            discovered[\"ips\"].add(seed_indicator)\n            domains = self.reverse_ip_lookup(seed_indicator)\n            for domain in domains[:20]:\n                discovered[\"domains\"].add(domain)\n                discovered[\"relationships\"].append({\n                    \"source\": domain, \"target\": seed_indicator,\n                    \"type\": \"hosted_on\",\n                })\n\n        print(f\"[+] Pivot from {seed_indicator}: \"\n              f\"{len(discovered['domains'])} domains, \"\n              f\"{len(discovered['ips'])} IPs, \"\n              f\"{len(discovered['relationships'])} relationships\")\n        return discovered\n\ntracker = InfrastructureTracker(\n    securitytrails_key=\"YOUR_ST_KEY\",\n    vt_key=\"YOUR_VT_KEY\",\n)\n```\n\n### Step 2: Build Infrastructure Graph\n\n```python\nimport networkx as nx\n\nclass InfrastructureGraph:\n    def __init__(self):\n        self.graph = nx.Graph()\n\n    def add_discovery(self, discovery_data):\n        \"\"\"Add discovered infrastructure to graph.\"\"\"\n        for domain in discovery_data[\"domains\"]:\n            self.graph.add_node(domain, type=\"domain\")\n        for ip in discovery_data[\"ips\"]:\n            self.graph.add_node(ip, type=\"ip\")\n        for rel in discovery_data[\"relationships\"]:\n            self.graph.add_edge(\n                rel[\"source\"], rel[\"target\"],\n                relationship=rel[\"type\"],\n                first_seen=rel.get(\"first_seen\", \"\"),\n                last_seen=rel.get(\"last_seen\", \"\"),\n            )\n\n    def find_clusters(self):\n        \"\"\"Identify infrastructure clusters.\"\"\"\n        components = list(nx.connected_components(self.graph))\n        clusters = []\n        for component in components:\n            domains = [n for n in component if self.graph.nodes[n].get(\"type\") == \"domain\"]\n            ips = [n for n in component if self.graph.nodes[n].get(\"type\") == \"ip\"]\n            clusters.append({\n                \"size\": len(component),\n                \"domains\": sorted(domains),\n                \"ips\": sorted(ips),\n                \"domain_count\": len(domains),\n                \"ip_count\": len(ips),\n            })\n        clusters.sort(key=lambda x: x[\"size\"], reverse=True)\n        print(f\"[+] Infrastructure clusters: {len(clusters)}\")\n        return clusters\n\n    def find_hub_nodes(self, top_n=10):\n        \"\"\"Find high-centrality nodes (shared infrastructure).\"\"\"\n        centrality = nx.degree_centrality(self.graph)\n        top_nodes = sorted(centrality.items(), key=lambda x: x[1], reverse=True)[:top_n]\n        hubs = []\n        for node, score in top_nodes:\n            hubs.append({\n                \"node\": node,\n                \"type\": self.graph.nodes[node].get(\"type\", \"unknown\"),\n                \"centrality\": round(score, 4),\n                \"connections\": self.graph.degree(node),\n            })\n        return hubs\n\n    def export_graph(self, output_file=\"infrastructure_graph.json\"):\n        data = nx.node_link_data(self.graph)\n        with open(output_file, \"w\") as f:\n            json.dump(data, f, indent=2)\n        print(f\"[+] Graph exported: {self.graph.number_of_nodes()} nodes, \"\n              f\"{self.graph.number_of_edges()} edges\")\n\ninfra_graph = InfrastructureGraph()\ndiscovery = tracker.pivot_from_seed(\"evil-domain.com\", depth=2)\ninfra_graph.add_discovery(discovery)\nclusters = infra_graph.find_clusters()\nhubs = infra_graph.find_hub_nodes()\ninfra_graph.export_graph()\n```\n\n### Step 3: Monitor for New Infrastructure\n\n```python\nimport time\n\nclass InfrastructureMonitor:\n    def __init__(self, tracker, known_indicators):\n        self.tracker = tracker\n        self.known = set(known_indicators)\n        self.alerts = []\n\n    def check_new_registrations(self, patterns):\n        \"\"\"Check for newly registered domains matching adversary patterns.