[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADQX49Z6AAMY1KXJNNDR9R":3,"skill-same:01M6ADQX49Z6AAMY1KXJNNDR9R":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6ADQX49Z6AAMY1KXJNNDR9R","analyzing-network-traffic-for-incidents",null,"Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-for-incidents\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"network","analyzing network traffic for incidents","analyzing","c2","command-and-control","exfiltration","incident-response","network-forensics","forensics","security","flow","data","pcap","traffic-analysis","PCAP-analysis","Wireshark","Zeek","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-network-traffic-for-incidents\ndescription: 'Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including\n  command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek,\n  and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation,\n  PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.\n\n  '\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- network-forensics\n- PCAP-analysis\n- Wireshark\n- Zeek\n- traffic-analysis\nmitre_attack:\n- T1071\n- T1095\n- T1573\n- T1572\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\n---\n\n# Analyzing Network Traffic for Incidents\n\n## When to Use\n\n- SIEM alerts on anomalous network traffic patterns requiring deeper investigation\n- C2 beaconing is suspected and needs confirmation through packet-level analysis\n- Data exfiltration volume or destination must be quantified from network evidence\n- Lateral movement between systems needs to be traced through network connections\n- An IDS\u002FIPS alert requires packet-level validation to confirm or dismiss\n\n**Do not use** for host-based forensic analysis (process execution, file system artifacts); use endpoint forensics tools instead.\n\n## Prerequisites\n\n- Full packet capture (PCAP) infrastructure or on-demand capture capability (network tap, SPAN port)\n- Wireshark installed on the analysis workstation with appropriate display filters knowledge\n- Zeek (formerly Bro) deployed for network metadata generation (conn.log, dns.log, http.log, ssl.log)\n- NetFlow\u002FIPFIX collection from network devices for traffic flow analysis\n- Network architecture diagram showing VLAN layout, firewall placement, and monitoring points\n- Threat intelligence feeds for correlating observed network indicators\n\n## Workflow\n\n### Step 1: Capture or Acquire Network Traffic\n\nObtain the relevant traffic data for the investigation:\n\n**Live Capture (if incident is active):**\n```bash\n# Capture on specific interface filtering by host\ntcpdump -i eth0 -w capture.pcap host 10.1.5.42\n\n# Capture C2 traffic to specific external IP\ntcpdump -i eth0 -w c2_traffic.pcap host 185.220.101.42\n\n# Capture with rotation (1GB files, keep 10)\ntcpdump -i eth0 -w capture_%Y%m%d%H%M.pcap -C 1000 -W 10\n```\n\n**From Existing Infrastructure:**\n- Export PCAP from full packet capture appliance (Arkime\u002FMoloch, ExtraHop, Corelight)\n- Pull Zeek logs from the Zeek cluster for the investigation timeframe\n- Export NetFlow data from network devices for high-level traffic analysis\n\n### Step 2: Identify C2 Communications\n\nDetect command-and-control traffic patterns:\n\n**Beaconing Detection (Zeek conn.log):**\n```bash\n# Extract connections to external IPs with regular intervals\ncat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes \\\n  | awk '$4 ~ \u002F^185\\.220\u002F' | sort -t. -k1,1n -k2,2n\n```\n\n**Wireshark Beacon Analysis:**\n```\n# Filter for traffic to suspected C2 IP\nip.addr == 185.220.101.42\n\n# Filter HTTPS traffic to non-standard ports\ntcp.port != 443 && ssl\n\n# Filter DNS queries for suspicious domains\ndns.qry.name contains \"evil\" or dns.qry.name matches \"^[a-z0-9]{32}\\.