Skill UI

Examines packet captures, Zeek logs, and NetFlow data to uncover C2 channels, lateral movement, and exfiltration during security incidents, guiding analysts through capture, filtering, and IOC extraction workflows.

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

This skill provides a systematic methodology for detecting Command and Control (C2) beaconing patterns in network traffic. It utilizes advanced statistical techniques, including Coefficient of Variation (CV) and jitter analysis, applied to network flow logs (Zeek, proxy, firewall). It is crucial for proactive threat hunting and incident response to identify compromised endpoints communicating periodically with malicious infrastructure.

Zeek is a powerful, open-source network security monitoring framework that generates high-fidelity structured logs and metadata from raw network traffic. This skill covers deploying Zeek, analyzing various protocol logs (HTTP, DNS, TLS, etc.), writing custom detection scripts to identify anomalies, and integrating resulting security insights with SIEM platforms for comprehensive threat detection and forensic investigation.