[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FJS7MVX7KS3MJPQY1YY77":3,"skill-same:01M71FJS7MVX7KS3MJPQY1YY77":96},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M71FJS7MVX7KS3MJPQY1YY77","capture-tshark-analyze",null,"Automate network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction from PCAP files","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fcapture\u002Ftshark\u002Fanalyze\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"capture tshark analyze","tshark","capture","analyze","security","flow","network","read","de","suspicious","network-forensics","statistics","dns","analysis","Bash","cybersecurity","traffic","files","ioc extraction","cm","2026-11-10 10:12:30",false,"---\nname: capture-tshark-analyze\ndescription: Automate network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction from PCAP files\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- tshark\n- pyshark\n- pcap\n- packet-analysis\n- network-forensics\n- wireshark\n- traffic-analysis\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1040\n- T1041\n- T1059\n- T1071.001\n- T1562.001\ncapec: []\n---\n\n# Performing Network Traffic Analysis with TShark\n\n## Overview\n\nThis skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing network traffic analysis with tshark\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- tshark (Wireshark CLI) installed and in PATH\n- Python 3.8+ with pyshark library\n- PCAP or PCAPNG capture file for analysis\n\n## Steps\n\n1. **Extract Protocol Statistics** — Generate protocol hierarchy and conversation statistics from the capture\n2. **Identify Top Talkers** — Rank source\u002Fdestination IPs by volume and connection count\n3. **Detect Suspicious Flows** — Flag port scanning patterns, unusual port usage, and high-frequency connections\n4. **Extract Network IOCs** — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic\n5. **Analyze DNS Traffic** — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records\n6. **Generate Analysis Report** — Produce structured report with flow summaries and threat indicators\n\n## Expected Output\n\n- JSON report with protocol statistics and top talkers\n- Suspicious flow detections with severity ratings\n- Extracted IOCs (IPs, domains, URLs)\n- DNS anomaly analysis results\n","# Performing Network Traffic Analysis with TShark\n\n## Overview\n\nThis skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing network traffic analysis with tshark\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- tshark (Wireshark CLI) installed and in PATH\n- Python 3.8+ with pyshark library\n- PCAP or PCAPNG capture file for analysis\n\n## Steps\n\n1. **Extract Protocol Statistics** — Generate protocol hierarchy and conversation statistics from the capture\n2. **Identify Top Talkers** — Rank source\u002Fdestination IPs by volume and connection count\n3. **Detect Suspicious Flows** — Flag port scanning patterns, unusual port usage, and high-frequency connections\n4. **Extract Network IOCs** — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic\n5. **Analyze DNS Traffic** — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records\n6. **Generate Analysis Report** — Produce structured report with flow summaries and threat indicators\n\n## Expected Output\n\n- JSON report with protocol statistics and top talkers\n- Suspicious flow detections with severity ratings\n- Extracted IOCs (IPs, domains, URLs)\n- DNS anomaly analysis results\n",{"name":5,"tags":44,"capec":50,"model":51,"tools":52,"domain":34,"maxTurns":56,"nist_csf":57,"subdomain":62,"description":7,"mitre_attack":63},[20,45,46,47,29,48,49],"pyshark","pcap","packet-analysis","wireshark","traffic-analysis",[],"sonnet",[53,33,54,55],"Read","Glob","Grep",20,[58,59,60,61],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","network-security",[64,65,66,67,68],"T1040","T1041","T1059","T1071.001","T1562.001","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Fcapture\u002Ftshark\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill capture-tshark-analyze",{"tool":82,"command":83},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill capture-tshark-analyze",{"tool":85,"command":86},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill capture-tshark-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fcapture\u002Ftshark\u002Fanalyze\u002FSKILL.md",true,[90],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"index.json","REFERENCE","参考文档",654,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fcapture\u002Ftshark\u002Fanalyze\u002Findex.json",[97,120,139,159,181,197],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[104,105,106,107,108,27,38,109,110,111,112,113,114,115,116,117,118,34,119],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[127,104,128,107,129,130,35,34,33,32,131,132,133,134,27,135,136,26,137,138],"exploit","services wmi exec exploit","exec","remote","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[146,147,148,149,150,151,34,33,152,32,22,153,27,26,154,155,156,157,158,51],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[105,166,167,168,169,170,171,38,172,34,119,173,174,175,176,177,178,179,180,27],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[188,189,105,190,168,170,191,38,192,172,34,119,32,193,194,195,196,180,27,109],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,105,168,205,191,38,206,207,34,119,208,209,210,211,212,213,27,109,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]