[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FGE68MF5Y0FCBKXGF92G4":3,"skill-same:01M71FGE68MF5Y0FCBKXGF92G4":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":14,"repositoryHtmlUrl":44,"repositoryHomepageUrl":6,"ownerHtmlUrl":45,"ownerBlogUrl":6,"ownerDescription":46,"updatedAt":47,"install":48,"resources":61},"01M71FGE68MF5Y0FCBKXGF92G4","net-traffic-c2traffic",null,"| | **Beaconing** | Periodic check-in communication from malware to C2 server at regular intervals, often with jitter to avoid pattern detection | | **Jitter** | Randomization applied to beacon interval (e.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-traffic-c2traffic\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"net traffic c2traffic","traffic","malware","detection","pattern","c2","beacon","at","pattern detection","communication","jitter","beaconing","server","with","check","cybersecurity","periodic","2026-11-10 10:12:30",false,"---\nname: net-traffic-c2traffic\ndescription: \"| | **Beaconing** | Periodic check-in communication from malware to C2 server at regular intervals, often with jitter to avoid pattern detection | | **Jitter** | Randomization applied to beacon interval (e.\"\ndomain: cybersecurity\n---\n\n|\n| **Beaconing** | Periodic check-in communication from malware to C2 server at regular intervals, often with jitter to avoid pattern detection |\n| **Jitter** | Randomization applied to beacon interval (e.g., 60s +\u002F- 15%) to make the timing pattern less predictable and harder to detect |\n| **Malleable C2** | Cobalt Strike feature allowing operators to customize all aspects of C2 traffic (URIs, headers, encoding) to mimic legitimate services |\n| **Dead Drop** | Intermediate location (paste site, cloud storage, social media) where C2 commands are posted for the malware to retrieve |\n| **Domain Fronting** | Using a trusted CDN domain in the TLS SNI while routing to a different backend, making C2 traffic appear to go to a legitimate service |\n| **Fast Flux** | Rapidly changing DNS records for C2 domains to distribute across many IPs and resist takedown efforts |\n| **C2 Framework** | Software toolkit providing C2 server, implant generator, and operator interface (Cobalt Strike, Metasploit, Sliver, Covenant) |\n\n## Tools & Systems\n\n- **Wireshark**: Packet analyzer for detailed C2 protocol analysis at the packet level\n- **RITA (Real Intelligence Threat Analytics)**: Open-source tool analyzing Zeek logs for beacon detection and DNS tunneling\n- **CobaltStrikeParser**: Tool extracting Cobalt Strike beacon configuration from samples and memory dumps\n- **JA3\u002FJA3S**: TLS fingerprinting method for identifying C2 frameworks by their TLS implementation characteristics\n- **Shodan\u002FCensys**: Internet scanning platforms for mapping C2 infrastructure and identifying related servers\n\n## Common Scenarios\n\n### Scenario: Reverse Engineering a Custom C2 Protocol\n\n**Context**: A malware sample communicates with its C2 server using an unknown binary protocol over TCP port 8443. The protocol needs to be decoded to understand the command set and build detection signatures.\n\n**Approach**:\n1. Filter PCAP for TCP port 8443 conversations and extract the TCP streams\n2. Analyze the first few exchanges to identify the handshake\u002Fauthentication mechanism\n3. Map the message structure (length prefix, type field, payload encoding)\n4. Cross-reference with Ghidra disassembly of the send\u002Freceive functions in the malware\n5. Identify the command dispatcher and document each command code's function\n6. Build a protocol decoder in Python for ongoing traffic analysis\n7. Create Suricata rules matching the protocol handshake or static header bytes\n\n**Pitfalls**:\n- Assuming the protocol is static; some C2 frameworks negotiate encryption during the handshake\n- Not capturing enough traffic to see all command types (some commands are rare)\n- Missing fallback C2 channels (DNS, ICMP) that activate when the primary channel fails\n- Confusing encrypted payload data with the protocol framing structure\n\n## Output Format\n\n```\nC2 COMMUNICATION ANALYSIS REPORT\n===================================\nSample:           malware.exe (SHA-256: e3b0c44...)\nC2 Framework:     Cobalt Strike 4.9\n\nBEACON CONFIGURATION\nC2 Server:        hxxps:\u002F\u002F185.220.101[.]42\u002Fupdates\nBeacon Type:      HTTPS (reverse)\nSleep:            60 seconds\nJitter:           15%\nUser-Agent:       Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64)\nURI (GET):        \u002Fdpixel\nURI (POST):       \u002Fsubmit.php\nWatermark:        1234567890\n\nPROTOCOL ANALYSIS\nTransport:        HTTPS (TLS 1.2)\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nCertificate:      CN=Microsoft Update (self-signed)\nEncoding:         Base64 with XOR key 0x69\nCommand Format:   [4B length][4B command_id][payload]\n\nCOMMAND SET\n0x01 - Sleep          Change beacon interval\n0x02 - Shell          Execute cmd.exe command\n0x03 - Download       Transfer file from C2\n0x04 - Upload         Exfiltrate file to C2\n0x05 - Inject         Process injection\n0x06 - Keylog         Start keylogger\n0x07 - Screenshot     Capture screen\n\nINFRASTRUCTURE\nPrimary:          185.220.101[.]42 (AS12345, Hosting Co, NL)\nFailover:         91.215.85[.]17 (AS67890, VPS Provider, RU)\nDNS:              update.malicious[.]com -> 185.220.101[.]42\nRegistrar:        NameCheap\nRegistration:     2025-09-01\n\nDETECTION SIGNATURES\nSID 9000010:      HTTP beacon pattern\nSID 9000011:      JA3 TLS fingerprint\nSID 9000013:      C2 certificate match\n```\n","|\n| **Beaconing** | Periodic check-in communication from malware to C2 server at regular intervals, often with jitter to avoid pattern detection |\n| **Jitter** | Randomization applied to beacon interval (e.g., 60s +\u002F- 15%) to make the timing pattern less predictable and harder to detect |\n| **Malleable C2** | Cobalt Strike feature allowing