\"\"\"\n        import re\n        new_domains = []\n        for pattern in patterns:\n            # Query SecurityTrails for new domains matching pattern\n            headers = {\"apikey\": self.tracker.st_key}\n            url = \"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fdomains\u002Flist\"\n            params = {\"include_ips\": \"true\", \"page\": 1}\n            body = {\"filter\": {\"keyword\": pattern}}\n            resp = requests.post(url, headers=headers, json=body, timeout=30)\n            if resp.status_code == 200:\n                records = resp.json().get(\"records\", [])\n                for record in records:\n                    domain = record.get(\"hostname\", \"\")\n                    if domain not in self.known:\n                        new_domains.append({\n                            \"domain\": domain,\n                            \"pattern_matched\": pattern,\n                            \"first_seen\": datetime.now().isoformat(),\n                        })\n                        self.known.add(domain)\n\n        if new_domains:\n            print(f\"[ALERT] {len(new_domains)} new domains matching patterns\")\n            self.alerts.extend(new_domains)\n        return new_domains\n\n    def generate_infrastructure_report(self, clusters, hubs):\n        report = f\"\"\"# Adversary Infrastructure Tracking Report\nGenerated: {datetime.now().isoformat()}\n\n## Summary\n- Infrastructure clusters identified: {len(clusters)}\n- Total domains tracked: {sum(c['domain_count'] for c in clusters)}\n- Total IPs tracked: {sum(c['ip_count'] for c in clusters)}\n- New domains detected: {len(self.alerts)}\n\n## Top Infrastructure Hubs\n| Node | Type | Connections | Centrality |\n|------|------|-------------|------------|\n\"\"\"\n        for hub in hubs[:10]:\n            report += (f\"| {hub['node']} | {hub['type']} \"\n                       f\"| {hub['connections']} | {hub['centrality']} |\\n\")\n\n        report += \"\\n## Infrastructure Clusters\\n\"\n        for i, cluster in enumerate(clusters[:5], 1):\n            report += f\"\\n### Cluster {i} ({cluster['size']} nodes)\\n\"\n            report += f\"- Domains: {', '.join(cluster['domains'][:5])}\\n\"\n            report += f\"- IPs: {', '.join(cluster['ips'][:5])}\\n\"\n\n        with open(\"infrastructure_report.md\", \"w\") as f:\n            f.write(report)\n        print(\"[+] Infrastructure report saved\")\n\nmonitor = InfrastructureMonitor(tracker, known_indicators=set())\n```\n\n## Validation Criteria\n\n- Passive DNS queries return historical resolution data\n- Reverse IP lookups discover co-hosted domains\n- Infrastructure pivoting expands from seed indicators\n- Graph analysis identifies clusters and hub nodes\n- New infrastructure detected through pattern monitoring\n- Reports generated with actionable recommendations\n\n## References\n\n- [Juniper: Threat Hunting with Passive DNS](https:\u002F\u002Fblogs.juniper.net\u002Fen-us\u002Fthreat-research\u002Fthreat-hunting-with-passive-dns-discovering-the-attacker-infrastructure)\n- [Censys: Advanced Persistent Infrastructure Tracking](https:\u002F\u002Fcensys.com\u002Fblog\u002Fadvanced-persistent-infrastructure-tracking)\n- [Embee Research: Malware Infrastructure with DNS Pivoting](https:\u002F\u002Fwww.embeeresearch.io\u002Finfrastructure-analysis-with-dns-pivoting\u002F)\n- [Validin: Passive DNS Threat Hunting](https:\u002F\u002Fwww.validin.com\u002Fblog\u002Fannouncing_validin_threat_hunting_platform\u002F)\n- [SecurityTrails API](https:\u002F\u002Fsecuritytrails.com\u002Fcorp\u002Fapi)\n- [Hunt.io: Uncovering Malicious Infrastructure](https:\u002F\u002Fhunt.io\u002Fblog\u002Fpractical-guide-unconvering-malicious-infrastructure)\n","# Building Adversary Infrastructure Tracking System\n\n## Overview\n\nAdversary infrastructure tracking uses passive DNS records, certificate transparency logs, WHOIS registration data, and IP enrichment to discover, map, and monitor threat actor command-and-control (C2) networks. Attackers frequently reuse hosting providers, registrars, SSL certificates, and naming patterns across campaigns, enabling analysts to pivot from known indicators to discover new infrastructure. This skill covers building an automated tracking system that identifies infrastructure relationships, detects newly registered domains matching adversary patterns, and maintains a continuously updated map of threat actor networks.