Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
mukul975 avatar

Analyzing Network Traffic Of Malware

mukul975/anthropic-cybersecurity-skills

  • 341 installs
  • 27.3k repo stars
  • Updated August 2, 2026
  • mukul975/anthropic-cybersecurity-skills

Analyzing Network Traffic of Malware is an agent skill that structures malware-oriented inspection of network captures and flows.

About

Analyzing Network Traffic of Malware is a specialized agent skill aimed at security-minded solo builders and small teams who need structured help interpreting network captures tied to malicious software. When you already have PCAPs, firewall logs, or proxy flows and need to explain what the malware is doing on the wire, the skill steers the agent toward systematic traffic review rather than guessing from filenames alone. It sits in the Ship phase under security because its value appears when you are validating exposure, hunting lateral movement, or documenting IOCs before you patch or redeploy. The published SKILL excerpt in the catalog is sparse beyond licensing, so treat capabilities as methodology for malware-oriented traffic analysis rather than a turnkey Wireshark automation. Pair it with broader incident response and hardening skills when you move from analysis to fix. Intermediate to advanced users who understand TCP/IP and basic malware lifecycles get the most from it.

  • Frames malware network analysis around capture inspection and suspicious flow triage
  • Supports reasoning about C2 channels, DNS patterns, and exfil paths from traffic artifacts
  • Fits post-incident or threat-research workflows when executable behavior is already suspected
  • Apache 2.0 licensed skill package from a cybersecurity skills collection

Analyzing Network Traffic Of Malware by the numbers

  • 341 all-time installs (skills.sh)
  • +17 installs in the week ending Aug 4, 2026 (Skillselion tracking)
  • Ranked #595 of 2,203 Security skills by installs in the Skillselion catalog
  • Security screen: LOW risk (skills.sh audit)
  • Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-network-traffic-of-malware

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs341
repo stars★ 27.3k
Security audit3 / 3 scanners passed
Last updatedAugust 2, 2026
Repositorymukul975/anthropic-cybersecurity-skills ↗

What it does

Guide an agent through PCAP and flow analysis to characterize malware C2, exfiltration, and beaconing before containment or remediation.

Who is it for?

Best when you're investigating suspected malware with PCAPs or proxy logs and needing agent-guided traffic narrative.

Skip if: Skip if you're without captures or logs and only need generic secure-coding linting—use appsec review skills instead.

When should I use this skill?

You have malware-related network captures or logs and need agent-guided traffic characterization.

What you get

You leave with a documented read on malicious network patterns and clearer next steps for blocking, hunting, or deeper forensics.

  • Narrative of suspicious flows, domains, and ports
  • IOC-oriented notes suitable for blocking or further hunting

Files

SKILL.mdMarkdownGitHub ↗

Analyzing Network Traffic of Malware

When to Use

  • Sandbox execution has captured a PCAP file and the network behavior needs detailed analysis
  • Identifying the C2 protocol structure for writing network detection signatures
  • Determining what data the malware exfiltrates and to which external infrastructure
  • Analyzing DNS tunneling, domain generation algorithms (DGA), or fast-flux behavior
  • Creating Suricata/Snort signatures based on observed malware network patterns

Do not use for host-based analysis of malware behavior; use Cuckoo sandbox reports or Volatility memory analysis for process-level activity.

Prerequisites

  • Wireshark 4.x installed for interactive PCAP analysis
  • tshark (Wireshark CLI) for scripted packet extraction
  • Zeek installed for automated metadata generation from PCAPs
  • Suricata with ET Open/ET Pro rulesets for signature matching
  • NetworkMiner for file extraction and credential detection from PCAPs
  • Python 3.8+ with scapy and dpkt for programmatic packet analysis

Workflow

Step 1: Initial PCAP Overview

Get a high-level understanding of the network traffic:

