building-adversary-infrastructure-tracking-system

Name: building-adversary-infrastructure-tracking-system
Availability: InStock
Author: Axxxxxxaaann

Map threat actor infrastructure from passive DNS, WHOIS, and certificate data.

Updated Aug 27, 2026

Search Tags:#whois #threat-intelligence #graph-analysis #pivoting #certificate-transparency #infrastructure-tracking #passive-dns

Ready to run

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill building-adversary-infrastructure-tracking-system

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: building-adversary-infrastructure-tracking-system
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/building-adversary-infrastructure-tracking-system
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill building-adversary-infrastructure-tracking-system

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Automates the tracking of threat actor infrastructure by aggregating passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor C2 networks.

Core Features & Use Cases

Passive DNS and WHOIS pivoting to discover related domains and IPs
Certificate transparency and TLS data for linking infrastructure
Infrastructure graphing, clustering, and hub identification for mapping threat networks
Example: Build an automated tracker from a seed domain to visualize C2 infrastructure over time.

Quick Start

Configure the tracker with a seed domain and run the agent to begin mapping threat actor infrastructure.

Frequently Asked Questions about building-adversary-infrastructure-tracking-system

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate adversary infrastructure mapping using passive DNS and WHOIS data?▼

You can automate adversary infrastructure mapping by collecting passive DNS, WHOIS data, and certificate transparency logs. This pivots from seed indicators to co-hosted domains, registrants, and TLS relationships to reveal domain-IP relationships and map C2 networks over time.

What is the best way to pivot from a seed domain to discover related threat actor infrastructure?▼

Pivoting from a seed domain involves querying passive DNS history and certificate transparency data to link infrastructure. By aggregating these data points, you can cluster related IPs, registrants, and TLS certificates to identify co-hosted domains and map the threat network.

Do I need API access to SecurityTrails or Shodan to track C2 infrastructure?▼

Yes, tracking C2 infrastructure requires API access to SecurityTrails or PassiveTotal, and Shodan for IP enrichment. You also need Python 3.9+ with libraries for DNS, WHOIS, and graph visualization, plus a graph database or NetworkX to map the data.

How does certificate transparency data help link threat actor domains?▼

Certificate transparency data helps link threat actor domains by exposing TLS relationships across multiple sources. When threat actors reuse certificates across different domains, this data allows you to connect infrastructure nodes that might not share IP addresses or WHOIS records.

Can I use NetworkX for infrastructure graphing and hub identification?▼

Yes, you can use NetworkX for infrastructure graphing, clustering, and hub identification. It allows you to visualize C2 infrastructure over time by mapping the relationships between domains, IPs, and certificates collected during the tracking process.

What are the limitations of using certificate transparency logs for threat hunting?▼

While certificate transparency logs are effective for linking domains via TLS relationships, they do not capture infrastructure using self-signed certificates or no TLS. You must combine this with passive DNS and WHOIS pivoting to ensure comprehensive adversary infrastructure tracking.