Communitygithub.com

分析勒索软件网络指标

通过分析 Zeek conn.log 和 NetFlow 数据，识别勒索软件相关的网络指标，包括 C2 信标模式、TOR 出口节点连接、数据外泄流和加密密钥交换。适用于威胁狩猎中主动搜索活跃勒索软件网络活动，或在事件响应中调查疑似加密前外泄行为。

分析勒索软件网络指标 是什么？

该技能专注于利用 Zeek conn.log 和 NetFlow 数据，检测勒索软件攻击前及攻击中的关键网络指标。它能自动解析连接日志，识别周期性回调的信标模式（如连接间隔的均值、标准差和变异系数），并与当前 TOR 出口节点列表交叉比对，标记可疑出口节点连接。同时，它通过分析高比例出站流量发现数据外泄行为，并利用熵值分析和 DGA 检测技术识别恶意 DNS 活动。技能最终输出包含结构化 JSON 报告、威胁时间线以及 MITRE ATT&CK 映射（T1071、T1573、T1041），为安全团队提供从被动监控到主动威胁狩猎的实用工具。支持平台包括 Zeek 和 NetFlow 环境，Python 3.8+ 即可运行，无需额外依赖，适合 SOC 分析师和事件响应人员使用。

兼容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-ransomware-network-indicators
查看原文→浏览所有技能

在你喜欢的 AI 中提问

打开一个已预加载此 Agent Skill 的新对话。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

文档

分析勒索软件网络指标 是做什么的？

概述

在勒索软件执行前及执行过程中，攻击者会建立 C2 通道、外泄数据并下载加密密钥。本技能通过分析 Zeek conn.log 和 NetFlow 数据，检测信标模式（定期回拨）、与已知 TOR 出口节点的连接、大量出站数据传输以及与勒索软件家族相关的可疑 DNS 活动。

使用时机

  • 调查需要分析勒索软件网络指标的安全事件时
  • 为相关领域构建检测规则或威胁狩猎查询时
  • SOC 分析师需要此类分析类型的结构化流程时
  • 验证安全监控覆盖相关攻击技术时

前提条件

  • Zeek conn.log 文件或 NetFlow CSV/JSON 导出文件
  • Python 3.8+ 及标准库
  • TOR 出口节点列表（从 Tor Project 或威胁情报源获取）
  • 可选：已知勒索软件 C2 IOC 列表

步骤

  1. 解析连接日志 — 将 Zeek conn.log（TSV 格式）或 NetFlow 记录转换为结构化格式
  2. 检测信标模式 — 计算连接间隔统计量（均值、标准差、变异系数）以识别周期性回拨
  3. 检查 TOR 出口节点连接 — 将目标 IP 与当前 TOR 出口节点列表交叉引用
  4. 识别数据外泄 — 标记与外部 IP 之间具有异常高出站字节比例的连接
  5. 分析 DNS 模式 — 检测类似 DGA 的域名查询和高熵子域名
  6. 评分与关联 — 对所有指标类型应用复合风险评分
  7. 生成报告 — 生成包含时间线和 MITRE ATT&CK 映射的结构化报告

预期输出

  • 包含信标检测及其间隔统计量的 JSON 报告
  • TOR 出口节点连接告警
  • 数据外泄流分析
  • 包含 MITRE 映射（T1071、T1573、T1041）的复合勒索软件风险评分

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target

achieving-cmmc-level-2-compliance

>-

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

analyzing-active-directory-acl-abuse

Detect dangerous ACL misconfigurations in Active Directory using ldap3

analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.

analyzing-api-gateway-access-logs

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

analyzing-apt-group-with-mitre-navigator

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups

analyzing-azure-activity-logs-for-threats

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

analyzing-bootkit-and-rootkit-samples

Analyzes bootkit and advanced rootkit malware infecting the Master

analyzing-browser-forensics-with-hindsight

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user

analyzing-campaign-attribution-evidence

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

analyzing-certificate-transparency-for-phishing

Monitor Certificate Transparency logs using crt.sh and Certstream to

analyzing-cloud-storage-access-patterns

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

analyzing-cobalt-strike-beacon-configuration

Extract and analyze Cobalt Strike beacon configuration from PE files

analyzing-cobaltstrike-malleable-c2-profiles

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.

analyzing-command-and-control-communication

Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

analyzing-cyber-kill-chain

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

analyzing-disk-image-with-autopsy

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.

analyzing-dns-logs-for-exfiltration

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

相关技能

steipete/video-frames

Extract frames or short clips from videos using ffmpeg.

community

steipete/summarize

Summarize or transcribe URLs, YouTube/videos, podcasts, articles, transcripts, PDFs, and local files.

community

openclaw/openclaw

Use when testing, fixing, or extending the OpenClaw Control UI GUI with Vitest + Playwright end-to-end checks, mocked Gateway WebSocket flows, mocked dashboard runs, screenshots/videos, or agent-verifiable browser proof.

community

obra/superpowers

Obra superpowers agent skills.

community

affaan-m/ECC

See, Understand, Act on video and audio. See- ingest from local files, URLs, RTSP/live feeds, or live record desktop; return realtime context and playable stream links. Understand- extract frames, build visual/semantic/temporal indexes, and search moments with timestamps and auto-clips. Act- transcode and normalize (codec, fps, resolution, aspect ratio), perform timeline edits (subtitles, text/image overlays, branding, audio overlays, dubbing, translation), generate media assets (image, audio...

community

affaan-m/everything-claude-code

End-to-end marketing campaign planning and execution. Covers audience research, positioning, campaign angle definition, landing page copy, email sequences, social posts, ad copy, short-form video scripts, and content calendars. Use as the orchestration layer for multi-channel product launches. Use when planning or executing a multi-channel product launch, or producing landing page, email, social, or ad copy.

community