Skill UI

Use Wireshark to capture and filter live traffic or PCAP files, inspect protocols, follow streams, and generate statistics for incident response, performance tuning, and protocol learning.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

This tool analyzes network packet captures (PCAP) to detect covert communication channels used by malware for Command and Control (C2) and data exfiltration. It specifically focuses on identifying indicators of DNS tunneling, ICMP tunneling, and protocol abuse patterns, providing scoring and detailed reasons for suspicious activity. Useful for threat hunting and security incident investigation.

Utilize the Scapy library in Python to perform deep packet inspection, crafting, sending, and sniffing of various network protocols (TCP, UDP, ICMP, DNS). This skill is essential for analyzing pcap files, implementing advanced security techniques like SYN scans, extracting protocol fields, and detecting network anomalies such as fragmentation or tunneling indicators. Ideal for security researchers, SOC analysts, and penetration testers.

Examines packet captures, Zeek logs, and NetFlow data to uncover C2 channels, lateral movement, and exfiltration during security incidents, guiding analysts through capture, filtering, and IOC extraction workflows.

A comprehensive guide for analyzing PCAP files captured during malware execution. It demonstrates advanced techniques using Wireshark, Zeek, Suricata, and Python (scapy) to identify Command and Control (C2) communications, data exfiltration channels, Domain Generation Algorithms (DGA), and periodic beaconing patterns. Essential for malware reverse engineering and network threat detection.

A comprehensive toolkit designed to automatically extract Indicators of Compromise (IOCs) from malware samples. It harvests critical artifacts including file hashes (MD5, SHA256), network indicators (IPs, domains, URLs), and host artifacts (registry keys, mutexes) using static, dynamic, and PCAP analysis. Essential for threat intelligence, building defense rules (YARA, Snort), and incident response.

This skill provides comprehensive methods to detect Cobalt Strike beacon command-and-control (C2) traffic. It uses advanced network forensics techniques, including analyzing default TLS certificates (e.g., serial 8BB00EE), JA3/JA3S fingerprints, HTTP malleable profiles, and beacon interval jitter, leveraging Zeek logs, Suricata rules, and Python PCAP analysis. It is essential for threat hunters and SOC analysts investigating sophisticated C2 communications.

This tool provides comprehensive network traffic analysis capabilities by querying the Arkime API. Users can search sessions, download PCAPs for forensics, detect sophisticated threats like C2 beaconing (via jitter/interval analysis), spot DNS tunneling patterns, and flag connections to known-bad TLS certificate issuers. Ideal for security assessment and incident investigation.

CAPE is an open-source sandbox derived from Cuckoo, designed for automated dynamic malware analysis. It features advanced behavioral instrumentation, capturing system changes, network traffic (PCAP), and specialized parsers to extract malware configurations (e.g., Emotet, Cobalt Strike). Use this skill for incident response, security assessments, and validating security controls against complex payloads and evasion techniques.

A comprehensive guide for performing deep network forensics using Wireshark and tshark. This technique analyzes raw PCAP/PCAPNG files captured during security incidents to reconstruct network events, identify data exfiltration methods, extract sensitive artifacts (credentials, files), detect Command-and-Control (C2) communications, and pinpoint network indicators of compromise (IOCs). Ideal for digital forensics and incident response teams.