\"\n\n# Filter HTTP POST (common C2 check-in method)\nhttp.request.method == \"POST\" && ip.dst == 185.220.101.42\n```\n\nBeaconing characteristics to identify:\n- Regular time intervals between connections (e.g., every 60 seconds with 10-15% jitter)\n- Consistent packet sizes in requests and responses\n- HTTPS to external IPs not associated with legitimate CDNs or services\n- DNS queries with high entropy subdomains (DNS tunneling indicator)\n\n### Step 3: Analyze Lateral Movement Traffic\n\nTrace adversary movement between internal systems:\n\n```\nKey protocols for lateral movement detection:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nSMB (TCP 445):     PsExec, file share access, ransomware propagation\nRDP (TCP 3389):    Remote desktop sessions\nWinRM (TCP 5985):  PowerShell remoting\nWMI (TCP 135):     Remote command execution\nSSH (TCP 22):      Linux lateral movement\nDCE\u002FRPC (TCP 135): DCOM-based lateral movement\n```\n\n**Wireshark Filters for Lateral Movement:**\n```\n# SMB lateral movement\nsmb2 && ip.src == 10.1.5.42 && ip.dst != 10.1.5.42\n\n# RDP connections from compromised host\ntcp.dstport == 3389 && ip.src == 10.1.5.42\n\n# Kerberos ticket requests (potential pass-the-ticket)\nkerberos.msg_type == 12 && ip.src == 10.1.5.42\n\n# NTLM authentication (potential pass-the-hash)\nntlmssp.auth.username && ip.src == 10.1.5.42\n```\n\n### Step 4: Detect Data Exfiltration\n\nIdentify unauthorized data transfers leaving the network:\n\n```\n# Identify large outbound transfers in Zeek conn.log\ncat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p orig_bytes \\\n  | awk '$5 > 100000000' | sort -t$'\\t' -k5 -rn\n\n# DNS tunneling detection (high volume of TXT queries)\ncat dns.log | zeek-cut query qtype | grep TXT | cut -f1 \\\n  | rev | cut -d. -f1,2 | rev | sort | uniq -c | sort -rn | head\n\n# Unusual protocol usage (ICMP tunneling, DNS over HTTPS)\ncat conn.log | zeek-cut proto id.resp_p orig_bytes | awk '$1 == \"icmp\" && $3 > 1000'\n```\n\n**Wireshark Exfiltration Filters:**\n```\n# Large HTTP POST uploads\nhttp.request.method == \"POST\" && tcp.len > 10000\n\n# FTP data transfers\nftp-data && ip.src == 10.0.0.0\u002F8\n\n# DNS with large TXT responses (tunneling)\ndns.resp.type == 16 && dns.resp.len > 200\n```\n\n### Step 5: Extract and Correlate IOCs\n\nPull network-based indicators from traffic analysis:\n\n- External IP addresses contacted by compromised hosts\n- Domains resolved via DNS during the incident timeframe\n- URLs accessed via HTTP\u002FHTTPS (if SSL inspection is in place)\n- TLS certificate details (subject, issuer, serial number, JA3\u002FJA3S hashes)\n- User-Agent strings from HTTP requests\n- File transfers captured in PCAP (extract using Wireshark Export Objects)\n\n### Step 6: Document Network Forensic Findings\n\nCompile analysis into a structured report with evidence references:\n\n- Reference specific PCAP files, frame numbers, and timestamps for each finding\n- Include packet captures of key evidence as screenshots or exported PDFs\n- Map network activity to the incident timeline\n- Correlate network findings with host-based evidence from endpoint forensics\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PCAP (Packet Capture)** | File format storing raw network packets captured from a network interface for offline analysis |\n| **Beaconing** | Regular, periodic network connections from a compromised host to a C2 server, identifiable by consistent timing intervals |\n| **JA3\u002FJA3S** | TLS client and server fingerprinting method based on the ClientHello and ServerHello parameters; unique per application |\n| **NetFlow\u002FIPFIX** | Network traffic metadata (source, destination, ports, bytes, duration) collected by routers and switches without full packet capture |\n| **DNS Tunneling** | Technique encoding data in DNS queries and responses to exfiltrate data or maintain C2 through DNS protocol |\n| **Network Tap** | Hardware device that creates an exact copy of network traffic for monitoring without impacting network performance |\n| **Zeek Logs** | Structured metadata logs generated by the Zeek network