\n\n\n## When to Use\n\n- When deploying or configuring building adversary infrastructure tracking system capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `dnspython`, `python-whois`, `shodan`, `networkx` libraries\n- API keys: SecurityTrails, PassiveTotal\u002FRiskIQ, Shodan, VirusTotal\n- Access to passive DNS data sources\n- Understanding of DNS infrastructure, hosting, and domain registration\n- Graph database (Neo4j) or NetworkX for relationship visualization\n\n## Key Concepts\n\n### Passive DNS\n\nPassive DNS captures historical DNS resolution data, recording which domains resolved to which IPs and when. Unlike active DNS queries, passive DNS preserves historical relationships even after records change, enabling analysts to track infrastructure changes, identify shared hosting patterns, and discover related domains that resolved to the same IP addresses over time.\n\n### Infrastructure Pivoting\n\nPivoting identifies related infrastructure by following connections: IP pivot (find all domains on an IP), domain pivot (find all IPs a domain resolved to), WHOIS pivot (find domains with same registrant), certificate pivot (find hosts sharing SSL certificates), and NS\u002FMX pivot (find domains using same name servers or mail servers).\n\n### Adversary Infrastructure Patterns\n\nThreat actors exhibit patterns: preferred registrars (Namecheap, REG.RU, Tucows), preferred hosting (bulletproof hosting providers, cloud services), domain generation algorithms (DGA), consistent naming patterns, and certificate reuse across campaigns.\n\n## Workflow\n\n### Step 1: Passive DNS Infrastructure Discovery\n\n```python\nimport requests\nimport json\nfrom collections import defaultdict\nfrom datetime import datetime\n\nclass InfrastructureTracker:\n    def __init__(self, securitytrails_key=None, vt_key=None, shodan_key=None):\n        self.st_key = securitytrails_key\n        self.vt_key = vt_key\n        self.shodan_key = shodan_key\n        self.infrastructure_graph = defaultdict(lambda: {\"nodes\": set(), \"edges\": []})\n\n    def passive_dns_lookup(self, domain):\n        \"\"\"Query passive DNS for domain resolution history.\"\"\"\n        headers = {\"apikey\": self.st_key}\n        url = f\"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fhistory\u002F{domain}\u002Fdns\u002Fa\"\n        resp = requests.get(url, headers=headers, timeout=30)\n        if resp.status_code == 200:\n            records = resp.json().get(\"records\", [])\n            history = []\n            for record in records:\n                for value in record.get(\"values\", []):\n                    history.append({\n                        \"domain\": domain,\n                        \"ip\": value.get(\"ip\", \"\"),\n                        \"first_seen\": record.get(\"first_seen\", \"\"),\n                        \"last_seen\": record.get(\"last_seen\", \"\"),\n                        \"type\": record.get(\"type\", \"a\"),\n                    })\n            print(f\"[+] Passive DNS for {domain}: {len(history)} records\")\n            return history\n        return []\n\n    def reverse_ip_lookup(self, ip_address):\n        \"\"\"Find all domains hosted on an IP address.\"\"\"\n        headers = {\"apikey\": self.st_key}\n        url = f\"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fips\u002Fnearby\u002F{ip_address}\"\n        resp = requests.get(url, headers=headers, timeout=30)\n        if resp.status_code == 200:\n            blocks = resp.json().get(\"blocks\", [])\n            domains = []\n            for block in blocks:\n                for site in block.get(\"sites\", []):\n                    domains.append(site)\n            print(f\"[+] Reverse IP for {ip_address}: {len(domains)} domains\")\n            return domains\n        return []\n\n    def whois_lookup(self, domain):\n        \"\"\"Get WHOIS registration data for pivoting.