skills.rest
op7ic
op7icCOMMUNITY
Explore all skills by this author →
GitHub

Hunt: Network Connection Analysis

Dump and analyze endpoint network connections to identify C2 communications and beaconing patterns.

14|5|Updated May 14, 2020
Search Tags:#endpoint#beaconing#C2#network-analysis#threat-hunting
One-click install
npx skills add https://github.com/op7ic/amphunt --skill hunt-network-connection-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Hunt: Network Connection Analysis
Source: https://github.com/op7ic/amphunt/tree/main/SKILLS/.claude/skills/hunt-network
Command: npx skills add https://github.com/op7ic/amphunt --skill hunt-network-connection-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Dump and analyze all network connections and URL requests across endpoints. Use to identify C2 communications, data exfiltration, beaconing patterns, and suspicious outbound connections.

Core Features & Use Cases

  • Dump all TCP/UDP network connections across all endpoints
  • Extract all URL requests with domain statistics
  • Detect beaconing patterns and suspicious outbound connections to inform incident response

Quick Start

Analyze a fleet of endpoints to map network activity and identify anomalies.

Frequently Asked Questions about Hunt: Network Connection Analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect C2 beaconing patterns from endpoint network traffic?▼

You can detect C2 beaconing by dumping endpoint network connections and URL requests across all managed endpoints, then analyzing the traffic patterns to identify suspicious outbound communications and data exfiltration.

What is the best way to analyze outbound connections for data exfiltration across multiple endpoints?▼

Analyzing outbound connections for data exfiltration involves dumping all TCP/UDP network activity across endpoints, extracting URL requests with domain statistics, and flagging suspicious or anomalous traffic patterns.

Can I extract all URL requests and domain statistics from endpoint traffic for threat hunting?▼

Yes, you can extract all URL requests and domain statistics from endpoint traffic. The provided Python scripts parse endpoint configurations to dump URL activity, supporting threat hunting and incident response workflows.

Do I need a Python runtime to dump and analyze network connections across endpoints?▼

Yes, a Python runtime is required to execute the provided scripts that parse endpoint configurations, dump network connections, and generate CSV exports for analysis.

Does this network analysis approach work for triage and incident response in a managed environment?▼

Yes, this network analysis approach works for triage and incident response in a managed environment. It applies across all endpoints, dumping network connections and URL requests to identify C2 communications and beaconing patterns.

Related Skills

Explore More Data & Analytics Skills→
cyberpunk042cyberpunk042

mvp-agent

Automate MVP agent creation and deployment in a fleet project.

Community
Advanced
YukiIto1999YukiIto1999

detecting-beaconing-patterns-with-zeek

Analyze Zeek conn.log data to detect C2 beaconing patterns.

Community
Intermediate
wyre-technologywyre-technology
39

threat-hunting

Execute PowerQuery language queries against SentinelOne Singularity Data Lake for threat hunting.

Official
Advanced
automateyournetworkautomateyournetwork
627

packet-analysis

Analyze network packet captures with Packet Buddy MCP and tshark.

Community
Intermediate