Download

Skill UI

Browse and discover 6252+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search C2 Detection , found 12 results

Default Newest Most Downloaded

Cobalt Strike Profile Analysis

analyzing-cobalt-strike-malleable-profiles

mukul975/Anthropic-Cybersecurity-Skills

Parses Cobalt Strike malleable C2 profiles via pyMalleableC2 to pull beacon configs, HTTP communication patterns, sleep/jitter settings, and combines JARM scans for C2 detection when hunting suspected infrastructure or building IDS signatures.

Cobalt Strike Profile Analysis

analyzing-cobaltstrike-malleable-c2-profiles

mukul975/Anthropic-Cybersecurity-Skills

Parse and analyze Cobalt Strike Malleable C2 profiles to extract HTTP transformations, indicator data, and process behaviors, enabling SOC analysts and threat hunters to generate structured detection rules and validate monitoring coverage.

Command-and-Control Analysis

analyzing-command-and-control-communication

mukul975/Anthropic-Cybersecurity-Skills

Analyzes malware command-and-control (C2) communication by profiling protocols, beaconing behavior, and payload structure to inform detection, reverse engineering, and threat intelligence workflows.

DNS Exfiltration Detection

analyzing-dns-logs-for-exfiltration

mukul975/Anthropic-Cybersecurity-Skills

Scans DNS query logs within SIEM platforms to flag data exfiltration by spotting suspicious tunneling subdomains, high-entropy DGA-style domains, and abnormal query volumes, helping SOC teams uncover DNS-based threats evading standard controls.

NetFlow-Based Traffic Analysis

analyzing-network-flow-data-with-netflow

mukul975/Anthropic-Cybersecurity-Skills

Parse NetFlow v9 and IPFIX records via Python to spot volumetric anomalies, port scans, exfiltration, and C2 beaconing, helping SOC analysts tune detections and validate monitoring coverage with statistical baselines and reports.

Malware Network Traffic Analysis

analyzing-network-traffic-of-malware

mukul975/Anthropic-Cybersecurity-Skills

Analyzes malware-generated network traffic from sandbox or incident captures using Wireshark, Zeek, and Suricata to highlight C2 protocols, data exfiltration paths, lateral movement hints, and detection signature opportunities.

Zeek Beaconing Detection

detecting-beaconing-patterns-with-zeek

mukul975/Anthropic-Cybersecurity-Skills

Analyzes Zeek conn.log intervals with ZAT and NumPy to flag low-jitter, periodic connections typical of C2 beaconing, helping SOC teams hunt callbacks with statistical rigor.

GuardDuty Cloud Threat Detection

detecting-cloud-threats-with-guardduty

mukul975/Anthropic-Cybersecurity-Skills

Guides security teams through deploying Amazon GuardDuty with protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting findings, and wiring EventBridge plus Lambda for automated responses across AWS accounts.

Cloud Cryptomining Detection

detecting-cryptomining-in-cloud

mukul975/Anthropic-Cybersecurity-Skills

Guides security teams through identifying unauthorized cloud cryptomining by correlating cost anomalies, GuardDuty crypto findings, network traffic to mining pools, and runtime process hooks across EC2, ECS, EKS, and Azure workloads.

Domain Fronting Detection

hunting-for-domain-fronting-c2-traffic

mukul975/Anthropic-Cybersecurity-Skills

Detect domain fronting C2 traffic by correlating proxy SNI vs HTTP Host mismatches, TLS certificate issuers, and CDN IP ranges, then scoring alerts for MITRE ATT&CK T1090.004 investigations.

Cloud Workload Protection

implementing-cloud-workload-protection

mukul975/Anthropic-Cybersecurity-Skills

Implements cloud workload protection using boto3 and google-cloud APIs for runtime monitoring, anomaly detection, file integrity checks, and resource audits to hunt cryptominers, reverse shells, and unauthorized binaries on EC2 and GCE workloads.

DNS C2 Detection

detecting-command-and-control-over-dns

mukul975/Anthropic-Cybersecurity-Skills

Detects DNS-based command-and-control activity by analyzing query logs, entropy, ML-driven DGA classification, and signature rules to uncover tunneling, beaconing, and encoded payload delivery in SOC environments.

1

Language