capturing-and-analyzing-malware-network-traffic

Name: capturing-and-analyzing-malware-network-traffic
Author: meltedinhex

18stars5forks

How to install capturing-and-analyzing-malware-network-traffic?

meltedinhex/analyst-ai-pack/capturing-and-analyzing-malware-network-traffic

$npx -y skills add meltedinhex/analyst-ai-pack --skill capturing-and-analyzing-malware-network-traffic

Installs into the current project.

Summary

Captures and analyzes malware network traffic from a detonation: extracting C2

Files · 1

View on GitHub

SKILL.md

1	# Capturing and Analyzing Malware Network Traffic
2
3	## When to Use
4
5	- You detonated a sample and captured a PCAP on the services guest, and need to extract its
6	network behavior.
7	- You want C2 endpoints, HTTP/DNS patterns, TLS SNI/JA3, and beaconing intervals.
8	- You are turning traffic observations into network IOCs and detection signatures.
9
10	Do not use a single capture as the full C2 picture — staged samples reveal more on longer
11	runs or with the right context. Combine with binary config extraction.
12
13	## Prerequisites
14
15	- A PCAP captured from the isolated lab (capture on the analysis guest, not the victim).
16	- `tshark`/Wireshark, or Zeek for connection logs, or the bundled PCAP summarizer.
17	- The lab's simulated-internet IP so you can separate sample traffic from noise.
18
19	## Safety & Handling
20
21	- Capture from the services/analysis guest so the victim never hosts a sniffer.
22	- Defang all extracted domains/IPs/URLs before sharing.
23
24	## Workflow
25
26	### Step 1: Get a connection overview
27
28	Summarize conversations and protocols to see who talks to whom and how often:
29
30	```bash
31	python scripts/analyst.py summarize capture.pcap
32	```
33
34	### Step 2: Analyze DNS
35
36	List queried domains and resolved IPs. Look for DGA-like randomness, repeated NXDOMAIN, and
37	long TXT records (possible tunneling).
38
39	### Step 3: Inspect HTTP/HTTPS
40
41	For HTTP, examine URIs, methods, User-Agent (often unique/odd), and POST bodies. For HTTPS,
42	extract SNI and JA3/JA3S fingerprints since payloads are encrypted.
43
44	### Step 4: Detect beaconing
45
46	Compute inter-arrival times to the same destination. Regular intervals (with jitter) to one
47	host indicate C2 check-ins.
48
49	### Step 5: Build IOCs and detection
50
51	Produce a network IOC set (domains, IPs, URIs, JA3, User-Agent) and hand candidate signatures
52	to the Suricata/Zeek detection workflow.
53
54	## Validation
55
56	- Beaconing intervals are consistent and tied to a specific destination, not random browsing.
57	- Extracted SNI/JA3 reproduce across runs of the same sample.
58	- DNS and HTTP observations corroborate the C2 endpoints found in the binary's config.
59
60	## Pitfalls
61
62	- Mistaking simulated-internet responses for real C2 behavior; know your lab's IPs.
63	- Ignoring HTTPS because it is encrypted — SNI, JA3, and timing are still strong signals.
64	- Treating one short capture as complete; some C2 only beacons periodically.
65
66	## References
67
68	- See [`references/api-reference.md`](references/api-reference.md) for the PCAP summarizer and
69	beaconing detector.
70	- Wireshark and Zeek documentation (linked in frontmatter).

People who liked this also viewed

6 picks

Type

capturing-and-analyzing-malware-network-traffic

18stars5forks

View on GitHub

How to install capturing-and-analyzing-malware-network-traffic?

meltedinhex/analyst-ai-pack/capturing-and-analyzing-malware-network-traffic

$npx -y skills add meltedinhex/analyst-ai-pack --skill capturing-and-analyzing-malware-network-traffic

Installs into the current project.

Summary

Captures and analyzes malware network traffic from a detonation: extracting C2

Files · 1

View on GitHub

SKILL.md

1	# Capturing and Analyzing Malware Network Traffic
2
3	## When to Use
4
5	- You detonated a sample and captured a PCAP on the services guest, and need to extract its
6	network behavior.
7	- You want C2 endpoints, HTTP/DNS patterns, TLS SNI/JA3, and beaconing intervals.
8	- You are turning traffic observations into network IOCs and detection signatures.
9
10	Do not use a single capture as the full C2 picture — staged samples reveal more on longer
11	runs or with the right context. Combine with binary config extraction.
12
13	## Prerequisites
14
15	- A PCAP captured from the isolated lab (capture on the analysis guest, not the victim).
16	- `tshark`/Wireshark, or Zeek for connection logs, or the bundled PCAP summarizer.
17	- The lab's simulated-internet IP so you can separate sample traffic from noise.
18
19	## Safety & Handling
20
21	- Capture from the services/analysis guest so the victim never hosts a sniffer.
22	- Defang all extracted domains/IPs/URLs before sharing.
23
24	## Workflow
25
26	### Step 1: Get a connection overview
27
28	Summarize conversations and protocols to see who talks to whom and how often:
29
30	```bash
31	python scripts/analyst.py summarize capture.pcap
32	```
33
34	### Step 2: Analyze DNS
35
36	List queried domains and resolved IPs. Look for DGA-like randomness, repeated NXDOMAIN, and
37	long TXT records (possible tunneling).
38
39	### Step 3: Inspect HTTP/HTTPS
40
41	For HTTP, examine URIs, methods, User-Agent (often unique/odd), and POST bodies. For HTTPS,
42	extract SNI and JA3/JA3S fingerprints since payloads are encrypted.
43
44	### Step 4: Detect beaconing
45
46	Compute inter-arrival times to the same destination. Regular intervals (with jitter) to one
47	host indicate C2 check-ins.
48
49	### Step 5: Build IOCs and detection
50
51	Produce a network IOC set (domains, IPs, URIs, JA3, User-Agent) and hand candidate signatures
52	to the Suricata/Zeek detection workflow.
53
54	## Validation
55
56	- Beaconing intervals are consistent and tied to a specific destination, not random browsing.
57	- Extracted SNI/JA3 reproduce across runs of the same sample.
58	- DNS and HTTP observations corroborate the C2 endpoints found in the binary's config.
59
60	## Pitfalls
61
62	- Mistaking simulated-internet responses for real C2 behavior; know your lab's IPs.
63	- Ignoring HTTPS because it is encrypted — SNI, JA3, and timing are still strong signals.
64	- Treating one short capture as complete; some C2 only beacons periodically.
65
66	## References
67
68	- See [`references/api-reference.md`](references/api-reference.md) for the PCAP summarizer and
69	beaconing detector.
70	- Wireshark and Zeek documentation (linked in frontmatter).

People who liked this also viewed

6 picks

Type