# Capture statistics
capinfos malware.pcap

# Protocol hierarchy
tshark -r malware.pcap -q -z io,phs

# Endpoint statistics (top talkers)
tshark -r malware.pcap -q -z endpoints,ip

# Conversation statistics
tshark -r malware.pcap -q -z conv,tcp

# DNS query summary
tshark -r malware.pcap -q -z dns,tree

Step 2: Analyze DNS Activity

Examine DNS queries for DGA, tunneling, or C2 domain resolution:

# Extract all DNS queries
tshark -r malware.pcap -T fields -e frame.time -e dns.qry.name -e dns.a \
  -Y "dns.flags.response == 1" | sort

# Detect DGA patterns (high entropy domain names)
python3 << 'PYEOF'
import math
from collections import Counter

def entropy(s):
    p = [n/len(s) for n in Counter(s).values()]
    return -sum(pi * math.log2(pi) for pi in p if pi > 0)

# Parse DNS queries from tshark output
import subprocess
result = subprocess.run(
    ["tshark", "-r", "malware.pcap", "-T", "fields", "-e", "dns.qry.name",
     "-Y", "dns.flags.response == 0"],
    capture_output=True, text=True
)

domains = set(result.stdout.strip().split('\n'))
print("Suspicious DNS queries (high entropy):")
for domain in domains:
    if domain:
        subdomain = domain.split('.')[0]
        ent = entropy(subdomain)
        if ent > 3.5 and len(subdomain) > 10:
            print(f"  {domain} (entropy: {ent:.2f})")
PYEOF

# Detect DNS tunneling (large TXT responses)
tshark -r malware.pcap -T fields -e dns.qry.name -e dns.txt \
  -Y "dns.resp.type == 16 and dns.resp.len > 100"

Step 3: Analyze HTTP/HTTPS C2 Communication

Examine web-based command-and-control traffic:

# Extract HTTP requests
tshark -r malware.pcap -T fields \
  -e frame.time -e ip.src -e ip.dst -e http.host \
  -e http.request.method -e http.request.uri -e http.user_agent \
  -Y "http.request"

# Extract HTTP response bodies (potential payload downloads)
tshark -r malware.pcap -T fields \
  -e http.host -e http.request.uri -e http.content_type -e tcp.len \
  -Y "http.response and tcp.len > 1000"

# Extract POST data (potential exfiltration)
tshark -r malware.pcap -T fields \
  -e http.host -e http.request.uri -e http.file_data \
  -Y "http.request.method == POST"

# TLS analysis (SNI, JA3 fingerprints)
tshark -r malware.pcap -T fields \
  -e tls.handshake.extensions_server_name \
  -e tls.handshake.ja3 \
  -Y "tls.handshake.type == 1"

# Extract TLS certificate details
tshark -r malware.pcap -T fields \
  -e x509ce.dNSName -e x509af.serialNumber \
  -e x509sat.utf8String \
  -Y "tls.handshake.type == 11"

# Export HTTP objects (downloaded files)
tshark -r malware.pcap --export-objects http,exported_files/

Step 4: Detect Beaconing Patterns

Identify regular periodic communication indicating C2 beaconing:

# Beacon detection from PCAP
from scapy.all import rdpcap, IP, TCP
from collections import defaultdict
import statistics

packets = rdpcap("malware.pcap")

# Group connections by destination IP:port
connections = defaultdict(list)
for pkt in packets:
    if IP in pkt and TCP in pkt:
        if pkt[TCP].flags & 0x02:  # SYN flag
            dst = f"{pkt[IP].dst}:{pkt[TCP].dport}"
            connections[dst].append(float(pkt.time))

# Analyze timing intervals for beaconing
print("Beacon Analysis:")
for dst, times in connections.items():
    if len(times) >= 5:
        intervals = [times[i+1] - times[i] for i in range(len(times)-1)]
        avg = statistics.mean(intervals)
        stdev = statistics.stdev(intervals) if len(intervals) > 1 else 0
        jitter = (stdev / avg * 100) if avg > 0 else 0

        if 10 < avg < 3600 and jitter < 30:  # Regular interval with < 30% jitter
            print(f"  [!] {dst}: {len(times)} connections")
            print(f"      Interval: {avg:.1f}s ± {stdev:.1f}s (jitter: {jitter:.1f}%)")
            print(f"      Pattern: LIKELY BEACONING")

