Network Analysis (PCAP / Zeek / Netflow)

To analyze PCAP files for C2 beaconing and DNS anomalies, you can use this Skill to profile traffic, extract protocol metadata, and identify automated communication patterns. It targets DFIR triage scenarios by isolating suspicious DNS behavior and beaconing candidates.

Extracting IOCs from Zeek logs during DFIR triage involves correlating connections, DNS answers, HTTP metadata, and TLS JA3/SNI values. This Skill structures that enrichment process to produce pivot-ready artifacts for tracking indicators of compromise.

Yes, you need tshark and capinfos to perform network traffic analysis with this Skill. These tools are required for extracting metadata and field values from PCAP and pcapng files to support threat-relevant protocol interrogation.

You can detect TLS indicators and credential exposure in pcapng files using this Skill. It interrogates HTTP/TLS metadata and file-transfer artifacts, surfacing potential credential exposure and C2 signals for follow-on analysis.

Profiling top talkers and protocol hierarchy from captured network traffic requires parsing capture time ranges and protocol distributions. This Skill orients your analysis by quickly summarizing what the dataset contains before deeper threat hunting.

Yes, network analysis supports pivoting from extracted artifacts to malware analysis. This Skill produces deterministic artifact lists and extracted objects that feed directly into malware-analysis, memory-analysis netscan cross-references, and IOC tracking workflows.