08-network-security

Name: 08-network-security
Author: Masriyan

190stars37forks

How to install 08-network-security?

masriyan/claude-code-cybersecurity-skill/08-network-security

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 08-network-security

Installs into the current project.

Summary

Network traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection

Files · 1

View on GitHub

SKILL.md

1	# Network Security & Traffic Analysis
2
3	## Purpose
4
5	Enable Claude to assist with network security operations including traffic analysis from PCAP files, IDS/IPS rule authoring for Snort and Suricata, firewall rule auditing, network anomaly detection, and network architecture security reviews.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Analyzing PCAP or PCAPNG files for suspicious activity
13	- Creating Snort or Suricata detection rules
14	- Writing Zeek (Bro) scripts for network analysis
15	- Reviewing firewall rules (iptables, nftables, pf, cloud security groups)
16	- Detecting C2 beaconing, DNS tunneling, or data exfiltration in network traffic
17	- Network architecture security review
18	- IDS/IPS signature development
19	- Network segmentation and east-west traffic analysis
20	- TLS inspection and certificate analysis
21
22	---
23
24	## Prerequisites
25
26	```bash
27	pip install scapy dpkt requests
28	```
29
30	Recommended tools:
31	- `Wireshark / tshark` — Packet capture and GUI analysis
32	- `Suricata` — Modern IDS/IPS engine
33	- `Snort 3` — Classic IDS/IPS engine
34	- `Zeek (Bro)` — Network analysis and scripting framework
35	- `tcpdump` — Command-line packet capture
36	- `NetworkMiner` — PCAP artifact extraction
37	- `nmap` — Network scanning and discovery
38
39	---
40
41	## Core Capabilities
42
43	### 1. PCAP Traffic Analysis
44
45	When the user provides a PCAP file or asks to analyze network traffic:
46
47	```bash
48	# Quick summary with tshark
49	tshark -r capture.pcap -q -z io,phs # Protocol hierarchy
50	tshark -r capture.pcap -q -z conv,tcp # TCP conversations
51	tshark -r capture.pcap -q -z endpoints,ip # IP endpoints
52
53	# Extract HTTP requests
54	tshark -r capture.pcap -Y http.request -T fields -e ip.src -e http.host -e http.request.uri
55
56	# Extract DNS queries
57	tshark -r capture.pcap -Y dns.flags.response==0 -T fields -e ip.src -e dns.qry.name
58
59	# Extract files
60	tshark -r capture.pcap --export-objects http,./extracted_files/
61	tshark -r capture.pcap --export-objects smb,./smb_files/
62
63	# Run automated analysis
64	python scripts/pcap_analyzer.py --file capture.pcap --output analysis.json
65	python scripts/pcap_analyzer.py --file traffic.pcapng --dns --http --top-talkers 20
66	```
67
68	Traffic Analysis Checklist:
69	```
70	[ ] Protocol distribution — any unexpected protocols?
71	[ ] Top talkers — unusual source/destination combinations
72	[ ] DNS analysis — DGA domains, unusually long queries, high volume
73	[ ] HTTP analysis — suspicious user agents, unusual methods, encoded data
74	[ ] TLS analysis — invalid certificates, unusual SNI, cert fingerprints
75	[ ] ICMP analysis — large payloads (tunneling), ping sweeps
76	[ ] SMB analysis — authentication attempts, file access patterns
77	[ ] Data volume — large uploads (exfiltration?), irregular transfer sizes
78	[ ] Timing analysis — regular interval beaconing patterns
79	```
80
81	Beaconing Detection:
82	Beaconing shows as consistent time intervals between outbound connections:
83	```bash
84	# tshark: extract connection timestamps to check for regularity
85	tshark -r capture.pcap -Y "ip.dst == 203.0.113.10 and tcp.flags.syn==1" \
86	-T fields -e frame.time_epoch \| \
87	awk 'NR>1{printf "%.0f\n", ($1-prev)} {prev=$1}' \| sort \| uniq -c \| sort -rn
88	# Consistent counts at specific intervals = beaconing
89	```
90
91	DNS Tunneling Detection:
92	```bash
93	# Long DNS query names (>50 chars for subdomain) = likely tunneling
94	tshark -r capture.pcap -Y "dns.qry.name.len > 50" \
95	-T fields -e ip.src -e dns.qry.name \| head -50
96
97	# High-volume DNS to single domain = tunneling
98	tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name \| \
99	awk -F. '{print $(NF-1)"."$NF}' \| sort \| uniq -c \| sort -rn \| head -20
100	```
101
102	### 2. Suricata Rule Creation
103
104	When the user asks to create Suricata IDS rules:
105
106	Suricata Rule Syntax Reference:
107	```
108	action protocol src_ip src_port -> dst_ip dst_port (options)
109	```
110
111	Rule Templates:
112
113	```suricata
114	# Template: C2 Beaconing over HTTP
115	alert http $HOME_NET any -> $EXTERNAL_NET any (
116	msg:"MALWARE Suspicious C2 Beacon - Regular Interval HTTP POST";
117	flow:established,to_server;
118	http.method; content:"POST";
119	http.uri; content:"/api/check" endswith;
120	http.header; content:"User-Agent: Mozilla/4.0 (compatible)";
121	threshold:type both, track by_src, count 5, seconds 300;
122	classtype:trojan-activity;
123	sid:9000001;
124	rev:1;
125	metadata:affected_product Windows_XP_Vista_7_8_10_Server, attack_target Client_Endpoint,
126	created_at 2025_05_28, deployment Perimeter;
127	)
128
129	# Template: DNS Tunneling Detection
130	alert dns $HOME_NET any -> any any (
131	msg:"POLICY Possible DNS Tunneling - Long Subdomain Query";
132	dns.query;
133	content:".";
134	byte_test:1,>,50,0,relative; # Query length > 50 chars
135	threshold:typ