\"\"\"\n        headers = {\"apikey\": self.st_key}\n        url = f\"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fdomain\u002F{domain}\u002Fwhois\"\n        resp = requests.get(url, headers=headers, timeout=30)\n        if resp.status_code == 200:\n            data = resp.json()\n            whois_data = {\n                \"domain\": domain,\n                \"registrar\": data.get(\"registrar\", \"\"),\n                \"registrant_org\": data.get(\"registrant_org\", \"\"),\n                \"registrant_email\": data.get(\"registrant_email\", \"\"),\n                \"name_servers\": data.get(\"nameServers\", []),\n                \"created_date\": data.get(\"createdDate\", \"\"),\n                \"updated_date\": data.get(\"updatedDate\", \"\"),\n                \"expires_date\": data.get(\"expiresDate\", \"\"),\n            }\n            return whois_data\n        return {}\n\n    def pivot_from_seed(self, seed_indicator, indicator_type=\"domain\", depth=2):\n        \"\"\"Recursively pivot from a seed indicator to discover infrastructure.\"\"\"\n        discovered = {\"domains\": set(), \"ips\": set(), \"relationships\": []}\n\n        if indicator_type == \"domain\":\n            discovered[\"domains\"].add(seed_indicator)\n            # Get IPs for domain\n            pdns = self.passive_dns_lookup(seed_indicator)\n            for record in pdns:\n                ip = record[\"ip\"]\n                discovered[\"ips\"].add(ip)\n                discovered[\"relationships\"].append({\n                    \"source\": seed_indicator, \"target\": ip,\n                    \"type\": \"resolves_to\",\n                    \"first_seen\": record[\"first_seen\"],\n                    \"last_seen\": record[\"last_seen\"],\n                })\n\n                if depth > 1:\n                    # Reverse lookup on discovered IPs\n                    reverse_domains = self.reverse_ip_lookup(ip)\n                    for rd in reverse_domains[:20]:\n                        discovered[\"domains\"].add(rd)\n                        discovered[\"relationships\"].append({\n                            \"source\": rd, \"target\": ip,\n                            \"type\": \"hosted_on\",\n                        })\n\n        elif indicator_type == \"ip\":\n            discovered[\"ips\"].add(seed_indicator)\n            domains = self.reverse_ip_lookup(seed_indicator)\n            for domain in domains[:20]:\n                discovered[\"domains\"].add(domain)\n                discovered[\"relationships\"].append({\n                    \"source\": domain, \"target\": seed_indicator,\n                    \"type\": \"hosted_on\",\n                })\n\n        print(f\"[+] Pivot from {seed_indicator}: \"\n              f\"{len(discovered['domains'])} domains, \"\n              f\"{len(discovered['ips'])} IPs, \"\n              f\"{len(discovered['relationships'])} relationships\")\n        return discovered\n\ntracker = InfrastructureTracker(\n    securitytrails_key=\"YOUR_ST_KEY\",\n    vt_key=\"YOUR_VT_KEY\",\n)\n```\n\n### Step 2: Build Infrastructure Graph\n\n```python\nimport networkx as nx\n\nclass InfrastructureGraph:\n    def __init__(self):\n        self.graph = nx.Graph()\n\n    def add_discovery(self, discovery_data):\n        \"\"\"Add discovered infrastructure to graph.\"\"\"\n        for domain in discovery_data[\"domains\"]:\n            self.graph.add_node(domain, type=\"domain\")\n        for ip in discovery_data[\"ips\"]:\n            self.graph.add_node(ip, type=\"ip\")\n        for rel in discovery_data[\"relationships\"]:\n            self.graph.add_edge(\n                rel[\"source\"], rel[\"target\"],\n                relationship=rel[\"type\"],\n                first_seen=rel.get(\"first_seen\", \"\"),\n                last_seen=rel.get(\"last_seen\", \"\"),\n            )\n\n    def find_clusters(self):\n        \"\"\"Identify infrastructure clusters.