analysis framework covering connections, DNS, HTTP, SSL, and more |\n\n## Tools & Systems\n\n- **Wireshark**: Open-source packet analyzer for deep inspection of network protocols at the packet level\n- **Zeek (formerly Bro)**: Network analysis framework generating structured metadata logs from live or captured traffic\n- **Arkime (formerly Moloch)**: Open-source full packet capture and search platform for large-scale network forensics\n- **NetworkMiner**: Network forensic analysis tool for extracting files, images, and credentials from PCAP files\n- **RITA (Real Intelligence Threat Analytics)**: Open-source beacon detection and DNS tunneling analysis tool for Zeek logs\n\n## Common Scenarios\n\n### Scenario: Confirming C2 Beaconing and Quantifying Exfiltration\n\n**Context**: EDR detects a suspicious process on a workstation but cannot determine the volume of data exfiltrated. Network team provides PCAP from the full packet capture appliance covering the incident timeframe.\n\n**Approach**:\n1. Filter PCAP to traffic from the compromised host IP to external destinations\n2. Identify the C2 channel by analyzing connection timing patterns (beacon detection)\n3. Extract TLS certificate and JA3 hash from the C2 connection for IOC generation\n4. Calculate total bytes transferred to C2 infrastructure over the incident duration\n5. Check for additional exfiltration channels (DNS tunneling, cloud storage uploads)\n6. Extract any unencrypted files transferred using Wireshark Export Objects feature\n\n**Pitfalls**:\n- Analyzing only HTTP traffic when C2 is operating over HTTPS without SSL inspection\n- Missing DNS tunneling because the data volume per query is small (but total over time is significant)\n- Not correlating network timestamps with endpoint timestamps (timezone mismatches)\n- Overlooking legitimate cloud services abused for exfiltration (OneDrive, Google Drive, Dropbox)\n\n## Output Format\n\n```\nNETWORK TRAFFIC ANALYSIS REPORT\n=================================\nIncident:         INC-2025-1547\nAnalyst:          [Name]\nCapture Source:   Arkime full packet capture\nAnalysis Period:  2025-11-15 14:00 UTC - 2025-11-15 18:00 UTC\nTotal PCAP Size:  4.7 GB\n\nC2 COMMUNICATIONS\nSource:           10.1.5.42 (WKSTN-042)\nDestination:      185.220.101.42:443 (HTTPS)\nBeacon Interval:  60 seconds ± 12% jitter\nSessions:         237 connections over 4 hours\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nTLS Certificate:  CN=update.evil[.]com (self-signed)\nTotal Data Sent:  147 MB (outbound)\nTotal Data Recv:  2.3 MB (inbound - commands)\n\nLATERAL MOVEMENT\n10.1.5.42 → 10.1.10.15 (SMB, TCP 445) - 14:35 UTC\n10.1.5.42 → 10.1.10.20 (RDP, TCP 3389) - 14:42 UTC\n10.1.5.42 → 10.1.1.5  (LDAP, TCP 389) - 15:10 UTC\n\nEXFILTRATION SUMMARY\nProtocol:         HTTPS to C2 server\nVolume:           147 MB outbound\nDuration:         14:23 UTC - 18:00 UTC\nFiles Extracted:  [list if recoverable from unencrypted channels]\n\nDNS ANALYSIS\nSuspicious Queries: 0 DNS tunneling indicators\nDGA Detection:      0 algorithmically generated domains\n\nEVIDENCE REFERENCES\nPCAP File:        INC-2025-1547_capture.pcap (SHA-256: ...)\nZeek Logs:        \u002Flogs\u002Fzeek\u002F2025-11-15\u002F (conn.log, ssl.log, dns.log)\n```\n","# Analyzing Network Traffic for Incidents\n\n## When to Use\n\n- SIEM alerts on anomalous network traffic patterns requiring deeper investigation\n- C2 beaconing is suspected and needs confirmation through packet-level analysis\n- Data exfiltration volume or destination must be quantified from network evidence\n- Lateral movement between systems needs to be traced through network connections\n- An IDS\u002FIPS alert requires packet-level validation to confirm or dismiss\n\n**Do not use** for host-based forensic analysis (process execution, file system artifacts); use endpoint forensics tools instead.