Detect port scans, DoS attacks, and C2 beaconing in network traffic.
npx skills add https://github.com/puyanguvic/Argis --skill threat-detection
Please help me install this Agent Skill. Skill: threat-detection Source: https://github.com/puyanguvic/Argis/tree/main/skillpacks/threat-detection Command: npx skills add https://github.com/puyanguvic/Argis --skill threat-detection
This Skill provides exact detection thresholds for identifying malicious network patterns like port scans, DoS attacks, and C2 beaconing, ensuring accurate threat identification.
Analyze the provided TCP packets to detect any port scan, DoS pattern, or C2 beaconing.
High-intent search queries and answers about installing and using this skill.
You can detect port scans and DoS attacks by analyzing pcap data through port entropy, SYN-only ratios, and maximum-to-average packet rate ratios. This approach applies precise statistical thresholds to network traffic logs to pinpoint malicious activities.
C2 beaconing in network traffic is identified by analyzing the Coefficient of Variation of inter-arrival times. Applying precise statistical thresholds to these time intervals reveals regular communication patterns characteristic of command and control activity.
Yes, you can use scapy for network threat detection on TCP packet captures. The skill processes scapy packets to compute port entropy, SYN-only ratios, and inter-arrival time statistics to detect port scans, DoS, and C2 beaconing.
SYN-only ratio analysis detects malicious network patterns by measuring the proportion of SYN packets without corresponding acknowledgments. A high ratio indicates connection attempts without completion, a primary statistical indicator of port scanning or DoS attacks.
Both flow logs and raw packet captures can identify C2 beaconing, as the skill requires timestamp data to calculate the inter-arrival time coefficient of variation. Analyzing these precise statistical thresholds flags regular beaconing intervals in network traffic.
jcastillotxCapture, filter, and inspect packets from live captures or PCAP files.
jayjpatel9717Integrate protocol and Active Directory findings into detection patterns for network attack chains.
refractionPOINTEvaluate threat reports to extract IOCs and behaviors across LimaCharlie organizations.
ConsiliencyDetect project technology stacks by analyzing package manifests and configuration files.