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

08-network-security

190stars37forks

View on GitHub

How to install 08-network-security?

masriyan/claude-code-cybersecurity-skill/08-network-security

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 08-network-security

Installs into the current project.

Summary

Network traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection

Files · 1

View on GitHub

SKILL.md

1	# Network Security & Traffic Analysis
2
3	## Purpose
4
5	Enable Claude to assist with network security operations including traffic analysis from PCAP files, IDS/IPS rule authoring for Snort and Suricata, firewall rule auditing, network anomaly detection, and network architecture security reviews.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Analyzing PCAP or PCAPNG files for suspicious activity
13	- Creating Snort or Suricata detection rules
14	- Writing Zeek (Bro) scripts for network analysis
15	- Reviewing firewall rules (iptables, nftables, pf, cloud security groups)
16	- Detecting C2 beaconing, DNS tunneling, or data exfiltration in network traffic
17	- Network architecture security review
18	- IDS/IPS signature development
19	- Network segmentation and east-west traffic analysis
20	- TLS inspection and certificate analysis
21
22	---
23
24	## Prerequisites
25
26	```bash
27	pip install scapy dpkt requests
28	```
29
30	Recommended tools:
31	- `Wireshark / tshark` — Packet capture and GUI analysis
32	- `Suricata` — Modern IDS/IPS engine
33	- `Snort 3` — Classic IDS/IPS engine
34	- `Zeek (Bro)` — Network analysis and scripting framework
35	- `tcpdump` — Command-line packet capture
36	- `NetworkMiner` — PCAP artifact extraction
37	- `nmap` — Network scanning and discovery
38
39	---
40
41	## Core Capabilities
42
43	### 1. PCAP Traffic Analysis
44
45	When the user provides a PCAP file or asks to analyze network traffic:
46
47	```bash
48	# Quick summary with tshark
49	tshark -r capture.pcap -q -z io,phs # Protocol hierarchy
50	tshark -r capture.pcap -q -z conv,tcp # TCP conversations
51	tshark -r capture.pcap -q -z endpoints,ip # IP endpoints
52
53	# Extract HTTP requests
54	tshark -r capture.pcap -Y http.request -T fields -e ip.src -e http.host -e http.request.uri
55
56	# Extract DNS queries
57	tshark -r capture.pcap -Y dns.flags.response==0 -T fields -e ip.src -e dns.qry.name
58
59	# Extract files
60	tshark -r capture.pcap --export-objects http,./extracted_files/
61	tshark -r capture.pcap --export-objects smb,./smb_files/
62
63	# Run automated analysis
64	python scripts/pcap_analyzer.py --file capture.pcap --output analysis.json
65	python scripts/pcap_analyzer.py --file traffic.pcapng --dns --http --top-talkers 20
