Skill UI

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

Utilize the Scapy library in Python to perform deep packet inspection, crafting, sending, and sniffing of various network protocols (TCP, UDP, ICMP, DNS). This skill is essential for analyzing pcap files, implementing advanced security techniques like SYN scans, extracting protocol fields, and detecting network anomalies such as fragmentation or tunneling indicators. Ideal for security researchers, SOC analysts, and penetration testers.

This skill provides methods for detecting covert data exfiltration channels using DNS tunneling. It analyzes DNS query patterns, including subdomain entropy, query volume anomalies, oversized TXT/CNAME records, and unusual query types, to identify potential data leakage attempts from compromised networks. Ideal for threat hunting and building advanced passive DNS monitoring capabilities.

This skill detects DNS-based data exfiltration by analyzing Zeek dns.log files. It identifies indicators such as high Shannon entropy subdomains, oversized TXT/NULL records, and abnormal query volumes. Use it when investigating suspected DNS tunneling or covert C2 channels to enhance threat detection capabilities.

This tool provides comprehensive network traffic analysis capabilities by querying the Arkime API. Users can search sessions, download PCAPs for forensics, detect sophisticated threats like C2 beaconing (via jitter/interval analysis), spot DNS tunneling patterns, and flag connections to known-bad TLS certificate issuers. Ideal for security assessment and incident investigation.

This skill detects covert data exfiltration occurring over DNS tunnels. It analyzes DNS query names by computing Shannon entropy, examining query length distributions, and identifying high subdomain cardinality. It is essential for security operations, incident response, and proactive threat hunting when suspicious or encoded DNS activity is suspected.

A sophisticated skill for detecting Command and Control (C2) traffic tunneled through DNS protocols. It utilizes advanced techniques like Shannon entropy analysis of subdomains, Machine Learning for DGA classification, and correlation with network logs from Zeek/Suricata. Ideal for SOC analysts and threat hunters investigating data exfiltration, DNS beaconing, or suspicious DNS activity.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.