Анализ скрытых каналов связи вредоносного ПО

★ 8.4 · security

analyzing-network-covert-channels-in-malware is a Claude Code skill that detects and analyzes covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 communication and data exfiltration. The skill provides Python scripts built on scapy, dpkt, and dnslib that parse PCAP files, compute subdomain entropy, unique-query ratios, and average subdomain lengths, then score suspicious domains; ICMP payloads are examined separately for tunneling artifacts from tools like icmpsh and ptunnel. It is aimed at SOC analysts, threat hunters, and network forensics practitioners investigating anomalous traffic, hunting hidden C2 channels in packet captures, or attributing exfiltration to known toolsets such as iodine or dnscat2. The skill maps to MITRE ATT&CK techniques T1071.001, T1095, T1572, and T1001, and requires Python 3.9+ along with Wireshark/tshark and optionally Zeek.