Step 5: Generate Network Detection Signatures

Create Suricata/Snort rules from observed traffic patterns:

# Run Suricata against the PCAP for existing signature matches
suricata -r malware.pcap -l suricata_output/ -c /etc/suricata/suricata.yaml

# Review alerts
cat suricata_output/fast.log

# Create custom Suricata rule from observed patterns
cat << 'EOF' > custom_malware.rules
# C2 beacon detection based on observed URI pattern
alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"MALWARE MalwareX C2 Beacon";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"/gate.php?id=";
    http.user_agent; content:"Mozilla/5.0 (compatible; MSIE 10.0)";
    sid:9000001; rev:1;
)

# DNS query for known C2 domain
alert dns $HOME_NET any -> any any (
    msg:"MALWARE MalwareX C2 DNS Query";
    dns.query; content:"update.malicious.com";
    sid:9000002; rev:1;
)

# JA3 hash match for malware TLS client
alert tls $HOME_NET any -> $EXTERNAL_NET any (
    msg:"MALWARE MalwareX JA3 Match";
    ja3.hash; content:"a0e9f5d64349fb13191bc781f81f42e1";
    sid:9000003; rev:1;
)
EOF

Step 6: Extract Files and Artifacts from Traffic

Recover transferred files and embedded data:

# Extract files using Zeek
zeek -r malware.pcap /opt/zeek/share/zeek/policy/frameworks/files/extract-all-files.zeek
ls extract_files/

# Extract files using NetworkMiner (GUI)
# Or use tshark for specific protocol exports
tshark -r malware.pcap --export-objects http,http_objects/
tshark -r malware.pcap --export-objects smb,smb_objects/
tshark -r malware.pcap --export-objects tftp,tftp_objects/

# Hash all extracted files
sha256sum http_objects/* smb_objects/* 2>/dev/null

# Generate Zeek logs for comprehensive metadata
zeek -r malware.pcap
# Output: conn.log, dns.log, http.log, ssl.log, files.log, etc.

Key Concepts

TermDefinition
BeaconingRegular periodic connections from malware to C2 server, identifiable by consistent time intervals and packet sizes
JA3/JA3STLS fingerprinting method creating a hash from ClientHello/ServerHello parameters to uniquely identify malware TLS implementations
DGA (Domain Generation Algorithm)Algorithm generating pseudo-random domain names that malware queries to locate C2 servers, evading static domain blocklists
DNS TunnelingEncoding data in DNS queries and responses to establish a C2 channel or exfiltrate data through DNS infrastructure
Fast FluxDNS technique rapidly rotating IP addresses for a domain to avoid takedown and distribute C2 across many compromised hosts
SNI (Server Name Indication)TLS extension revealing the hostname the client is connecting to; visible even in encrypted HTTPS connections
Network SignatureSuricata/Snort rule matching specific patterns in network traffic (headers, payloads, timing) to detect malicious communications

Tools & Systems

  • Wireshark: Open-source packet analyzer for deep interactive inspection of network traffic at the protocol level
  • Zeek: Network analysis framework generating structured metadata logs (conn, dns, http, ssl) from live or captured traffic
  • Suricata: High-performance network IDS/IPS for signature-based detection with Lua scripting for custom detection logic
  • NetworkMiner: Network forensic analysis tool for extracting files, images, and credentials from PCAP files
  • Scapy: Python packet manipulation library for programmatic packet analysis, beacon detection, and protocol decoding

Common Scenarios

Scenario: Decoding a Custom Binary C2 Protocol

Context: Malware communicates with its C2 server using a custom binary protocol over TCP port 8443. Standard HTTP analysis yields no results. The protocol structure needs to be reverse engineered from the PCAP.

