Skill UI

Use Wireshark to capture and filter live traffic or PCAP files, inspect protocols, follow streams, and generate statistics for incident response, performance tuning, and protocol learning.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

This skill guides users through advanced network security analysis using Scapy. It covers crafting, sending, sniffing, and dissecting various network packets (TCP/UDP/ICMP), analyzing pcap files, and detecting anomalies like SYN floods or DNS exfiltration. Ideal for SOC analysts, forensic investigators, and security researchers.

Examines packet captures, Zeek logs, and NetFlow data to uncover C2 channels, lateral movement, and exfiltration during security incidents, guiding analysts through capture, filtering, and IOC extraction workflows.

A comprehensive guide for analyzing PCAP files captured during malware execution. It demonstrates advanced techniques using Wireshark, Zeek, Suricata, and Python (scapy) to identify Command and Control (C2) communications, data exfiltration channels, Domain Generation Algorithms (DGA), and periodic beaconing patterns. Essential for malware reverse engineering and network threat detection.

This skill provides a comprehensive workflow to extract Indicators of Compromise (IOCs) from malware samples and analysis reports. It covers file hashes (SHA256, MD5), network artifacts (IPs, domains, URLs from strings and PCAPs), and host-based indicators (registry keys, file paths, mutexes) from sandbox reports. It is essential for threat intelligence sharing, building blocklists, and creating detection signatures (YARA, Snort).

This skill guides threat hunters in detecting Cobalt Strike Command and Control (C2) beacons. It utilizes advanced network forensic techniques, including analyzing default TLS certificate serials, JA3/JA3S/JARM fingerprints, beacon jitter, and HTTP profile matching. Detection is achieved by correlating data from Zeek logs, Suricata rules, and Python PCAP analysis to identify suspicious outbound communications.

This skill details the deployment and advanced querying techniques for Arkime (Moloch), enabling comprehensive full packet capture network traffic analysis. Users can leverage the Arkime API v3 to search connections, download PCAPs, detect sophisticated C2 beaconing, and analyze connection patterns and anomalies across DNS, HTTP, and TLS traffic. Essential for security monitoring and network forensics.

This comprehensive guide details a professional workflow for performing network forensics using Wireshark and tshark. Learn how to analyze captured PCAP files to identify malicious communications, reconstruct data exfiltration, extract crucial artifacts (HTTP, SMB, DICOM), and detect indicators of compromise (IOCs). Essential for incident response and malware analysis.

A comprehensive guide and toolkit for performing digital forensic analysis on network packet captures (PCAP/PCAPNG). It details techniques using Wireshark, tshark, and tcpdump to reconstruct communications, extract sensitive data, identify malicious C2 traffic, and establish irrefutable evidence of security breaches or data exfiltration.

This skill automates deep packet capture (PCAP) analysis using tshark and pyshark. It is invaluable for security assessments and incident response, enabling the extraction of protocol statistics, identification of suspicious network flows (e.g., port scanning, beaconing), and comprehensive extraction of Indicators of Compromise (IOCs), including IPs, domains, and URLs. It also specializes in detecting complex anomalies like DNS tunneling.