operators to customize all aspects of C2 traffic (URIs, headers, encoding) to mimic legitimate services |\n| **Dead Drop** | Intermediate location (paste site, cloud storage, social media) where C2 commands are posted for the malware to retrieve |\n| **Domain Fronting** | Using a trusted CDN domain in the TLS SNI while routing to a different backend, making C2 traffic appear to go to a legitimate service |\n| **Fast Flux** | Rapidly changing DNS records for C2 domains to distribute across many IPs and resist takedown efforts |\n| **C2 Framework** | Software toolkit providing C2 server, implant generator, and operator interface (Cobalt Strike, Metasploit, Sliver, Covenant) |\n\n## Tools & Systems\n\n- **Wireshark**: Packet analyzer for detailed C2 protocol analysis at the packet level\n- **RITA (Real Intelligence Threat Analytics)**: Open-source tool analyzing Zeek logs for beacon detection and DNS tunneling\n- **CobaltStrikeParser**: Tool extracting Cobalt Strike beacon configuration from samples and memory dumps\n- **JA3\u002FJA3S**: TLS fingerprinting method for identifying C2 frameworks by their TLS implementation characteristics\n- **Shodan\u002FCensys**: Internet scanning platforms for mapping C2 infrastructure and identifying related servers\n\n## Common Scenarios\n\n### Scenario: Reverse Engineering a Custom C2 Protocol\n\n**Context**: A malware sample communicates with its C2 server using an unknown binary protocol over TCP port 8443. The protocol needs to be decoded to understand the command set and build detection signatures.\n\n**Approach**:\n1. Filter PCAP for TCP port 8443 conversations and extract the TCP streams\n2. Analyze the first few exchanges to identify the handshake\u002Fauthentication mechanism\n3. Map the message structure (length prefix, type field, payload encoding)\n4. Cross-reference with Ghidra disassembly of the send\u002Freceive functions in the malware\n5. Identify the command dispatcher and document each command code's function\n6. Build a protocol decoder in Python for ongoing traffic analysis\n7. Create Suricata rules matching the protocol handshake or static header bytes\n\n**Pitfalls**:\n- Assuming the protocol is static; some C2 frameworks negotiate encryption during the handshake\n- Not capturing enough traffic to see all command types (some commands are rare)\n- Missing fallback C2 channels (DNS, ICMP) that activate when the primary channel fails\n- Confusing encrypted payload data with the protocol framing structure\n\n## Output Format\n\n```\nC2 COMMUNICATION ANALYSIS REPORT\n===================================\nSample:           malware.exe (SHA-256: e3b0c44...)\nC2 Framework:     Cobalt Strike 4.9\n\nBEACON CONFIGURATION\nC2 Server:        hxxps:\u002F\u002F185.220.101[.]42\u002Fupdates\nBeacon Type:      HTTPS (reverse)\nSleep:            60 seconds\nJitter:           15%\nUser-Agent:       Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64)\nURI (GET):        \u002Fdpixel\nURI (POST):       \u002Fsubmit.php\nWatermark:        1234567890\n\nPROTOCOL ANALYSIS\nTransport:        HTTPS (TLS 1.2)\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nCertificate:      CN=Microsoft Update (self-signed)\nEncoding:         Base64 with XOR key 0x69\nCommand Format:   [4B length][4B command_id][payload]\n\nCOMMAND SET\n0x01 - Sleep          Change beacon interval\n0x02 - Shell          Execute cmd.exe command\n0x03 - Download       Transfer file from C2\n0x04 - Upload         Exfiltrate file to C2\n0x05 - Inject         Process injection\n0x06 - Keylog         Start keylogger\n0x07 - Screenshot     Capture screen\n\nINFRASTRUCTURE\nPrimary:          185.220.101[.]42 (AS12345, Hosting Co, NL)\nFailover:         91.215.85[.]17 (AS67890, VPS Provider, RU)\nDNS:              update.malicious[.]com -> 185.220.101[.]42\nRegistrar:        NameCheap\nRegistration:     2025-09-01\n\nDETECTION SIGNATURES\nSID 9000010:      HTTP beacon pattern\nSID 9000011:      JA3 TLS fingerprint\nSID 9000013:      C2 certificate match\n```\n",{"name":5,"domain":34,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnet-traffic-c2traffic","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill net-traffic-c2traffic",{"tool":54,"command":55},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill net-traffic-c2traffic",{"tool":57,"command":58},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill net-traffic-c2traffic","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-traffic-c2traffic\u002FSKILL.md",true,[62],{"path":63,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":66,"sourceHtmlUrl":67},"index.json","REFERENCE","参考文档",662,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-traffic-c2traffic\u002Findex.json",[69,94,116,138,160,176],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":36},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,34,93],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":36},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[101,76,102,79,103,104,20,34,105,106,107,108,109,110,81,111,112,113,114,115],"exploit","services wmi exec exploit","exec","remote","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":36},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[123,124,125,126,127,128,34,105,129,106,130,131,81,113,132,133,134,135,136,137],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":36},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[77,145,146,147,148,149,150,82,151,34,93,152,153,154,155,156,157,158,159,81],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":36},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[167,168,77,169,147,149,170,82,171,151,34,93,106,172,173,174,175,159,81,83],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":36},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[183,77,147,184,170,82,185,186,34,93,187,188,189,190,191,32,81,83,192,193],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","mismatched","headers"]