Skill UI

This skill provides a systematic methodology for detecting Command and Control (C2) beaconing patterns in network traffic. It utilizes advanced statistical techniques, including Coefficient of Variation (CV) and jitter analysis, applied to network flow logs (Zeek, proxy, firewall). It is crucial for proactive threat hunting and incident response to identify compromised endpoints communicating periodically with malicious infrastructure.

This skill detects domain fronting, an advanced technique used by attackers to mask Command and Control (C2) traffic. It analyzes proxy/web gateway logs for mismatches between the TLS SNI field and the HTTP Host header, combined with deep TLS certificate inspection using pyOpenSSL. This is crucial for security teams investigating sophisticated network threats and validating detection coverage.

This guide outlines a mandatory, evidence-based protocol for declaring any work complete, fixing a bug, or submitting a pull request. It strictly mandates that all claims of success must be supported by fresh, verifiable evidence, such as passing test outputs, successful build logs, or comprehensive checklist verification. It eliminates reliance on assumptions, gut feelings, or trusting proxy reports.

This comprehensive bundle collects all necessary diagnostic information for Bright Data troubleshooting. It captures proxy connectivity details, zone status, response headers, and relevant error logs. Use this tool when encountering persistent connectivity issues or when preparing a detailed technical support ticket for Bright Data support.