\n\n## Prerequisites\n\n- Full packet capture (PCAP) infrastructure or on-demand capture capability (network tap, SPAN port)\n- Wireshark installed on the analysis workstation with appropriate display filters knowledge\n- Zeek (formerly Bro) deployed for network metadata generation (conn.log, dns.log, http.log, ssl.log)\n- NetFlow\u002FIPFIX collection from network devices for traffic flow analysis\n- Network architecture diagram showing VLAN layout, firewall placement, and monitoring points\n- Threat intelligence feeds for correlating observed network indicators\n\n## Workflow\n\n### Step 1: Capture or Acquire Network Traffic\n\nObtain the relevant traffic data for the investigation:\n\n**Live Capture (if incident is active):**\n```bash\n# Capture on specific interface filtering by host\ntcpdump -i eth0 -w capture.pcap host 10.1.5.42\n\n# Capture C2 traffic to specific external IP\ntcpdump -i eth0 -w c2_traffic.pcap host 185.220.101.42\n\n# Capture with rotation (1GB files, keep 10)\ntcpdump -i eth0 -w capture_%Y%m%d%H%M.pcap -C 1000 -W 10\n```\n\n**From Existing Infrastructure:**\n- Export PCAP from full packet capture appliance (Arkime\u002FMoloch, ExtraHop, Corelight)\n- Pull Zeek logs from the Zeek cluster for the investigation timeframe\n- Export NetFlow data from network devices for high-level traffic analysis\n\n### Step 2: Identify C2 Communications\n\nDetect command-and-control traffic patterns:\n\n**Beaconing Detection (Zeek conn.log):**\n```bash\n# Extract connections to external IPs with regular intervals\ncat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes \\\n  | awk '$4 ~ \u002F^185\\.220\u002F' | sort -t. -k1,1n -k2,2n\n```\n\n**Wireshark Beacon Analysis:**\n```\n# Filter for traffic to suspected C2 IP\nip.addr == 185.220.101.42\n\n# Filter HTTPS traffic to non-standard ports\ntcp.port != 443 && ssl\n\n# Filter DNS queries for suspicious domains\ndns.qry.name contains \"evil\" or dns.qry.name matches \"^[a-z0-9]{32}\\.\"\n\n# Filter HTTP POST (common C2 check-in method)\nhttp.request.method == \"POST\" && ip.dst == 185.220.101.42\n```\n\nBeaconing characteristics to identify:\n- Regular time intervals between connections (e.g., every 60 seconds with 10-15% jitter)\n- Consistent packet sizes in requests and responses\n- HTTPS to external IPs not associated with legitimate CDNs or services\n- DNS queries with high entropy subdomains (DNS tunneling indicator)\n\n### Step 3: Analyze Lateral Movement Traffic\n\nTrace adversary movement between internal systems:\n\n```\nKey protocols for lateral movement detection:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nSMB (TCP 445):     PsExec, file share access, ransomware propagation\nRDP (TCP 3389):    Remote desktop sessions\nWinRM (TCP 5985):  PowerShell remoting\nWMI (TCP 135):     Remote command execution\nSSH (TCP 22):      Linux lateral movement\nDCE\u002FRPC (TCP 135): DCOM-based lateral movement\n```\n\n**Wireshark Filters for Lateral Movement:**\n```\n# SMB lateral movement\nsmb2 && ip.src == 10.1.5.42 && ip.dst != 10.1.5.42\n\n# RDP connections from compromised host\ntcp.dstport == 3389 && ip.src == 10.1.5.42\n\n# Kerberos ticket requests (potential pass-the-ticket)\nkerberos.msg_type == 12 && ip.src == 10.1.5.42\n\n# NTLM authentication (potential pass-the-hash)\nntlmssp.auth.username && ip.src == 10.1.5.42\n```\n\n### Step 4: Detect Data Exfiltration\n\nIdentify unauthorized data transfers leaving the network:\n\n```\n# Identify large outbound transfers in Zeek conn.log\ncat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p orig_bytes \\\n  | awk '$5 > 100000000' | sort -t$'\\t' -k5 -rn\n\n# DNS tunneling detection (high volume of TXT queries)\ncat dns.log | zeek-cut query qtype | grep TXT | cut -f1 \\\n  | rev | cut -d. -f1,2 | rev | sort | uniq -c | sort -rn | head\n\n# Unusual protocol usage (ICMP tunneling, DNS over HTTPS)\ncat conn.log | zeek-cut proto id.resp_p orig_bytes | awk '$1 == \"icmp\" && $3 > 1000'\n```\n\n**Wireshark Exfiltration Filters:**\n```\n# Large HTTP POST uploads\nhttp.request.method == \"POST\" && tcp.len > 10000\n\n# FTP data transfers\nftp-data && ip.src == 10.0.0.0\u002F8\n\n# DNS with large TXT responses (tunneling)\ndns.resp.type == 16 && dns.resp.len > 200\n```\n\n### Step 5: Extract and Correlate IOCs\n\nPull network-based indicators from traffic analysis:\n\n- External IP addresses contacted by compromised hosts\n- Domains resolved via DNS during the incident timeframe\n- URLs accessed via HTTP\u002FHTTPS (if SSL inspection is in place)\n- TLS certificate details (subject, issuer, serial number, JA3\u002FJA3S hashes)\n- User-Agent strings from HTTP requests\n- File transfers captured in PCAP (extract using Wireshark Export Objects)\n\n### Step 6: Document Network Forensic Findings\n\nCompile analysis into a structured report with evidence references:\n\n- Reference specific PCAP files, frame numbers, and timestamps for each finding\n- Include packet captures of key evidence as screenshots or exported PDFs\n- Map network activity to the incident timeline\n- Correlate network findings with host-based evidence from endpoint forensics\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PCAP (Packet Capture)** | File format storing raw network packets captured from a network interface for offline analysis |\n| **Beaconing** | Regular, periodic network connections from a compromised host to a C2 server, identifiable by consistent timing intervals |\n| **JA3\u002FJA3S** | TLS client and server fingerprinting method based on the ClientHello and ServerHello parameters; unique per application |\n| **NetFlow\u002FIPFIX** | Network traffic metadata (source, destination, ports, bytes, duration) collected by routers and switches without full packet capture |\n| **DNS Tunneling** | Technique encoding data in DNS queries and responses to exfiltrate data or maintain C2 through DNS protocol |\n| **Network Tap** | Hardware device that creates an exact copy of network traffic for monitoring without impacting network performance |\n| **Zeek Logs** | Structured metadata logs generated by the Zeek network analysis framework covering connections, DNS, HTTP, SSL, and more |\n\n## Tools & Systems\n\n- **Wireshark**: Open-source packet analyzer for deep inspection of network protocols at the packet level\n- **Zeek (formerly Bro)**: Network analysis framework generating structured metadata logs from live or captured traffic\n- **Arkime (formerly Moloch)**: Open-source full packet capture and search platform for large-scale network forensics\n- **NetworkMiner**: Network forensic analysis tool for extracting files, images, and credentials from PCAP files\n- **RITA (Real Intelligence Threat Analytics)**: Open-source beacon detection and DNS tunneling analysis tool for Zeek logs\n\n## Common Scenarios\n\n### Scenario: Confirming C2 Beaconing and Quantifying Exfiltration\n\n**Context**: EDR detects a suspicious process on a workstation but cannot determine the volume of data exfiltrated. Network team provides PCAP from the full packet capture appliance covering the incident timeframe.\n\n**Approach**:\n1. Filter PCAP to traffic from the compromised host IP to external destinations\n2. Identify the C2 channel by analyzing connection timing patterns (beacon detection)\n3. Extract TLS certificate and JA3 hash from the C2 connection for IOC generation\n4. Calculate total bytes transferred to C2 infrastructure over the incident duration\n5. Check for additional exfiltration channels (DNS tunneling, cloud storage uploads)\n6. Extract any unencrypted files transferred using Wireshark Export Objects feature\n\n**Pitfalls**:\n- Analyzing only HTTP traffic when C2 is operating over HTTPS without SSL inspection\n- Missing DNS tunneling because the data volume per query is small (but total over time is significant)\n- Not correlating network timestamps with endpoint timestamps (timezone mismatches)\n- Overlooking legitimate cloud services abused for exfiltration (OneDrive, Google Drive, Dropbox)\n\n## Output