Analyze PCAP/PCAPNG captures to detect C2 beacons and DNS tunneling.
npx skills add https://github.com/Fuzzdkk/dfir-skills --skill network-forensics-fuzzdkk
Please help me install this Agent Skill. Skill: network-forensics Source: https://github.com/Fuzzdkk/dfir-skills/tree/main/network-forensics Command: npx skills add https://github.com/Fuzzdkk/dfir-skills --skill network-forensics-fuzzdkk
Analyzes PCAP/PCAPNG network captures to identify C2 beacons, data exfiltration, DNS tunneling, and suspicious traffic patterns, enabling rapid incident assessment.
Provide a PCAP file to initiate traffic analysis and generate IOCs and a findings report.
High-intent search queries and answers about installing and using this skill.
You can analyze PCAP network captures to identify C2 beacons, data exfiltration, and suspicious traffic patterns to enable rapid incident assessment. The process scans protocols like DNS, HTTP, and TLS to map anomalous flows and attacker reachability.
DNS tunneling is a technique that hides malicious data within DNS queries to bypass network filters. Network forensics identifies this by analyzing PCAP captures to detect anomalous DNS traffic patterns and extract actionable indicators of compromise.
Yes, you can extract IOCs from a PCAP during network forensics investigations. The analysis generates a concise list of indicators and a structured findings report to map attacker actions and document evidence for incident tickets.
Yes, the network forensics workflow supports deterministic tshark-based analysis across multiple phases including overview, DNS, HTTP, and beaconing to accurately identify suspicious traffic patterns in PCAP files.
Analyzing a PCAP from the compromised host is the best way to map attacker actions, reachability, and data exfiltration paths. This network forensics process assesses protocols like DNS, HTTP, and TLS to generate structured findings for investigations.
You need to analyze PCAPNG files during incident response when you must rapidly assess network compromises, detect C2 beaconing, or identify data exfiltration paths to extract IOCs and generate evidence-backed findings reports.
automateyournetworkAnalyze network packet captures with Packet Buddy MCP and tshark.
Happy-Technologies-LLCGenerate executive and technical security incident reports with MITRE ATT&CK mappings.
brucesongsDeploy honeypot decoys to collect attacker telemetry and IOCs.
YukiIto1999Detect DNS tunneling by analyzing query entropy, lengths, TXT records, and subdomain cardinality.