\"\"\"\n        components = list(nx.connected_components(self.graph))\n        clusters = []\n        for component in components:\n            domains = [n for n in component if self.graph.nodes[n].get(\"type\") == \"domain\"]\n            ips = [n for n in component if self.graph.nodes[n].get(\"type\") == \"ip\"]\n            clusters.append({\n                \"size\": len(component),\n                \"domains\": sorted(domains),\n                \"ips\": sorted(ips),\n                \"domain_count\": len(domains),\n                \"ip_count\": len(ips),\n            })\n        clusters.sort(key=lambda x: x[\"size\"], reverse=True)\n        print(f\"[+] Infrastructure clusters: {len(clusters)}\")\n        return clusters\n\n    def find_hub_nodes(self, top_n=10):\n        \"\"\"Find high-centrality nodes (shared infrastructure).\"\"\"\n        centrality = nx.degree_centrality(self.graph)\n        top_nodes = sorted(centrality.items(), key=lambda x: x[1], reverse=True)[:top_n]\n        hubs = []\n        for node, score in top_nodes:\n            hubs.append({\n                \"node\": node,\n                \"type\": self.graph.nodes[node].get(\"type\", \"unknown\"),\n                \"centrality\": round(score, 4),\n                \"connections\": self.graph.degree(node),\n            })\n        return hubs\n\n    def export_graph(self, output_file=\"infrastructure_graph.json\"):\n        data = nx.node_link_data(self.graph)\n        with open(output_file, \"w\") as f:\n            json.dump(data, f, indent=2)\n        print(f\"[+] Graph exported: {self.graph.number_of_nodes()} nodes, \"\n              f\"{self.graph.number_of_edges()} edges\")\n\ninfra_graph = InfrastructureGraph()\ndiscovery = tracker.pivot_from_seed(\"evil-domain.com\", depth=2)\ninfra_graph.add_discovery(discovery)\nclusters = infra_graph.find_clusters()\nhubs = infra_graph.find_hub_nodes()\ninfra_graph.export_graph()\n```\n\n### Step 3: Monitor for New Infrastructure\n\n```python\nimport time\n\nclass InfrastructureMonitor:\n    def __init__(self, tracker, known_indicators):\n        self.tracker = tracker\n        self.known = set(known_indicators)\n        self.alerts = []\n\n    def check_new_registrations(self, patterns):\n        \"\"\"Check for newly registered domains matching adversary patterns.\"\"\"\n        import re\n        new_domains = []\n        for pattern in patterns:\n            # Query SecurityTrails for new domains matching pattern\n            headers = {\"apikey\": self.tracker.st_key}\n            url = \"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fdomains\u002Flist\"\n            params = {\"include_ips\": \"true\", \"page\": 1}\n            body = {\"filter\": {\"keyword\": pattern}}\n            resp = requests.post(url, headers=headers, json=body, timeout=30)\n            if resp.status_code == 200:\n                records = resp.json().get(\"records\", [])\n                for record in records:\n                    domain = record.get(\"hostname\", \"\")\n                    if domain not in self.known:\n                        new_domains.append({\n                            \"domain\": domain,\n                            \"pattern_matched\": pattern,\n                            \"first_seen\": datetime.now().isoformat(),\n                        })\n                        self.known.add(domain)\n\n        if new_domains:\n            print(f\"[ALERT] {len(new_domains)} new domains matching patterns\")\n            self.alerts.extend(new_domains)\n        return new_domains\n\n    def generate_infrastructure_report(self, clusters, hubs):\n        report = f\"\"\"# Adversary Infrastructure Tracking Report\nGenerated: {datetime.now().isoformat()}\n\n## Summary\n- Infrastructure clusters identified: {len(clusters)}\n- Total domains tracked: {sum(c['domain_count'] for c in clusters)}\n- Total IPs tracked: {sum(c['ip_count'] for c in clusters)}\n- New domains detected: {len(self.alerts)}\n\n## Top Infrastructure Hubs\n| Node | Type | Connections | Centrality |\n|------|------|-------------|------------|\n\"\"\"\n        for hub in hubs[:10]:\n            report += (f\"| {hub['node']} | {hub['type']} \"\n                       f\"| {hub['connections']} | {hub['centrality']} |\\n\")\n\n        report += \"\\n## Infrastructure Clusters\\n\"\n        for i, cluster in enumerate(clusters[:5], 1):\n            report += f\"\\n### Cluster {i} ({cluster['size']} nodes)\\n\"\n            report += f\"- Domains: {', '.join(cluster['domains'][:5])}\\n\"\n            report += f\"- IPs: {', '.join(cluster['ips'][:5])}\\n\"\n\n        with open(\"infrastructure_report.md\", \"w\") as f:\n            f.write(report)\n        print(\"[+] Infrastructure report saved\")\n\nmonitor = InfrastructureMonitor(tracker, known_indicators=set())\n```\n\n## Validation Criteria\n\n- Passive DNS queries return historical resolution data\n- Reverse IP lookups discover co-hosted domains\n- Infrastructure pivoting expands from seed indicators\n- Graph analysis identifies clusters and hub nodes\n- New infrastructure detected through pattern monitoring\n- Reports generated with actionable recommendations\n\n## References\n\n- [Juniper: Threat Hunting with Passive DNS](https:\u002F\u002Fblogs.juniper.net\u002Fen-us\u002Fthreat-research\u002Fthreat-hunting-with-passive-dns-discovering-the-attacker-infrastructure)\n- [Censys: Advanced Persistent Infrastructure Tracking](https:\u002F\u002Fcensys.com\u002Fblog\u002Fadvanced-persistent-infrastructure-tracking)\n- [Embee Research: Malware Infrastructure with DNS Pivoting](https:\u002F\u002Fwww.embeeresearch.io\u002Finfrastructure-analysis-with-dns-pivoting\u002F)\n- [Validin: Passive DNS Threat Hunting](https:\u002F\u002Fwww.validin.com\u002Fblog\u002Fannouncing_validin_threat_hunting_platform\u002F)\n- [SecurityTrails API](https:\u002F\u002Fsecuritytrails.com\u002Fcorp\u002Fapi)\n- [Hunt.io: Uncovering Malicious Infrastructure](https:\u002F\u002Fhunt.io\u002Fblog\u002Fpractical-guide-unconvering-malicious-infrastructure)\n",{"name":5,"tags":44,"capec":50,"model":51,"tools":52,"domain":34,"maxTurns":56,"nist_csf":57,"subdomain":28,"description":7,"mitre_attack":62},[45,46,19,47,30,48,28,49],"infrastructure-tracking","passive-dns","whois","pivoting","domain-analysis",[],"sonnet",[53,33,54,55],"Read","Glob","Grep",20,[58,59,60,61],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[63,64],"T1071","T1596.002","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fc2\u002Fadversary\u002Fmonitor","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill c2-adversary-monitor",{"tool":78,"command":79},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill c2-adversary-monitor",{"tool":81,"command":82},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill c2-adversary-monitor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fc2\u002Fadversary\u002Fmonitor\u002FSKILL.md",true,[86],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"index.json","REFERENCE","参考文档",671,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fc2\u002Fadversary\u002Fmonitor\u002Findex.json",[93,116,135,156,178,194],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[100,101,102,103,104,27,37,105,106,107,108,109,110,111,112,113,114,34,115],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[123,100,124,103,125,126,127,34,33,32,128,129,130,131,27,26,132,25,133,134],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","lateral movement","lateral-movement","Impacket",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[142,143,144,145,146,147,34,33,148,32,149,150,27,25,151,152,153,154,155,51],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[101,163,164,165,166,167,168,37,169,34,115,170,171,172,173,174,175,176,177,27],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[185,186,101,187,165,167,188,37,189,169,34,115,32,190,191,192,193,177,27,105],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[201,101,165,202,188,37,203,204,34,115,205,206,207,208,209,210,27,105,211,212],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]