Format\n\n```\nNETWORK TRAFFIC ANALYSIS REPORT\n=================================\nIncident:         INC-2025-1547\nAnalyst:          [Name]\nCapture Source:   Arkime full packet capture\nAnalysis Period:  2025-11-15 14:00 UTC - 2025-11-15 18:00 UTC\nTotal PCAP Size:  4.7 GB\n\nC2 COMMUNICATIONS\nSource:           10.1.5.42 (WKSTN-042)\nDestination:      185.220.101.42:443 (HTTPS)\nBeacon Interval:  60 seconds ± 12% jitter\nSessions:         237 connections over 4 hours\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nTLS Certificate:  CN=update.evil[.]com (self-signed)\nTotal Data Sent:  147 MB (outbound)\nTotal Data Recv:  2.3 MB (inbound - commands)\n\nLATERAL MOVEMENT\n10.1.5.42 → 10.1.10.15 (SMB, TCP 445) - 14:35 UTC\n10.1.5.42 → 10.1.10.20 (RDP, TCP 3389) - 14:42 UTC\n10.1.5.42 → 10.1.1.5  (LDAP, TCP 389) - 15:10 UTC\n\nEXFILTRATION SUMMARY\nProtocol:         HTTPS to C2 server\nVolume:           147 MB outbound\nDuration:         14:23 UTC - 18:00 UTC\nFiles Extracted:  [list if recoverable from unencrypted channels]\n\nDNS ANALYSIS\nSuspicious Queries: 0 DNS tunneling indicators\nDGA Detection:      0 algorithmically generated domains\n\nEVIDENCE REFERENCES\nPCAP File:        INC-2025-1547_capture.pcap (SHA-256: ...)\nZeek Logs:        \u002Flogs\u002Fzeek\u002F2025-11-15\u002F (conn.log, ssl.log, dns.log)\n```\n",{"name":5,"tags":47,"author":48,"domain":41,"license":15,"version":49,"nist_csf":50,"subdomain":30,"description":55,"mitre_attack":56},[31,38,39,40,37],"mahipal","1.0.0",[51,52,53,54],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.\n",[57,58,59,60],"T1071","T1095","T1573","T1572","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-network-traffic-for-incidents",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-network-traffic-for-incidents",{"tool":77,"command":78},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-network-traffic-for-incidents",{"tool":80,"command":81},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-network-traffic-for-incidents","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-for-incidents\u002FSKILL.md",true,[85,90,94,100],{"path":86,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-for-incidents\u002FLICENSE",{"path":91,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE.txt",1467,"https:\u002F\u002Fgithub.com\u002Fderseitenschneider\u002Fdotfiles\u002Fblob\u002Fmain\u002Fclaude-config\u002F.claude\u002Fskills\u002Fsynced\u002Fc18e4183-2bcf-4f84-9592-16baf9918832_492d02ae-7d32-4227-a9d4-d9f601100de4\u002Fcomputer-use\u002FLICENSE.txt",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",2825,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-for-incidents\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",7804,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-for-incidents\u002Fscripts\u002Fagent.py",[107,133,157,184,209,236],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":114,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[113],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[115,116,117,118,33,41,119,120,121,122,123,124,125,126,127,128,129,130,131,132],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[139],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,129,142,143,33,144,41,121,145,146,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[151,168,169,170,171,41,172,173,145,174,175,30,176,177,178,179,180,181,182,183],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[190],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[192,193,194,41,195,196,197,198,199,200,201,35,202,203,204,205,148,206,207,208],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[215],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[217,218,219,41,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[242],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[33,244,41,245,246,247,248,249,250,251,252,179,253,180,254,255,256,257,258,259],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]