Skill UI

Parses Cobalt Strike malleable C2 profiles via pyMalleableC2 to pull beacon configs, HTTP communication patterns, sleep/jitter settings, and combines JARM scans for C2 detection when hunting suspected infrastructure or building IDS signatures.

A comprehensive toolset for analyzing Cobalt Strike Malleable C2 profiles. It parses advanced C2 communication configurations to extract crucial Indicators of Compromise (IOCs) such as HTTP headers, DNS settings, URI patterns, and user agents. The analysis is vital for threat hunting, developing network detection signatures (Suricata/Snort), and understanding evasion techniques used by advanced persistent threats (APTs).

A comprehensive guide and toolkit for analyzing malware Command-and-Control (C2) communication. This method helps security analysts reverse engineer network traffic captured from malware samples, identifying beaconing patterns, decoding custom protocols (HTTP, DNS, etc.), and mapping C2 infrastructure for advanced threat detection and threat intelligence gathering.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

A comprehensive tool for detecting and analyzing covert communication channels used by sophisticated malware. It focuses on identifying anomalies in network traffic, such as DNS tunneling, ICMP exfiltration, and steganographic HTTP abuse, which are used for Command and Control (C2) communication and data exfiltration. Ideal for security incident response, threat hunting, and building advanced network detection rules.

This tool parses NetFlow v9 and IPFIX records to conduct deep network security analysis. It is crucial for investigating security incidents by building traffic baselines and applying statistical methods. Key detection capabilities include identifying port scanning, data exfiltration attempts, command and control (C2) beaconing patterns, and general volumetric anomalies in network traffic.

Examines packet captures, Zeek logs, and NetFlow data to uncover C2 channels, lateral movement, and exfiltration during security incidents, guiding analysts through capture, filtering, and IOC extraction workflows.

A comprehensive guide for analyzing PCAP files captured during malware execution. It demonstrates advanced techniques using Wireshark, Zeek, Suricata, and Python (scapy) to identify Command and Control (C2) communications, data exfiltration channels, Domain Generation Algorithms (DGA), and periodic beaconing patterns. Essential for malware reverse engineering and network threat detection.

This comprehensive skill analyzes Zeek conn.log and NetFlow data to proactively detect advanced indicators of ransomware activity. It identifies critical threats such as Command and Control (C2) beaconing patterns, connections to TOR exit nodes, large-scale data exfiltration flows, and suspicious DNS anomalies. It is essential for threat hunting and complex security incident response.

This system automates the tracking and mapping of threat actor Command-and-Control (C2) networks. By leveraging passive DNS records, WHOIS data, certificate transparency logs, and IP enrichment, it helps security analysts perform infrastructure pivoting. It identifies shared hosting patterns, monitors domain reuse, and continuously maps adversary relationships for proactive threat intelligence.

This comprehensive guide details how to deploy and configure a resilient Command and Control (C2) infrastructure using the advanced Sliver framework. It covers setting up multi-protocol listeners (HTTPS, mTLS, DNS, WireGuard), implementing complex redirectors, domain fronting, and establishing operational security controls for professional red team engagements and advanced security assessments.

This guide provides a comprehensive walkthrough for deploying and configuring a production-grade Command and Control (C2) infrastructure using the open-source Havoc framework. It covers setting up the Teamserver, configuring secure HTTPS listeners, implementing redirectors (e.g., Nginx), and deploying Demon agents for advanced post-exploitation red team operations. This skill is essential for authorized security assessments and building robust defensive countermeasures.