Approach: 1. Filter the PCAP for TCP port 8443 conversations and follow the TCP stream 2. Identify the message framing (length prefix, delimiter, fixed-size headers) 3. Compare multiple messages to identify static header fields vs variable data fields 4. Cross-reference with reverse engineering findings from Ghidra (if the binary was analyzed) 5. Write a Wireshark dissector or Scapy parser for the custom protocol 6. Create Suricata rules matching the static header bytes for network detection 7. Document the full protocol specification for threat intelligence sharing

Pitfalls:

  • Analyzing only the first few packets; some C2 protocols change behavior after initial handshake
  • Not decrypting TLS traffic when the sandbox has MITM capabilities
  • Confusing legitimate CDN or cloud traffic with C2 (validate destination IPs)
  • Missing C2 traffic that uses DNS or ICMP instead of TCP/UDP

Output Format

MALWARE NETWORK TRAFFIC ANALYSIS
===================================
PCAP File:        malware_sandbox.pcap
Duration:         300 seconds
Total Packets:    12,847
Total Bytes:      4.2 MB

DNS ACTIVITY
Total Queries:    47
DGA Detected:     Yes (23 high-entropy queries to .com TLD)
Tunneling:        No
Resolved C2:      update.malicious[.]com -> 185.220.101[.]42

C2 COMMUNICATION
Protocol:         HTTPS (TLS 1.2)
Server:           185.220.101[.]42:443
SNI:              update.malicious[.]com
JA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1
Beacon Interval:  60.2s ± 6.8s (11.3% jitter)
Total Sessions:   237
Data Sent:        147 MB
Data Received:    2.3 MB
Certificate:      CN=update.malicious[.]com (self-signed, expired)

PAYLOAD DOWNLOADS
GET /payload.dll from compromised-site[.]com
  Size: 98,304 bytes
  SHA-256: abc123def456...
  Content-Type: application/octet-stream

EXFILTRATION
Method:           HTTPS POST to /gate.php
Content-Type:     application/octet-stream
Average Size:     15,432 bytes per request
Total Volume:     147 MB over 4 hours

SURICATA ALERTS
[1:2028401] ET MALWARE Generic C2 Beacon Pattern
[1:2028500] ET POLICY Self-Signed Certificate

GENERATED SIGNATURES
SID 9000001: MalwareX HTTP beacon pattern
SID 9000002: MalwareX DNS C2 domain
SID 9000003: MalwareX JA3 TLS fingerprint

Related skills

microsoftEntra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kmicrosoftAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3kxixu-meOpenclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72better-authBetter Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206firebaseFirebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397squirrelscanAudit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85

How it compares

Use for malware traffic interpretation, not as a replacement for endpoint EDR or automated sandbox detonation pipelines.

FAQ

Who is analyzing-network-traffic-of-malware for?

Developers and agents doing security investigations who already have network artifacts and want structured malware traffic analysis.

When should I use analyzing-network-traffic-of-malware?

During Ship security work after an incident or suspicious binary, when validating C2 or exfil in captures before Operate hardening or redeploy.

Is analyzing-network-traffic-of-malware safe to install?

Review the Security Audits panel on this Prism page and the upstream repo before installing; do not run unknown captures on production networks without isolation.

Securityauditappsec
Browse by category
AI & AgentsFrontend & DesignBackend & DataDev ToolsAutomationTesting & ReviewSecurityMonitoring & CloudDocs & Planning
Design & frontend
Design systemsAnimation & motionAccessibility (a11y)CSS & TailwindUI designUXDesign to codeshadcn/uiLanding pagesBest design skills
Most searched skills
find-skillscavemanfrontend-designbrainstormingsystematic-debuggingstop-slopemil-design-engui-ux-pro-maxkarpathy-guidelinesweb-design-guidelinesreact-best-practicesgrill-meimprovemicrosoft-foundryagent-browser
Browse all listings
All agent skillsAll MCP serversAll marketplacesAll plugins

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.