66	```
67
68	Traffic Analysis Checklist:
69	```
70	[ ] Protocol distribution — any unexpected protocols?
71	[ ] Top talkers — unusual source/destination combinations
72	[ ] DNS analysis — DGA domains, unusually long queries, high volume
73	[ ] HTTP analysis — suspicious user agents, unusual methods, encoded data
74	[ ] TLS analysis — invalid certificates, unusual SNI, cert fingerprints
75	[ ] ICMP analysis — large payloads (tunneling), ping sweeps
76	[ ] SMB analysis — authentication attempts, file access patterns
77	[ ] Data volume — large uploads (exfiltration?), irregular transfer sizes
78	[ ] Timing analysis — regular interval beaconing patterns
79	```
80
81	Beaconing Detection:
82	Beaconing shows as consistent time intervals between outbound connections:
83	```bash
84	# tshark: extract connection timestamps to check for regularity
85	tshark -r capture.pcap -Y "ip.dst == 203.0.113.10 and tcp.flags.syn==1" \
86	-T fields -e frame.time_epoch \| \
87	awk 'NR>1{printf "%.0f\n", ($1-prev)} {prev=$1}' \| sort \| uniq -c \| sort -rn
88	# Consistent counts at specific intervals = beaconing
89	```
90
91	DNS Tunneling Detection:
92	```bash
93	# Long DNS query names (>50 chars for subdomain) = likely tunneling
94	tshark -r capture.pcap -Y "dns.qry.name.len > 50" \
95	-T fields -e ip.src -e dns.qry.name \| head -50
96
97	# High-volume DNS to single domain = tunneling
98	tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name \| \
99	awk -F. '{print $(NF-1)"."$NF}' \| sort \| uniq -c \| sort -rn \| head -20
100	```
101
102	### 2. Suricata Rule Creation
103
104	When the user asks to create Suricata IDS rules:
105
106	Suricata Rule Syntax Reference:
107	```
108	action protocol src_ip src_port -> dst_ip dst_port (options)
109	```
110
111	Rule Templates:
112
113	```suricata
114	# Template: C2 Beaconing over HTTP
115	alert http $HOME_NET any -> $EXTERNAL_NET any (
116	msg:"MALWARE Suspicious C2 Beacon - Regular Interval HTTP POST";
117	flow:established,to_server;
118	http.method; content:"POST";
119	http.uri; content:"/api/check" endswith;
120	http.header; content:"User-Agent: Mozilla/4.0 (compatible)";
121	threshold:type both, track by_src, count 5, seconds 300;
122	classtype:trojan-activity;
123	sid:9000001;
124	rev:1;
125	metadata:affected_product Windows_XP_Vista_7_8_10_Server, attack_target Client_Endpoint,
126	created_at 2025_05_28, deployment Perimeter;
127	)
128
129	# Template: DNS Tunneling Detection
130	alert dns $HOME_NET any -> any any (
131	msg:"POLICY Possible DNS Tunneling - Long Subdomain Query";
132	dns.query;
133	content:".";
134	byte_test:1,>,50,0,relative; # Query length > 50 chars
135	threshold:typ

People who liked this also viewed

6 picks

Type