threat-detection

Detect port scans, DoS attacks, and C2 beaconing in network traffic.

1|Updated Jan 6, 2026

Search Tags:#network security #threat detection #pcap analysis #port scan #DoS attack #C2 beaconing

Ready to run

npx skills add https://github.com/puyanguvic/Argis --skill threat-detection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: threat-detection
Source: https://github.com/puyanguvic/Argis/tree/main/skillpacks/threat-detection
Command: npx skills add https://github.com/puyanguvic/Argis --skill threat-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires scapy, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides exact detection thresholds for identifying malicious network patterns like port scans, DoS attacks, and C2 beaconing, ensuring accurate threat identification.

Core Features & Use Cases

Port Scan Detection: Identifies port scans based on port entropy, SYN-only ratio, and unique ports.
DoS Pattern Detection: Detects Denial of Service attacks by analyzing the ratio of maximum to average packets per minute.
C2 Beaconing Detection: Identifies Command and Control beaconing by analyzing the Coefficient of Variation of inter-arrival times.
Use Case: Security analysts can use this skill to automatically analyze network traffic logs to pinpoint and classify various types of cyber threats.

Quick Start

Analyze the provided TCP packets to detect any port scan, DoS pattern, or C2 beaconing.

Frequently Asked Questions about threat-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect port scans and DoS attacks from pcap analysis?▼

You can detect port scans and DoS attacks by analyzing pcap data through port entropy, SYN-only ratios, and maximum-to-average packet rate ratios. This approach applies precise statistical thresholds to network traffic logs to pinpoint malicious activities.

What statistical thresholds identify C2 beaconing in network traffic?▼

C2 beaconing in network traffic is identified by analyzing the Coefficient of Variation of inter-arrival times. Applying precise statistical thresholds to these time intervals reveals regular communication patterns characteristic of command and control activity.

Can I use scapy for network threat detection on TCP packet captures?▼

Yes, you can use scapy for network threat detection on TCP packet captures. The skill processes scapy packets to compute port entropy, SYN-only ratios, and inter-arrival time statistics to detect port scans, DoS, and C2 beaconing.

How does SYN-only ratio analysis detect malicious network patterns?▼

SYN-only ratio analysis detects malicious network patterns by measuring the proportion of SYN packets without corresponding acknowledgments. A high ratio indicates connection attempts without completion, a primary statistical indicator of port scanning or DoS attacks.

Do I need flow logs or raw packet captures to identify C2 beaconing?▼

Both flow logs and raw packet captures can identify C2 beaconing, as the skill requires timestamp data to calculate the inter-arrival time coefficient of variation. Analyzing these precise statistical thresholds flags regular beaconing intervals in network traffic.