[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FJYP4W49VH59HA66CT7XE":3,"skill-same:01M71FJYP4W49VH59HA66CT7XE":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":14,"repositoryHtmlUrl":66,"repositoryHomepageUrl":6,"ownerHtmlUrl":67,"ownerBlogUrl":6,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M71FJYP4W49VH59HA66CT7XE","capture-zeek-configure",null,"Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in network data.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fcapture\u002Fzeek\u002Fconfigure\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"capture","capture zeek configure","configure","Zeek","command-and-control","security-operations","beaconing","analysis","Bash","logs","cybersecurity","jitter","cm","log","time","dataframes","detecting","hunting","when","pandas","2026-11-10 10:12:30",false,"---\nname: capture-zeek-configure\ndescription: Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in network data.\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- detecting\n- beaconing\n- patterns\n- with\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1071\n- T1071.001\ncapec: []\n---\n\n# Detecting Beaconing Patterns with Zeek\n\n\n## When to Use\n\n- When investigating security incidents that require detecting beaconing patterns with zeek\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nLoad Zeek conn.log data using ZAT (Zeek Analysis Tools), group connections by\nsource\u002Fdestination pairs, and compute timing statistics to identify beaconing.\n\n```python\nfrom zat.log_to_dataframe import LogToDataFrame\nimport numpy as np\n\nlog_to_df = LogToDataFrame()\nconn_df = log_to_df.create_dataframe('\u002Fpath\u002Fto\u002Fconn.log')\n\n# Group by src\u002Fdst pair and calculate inter-arrival time\nfor (src, dst), group in conn_df.groupby(['id.orig_h', 'id.resp_h']):\n    times = group['ts'].sort_values()\n    intervals = times.diff().dt.total_seconds().dropna()\n    if len(intervals) > 10:\n        std_dev = np.std(intervals)\n        mean_interval = np.mean(intervals)\n        # Low std_dev relative to mean = likely beaconing\n```\n\nKey analysis steps:\n1. Parse Zeek conn.log into DataFrame with ZAT LogToDataFrame\n2. Group connections by source IP and destination IP pairs\n3. Calculate inter-arrival time intervals between consecutive connections\n4. Compute standard deviation and coefficient of variation\n5. Flag pairs with low coefficient of variation as potential beacons\n\n## Examples\n\n```python\nfrom zat.log_to_dataframe import LogToDataFrame\nlog_to_df = LogToDataFrame()\ndf = log_to_df.create_dataframe('conn.log')\nprint(df[['id.orig_h', 'id.resp_h', 'ts', 'duration']].head())\n```\n","# Detecting Beaconing Patterns with Zeek\n\n\n## When to Use\n\n- When investigating security incidents that require detecting beaconing patterns with zeek\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nLoad Zeek conn.log data using ZAT (Zeek Analysis Tools), group connections by\nsource\u002Fdestination pairs, and compute timing statistics to identify beaconing.\n\n```python\nfrom zat.log_to_dataframe import LogToDataFrame\nimport numpy as np\n\nlog_to_df = LogToDataFrame()\nconn_df = log_to_df.create_dataframe('\u002Fpath\u002Fto\u002Fconn.log')\n\n# Group by src\u002Fdst pair and calculate inter-arrival time\nfor (src, dst), group in conn_df.groupby(['id.orig_h', 'id.resp_h']):\n    times = group['ts'].sort_values()\n    intervals = times.diff().dt.total_seconds().dropna()\n    if len(intervals) > 10:\n        std_dev = np.std(intervals)\n        mean_interval = np.mean(intervals)\n        # Low std_dev relative to mean = likely beaconing\n```\n\nKey analysis steps:\n1. Parse Zeek conn.log into DataFrame with ZAT LogToDataFrame\n2. Group connections by source IP and destination IP pairs\n3. Calculate inter-arrival time intervals between consecutive connections\n4. Compute standard deviation and coefficient of variation\n5. Flag pairs with low coefficient of variation as potential beacons\n\n## Examples\n\n```python\nfrom zat.log_to_dataframe import LogToDataFrame\nlog_to_df = LogToDataFrame()\ndf = log_to_df.create_dataframe('conn.log')\nprint(df[['id.orig_h', 'id.resp_h', 'ts', 'duration']].head())\n```\n",{"name":5,"tags":44,"capec":47,"model":48,"tools":49,"domain":29,"maxTurns":53,"nist_csf":54,"subdomain":24,"description":7,"mitre_attack":59},[35,25,45,46],"patterns","with",[],"sonnet",[50,27,51,52],"Read","Glob","Grep",20,[55,56,57,58],"DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02",[60,61,62],"T1059","T1071","T1071.001","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Fcapture\u002Fzeek\u002Fconfigure","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill capture-zeek-configure",{"tool":76,"command":77},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill capture-zeek-configure",{"tool":79,"command":80},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill capture-zeek-configure","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fcapture\u002Fzeek\u002Fconfigure\u002FSKILL.md",true,[84],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"index.json","REFERENCE","参考文档",681,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fcapture\u002Fzeek\u002Fconfigure\u002Findex.json",[91,115,136,157,179,195],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[98,99,100,101,102,103,31,104,105,106,107,108,109,110,111,112,113,29,114],"services","detect","services wmi persistence detect","wmi","persistence","de","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[122,98,123,101,124,125,126,29,27,26,127,128,129,130,103,131,132,133,134,135],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[143,144,145,146,147,148,29,27,149,26,150,151,103,133,152,153,154,155,156,48],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[99,164,165,166,167,168,169,31,170,29,114,171,172,173,174,175,176,177,178,103],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[186,187,99,188,166,168,189,31,190,170,29,114,26,191,192,193,194,178,103,104],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[202,99,166,203,189,31,204,205,29,114,206,207,208,209,210,46,103,104,211,212],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","mismatched","headers"]