analyzing-rat-command-and-control

Name: analyzing-rat-command-and-control
Author: meltedinhex

18stars5forks

How to install analyzing-rat-command-and-control?

meltedinhex/analyst-ai-pack/analyzing-rat-command-and-control

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-rat-command-and-control

Installs into the current project.

Summary

Analyzes remote access trojan command-and-control by mapping the RAT command set,

Files · 1

View on GitHub

SKILL.md

1	# Analyzing RAT Command and Control
2
3	## When to Use
4
5	- You have a RAT sample and need to map its command set (shell, file ops, screenshot, keylog,
6	webcam, proxy), C2 transport, and beacon parameters.
7	- You are cataloging operator capabilities for detection and impact assessment.
8
9	Do not use this to operate the RAT or connect to its C2 — characterize capabilities from inert
10	static analysis.
11
12	## Prerequisites
13
14	- The RAT sample (read inertly), optionally with an extracted config.
15
16	## Safety & Handling
17
18	- Read bytes statically; defang C2 endpoints; never connect to the C2.
19
20	## Workflow
21
22	### Step 1: Map command handlers and capabilities
23
24	```bash
25	python scripts/analyst.py profile sample.bin
26	```
27
28	Matches command-keyword and API patterns for capability classes: remote shell, file transfer,
29	screenshot/keylog/webcam, persistence, proxy/relay, and self-update.
30
31	### Step 2: Identify the C2 transport
32
33	Detect HTTP(S), raw TCP, TLS, DNS, or messaging-platform transport from imports/strings, plus
34	beacon intervals/user-agents where present.
35
36	### Step 3: Build the capability matrix
37
38	Summarize capabilities and transport, mapping to ATT&CK.
39
40	### Step 4: Defang and report
41
42	Defang endpoints and produce IOCs.
43
44	## Validation
45
46	- Capabilities are grouped into classes with the matched evidence.
47	- The C2 transport is identified from concrete imports/strings.
48	- Findings map to ATT&CK T1219/T1071.
49
50	## Pitfalls
51
52	- Generic API presence (e.g., `gdi32`) misread as screenshot capability — corroborate with command
53	handlers.
54	- Commodity RAT builders sharing strings across families — avoid over-attribution.
55	- Encrypted command sets requiring config decryption first.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the profiler.
60	- ATT&CK T1219 and T1071 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-rat-command-and-control

18stars5forks

View on GitHub

How to install analyzing-rat-command-and-control?

meltedinhex/analyst-ai-pack/analyzing-rat-command-and-control

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-rat-command-and-control

Installs into the current project.

Summary

Analyzes remote access trojan command-and-control by mapping the RAT command set,

Files · 1

View on GitHub

SKILL.md

1	# Analyzing RAT Command and Control
2
3	## When to Use
4
5	- You have a RAT sample and need to map its command set (shell, file ops, screenshot, keylog,
6	webcam, proxy), C2 transport, and beacon parameters.
7	- You are cataloging operator capabilities for detection and impact assessment.
8
9	Do not use this to operate the RAT or connect to its C2 — characterize capabilities from inert
10	static analysis.
11
12	## Prerequisites
13
14	- The RAT sample (read inertly), optionally with an extracted config.
15
16	## Safety & Handling
17
18	- Read bytes statically; defang C2 endpoints; never connect to the C2.
19
20	## Workflow
21
22	### Step 1: Map command handlers and capabilities
23
24	```bash
25	python scripts/analyst.py profile sample.bin
26	```
27
28	Matches command-keyword and API patterns for capability classes: remote shell, file transfer,
29	screenshot/keylog/webcam, persistence, proxy/relay, and self-update.
30
31	### Step 2: Identify the C2 transport
32
33	Detect HTTP(S), raw TCP, TLS, DNS, or messaging-platform transport from imports/strings, plus
34	beacon intervals/user-agents where present.
35
36	### Step 3: Build the capability matrix
37
38	Summarize capabilities and transport, mapping to ATT&CK.
39
40	### Step 4: Defang and report
41
42	Defang endpoints and produce IOCs.
43
44	## Validation
45
46	- Capabilities are grouped into classes with the matched evidence.
47	- The C2 transport is identified from concrete imports/strings.
48	- Findings map to ATT&CK T1219/T1071.
49
50	## Pitfalls
51
52	- Generic API presence (e.g., `gdi32`) misread as screenshot capability — corroborate with command
53	handlers.
54	- Commodity RAT builders sharing strings across families — avoid over-attribution.
55	- Encrypted command sets requiring config decryption first.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the profiler.
60	- ATT&CK T1219 and T1071 (linked in frontmatter).

People who liked this also viewed

6 picks

Type