Анализ сетевого трафика вредоносного ПО

★ 8.4 · security

analyzing-network-traffic-of-malware is a Claude Code skill that examines network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns. The toolchain spans Wireshark 4.x and tshark for interactive and scripted PCAP analysis, Zeek for automated metadata extraction, Suricata with ET Open/ET Pro rulesets for signature matching, NetworkMiner for file and credential recovery, and Python 3.8+ with scapy and dpkt for programmatic packet inspection. The five-step workflow covers initial PCAP overview with capinfos and protocol hierarchy, DNS analysis for DGA detection and tunneling, HTTP/HTTPS C2 decoding including JA3 fingerprints and TLS SNI extraction, beacon detection via connection-interval statistics, and Suricata/Snort rule generation from observed traffic patterns. Designed for threat analysts and incident responders who need network-based forensics on malicious samples captured in controlled or production environments.