analyzing-ransomware-network-indicators

Identify ransomware network indicators including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange via Zeek conn.log and NetFlow analysis

Works with

Claude CodeCursorClineWindsurfCodexGooseGitHub CopilotZed

0

total installs

0

this week

8.6K

GitHub stars

0

upvotes

Install Skill

Run in your terminal

$npx skills install mukul975/Anthropic-Cybersecurity-Skills/analyzing-ransomware-network-indicators

0

installs

0

this week

8.6K

stars

Installation Guide

How to use analyzing-ransomware-network-indicators on Cursor

AI-first code editor with Composer

1

Prerequisites

Before installing skills in Cursor, ensure your development environment meets these requirements:

  • Cursor installed and configured on your machine
  • Node.js 16+ with npm — verify with node --version
  • Active project directory where you want to add analyzing-ransomware-network-indicators
2

Run the install command

Execute the skills CLI command in your project's root directory to begin installation:

$npx skills install mukul975/Anthropic-Cybersecurity-Skills/analyzing-ransomware-network-indicators

Fetches analyzing-ransomware-network-indicators from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.

3

Select Cursor when prompted

The CLI shows a list of agents. Use arrow keys and space to select Cursor:

◆ Which agents do you want to install to?
│ ── Universal (.agents/skills) ────────────────
│ · Cline · Codex · Goose · Windsurf
│ ●Cursor(selected)
│ · Cursor · Aider · Continue
4

Verify installation

Confirm successful installation by checking the skill directory location:

.cursor/skills/analyzing-ransomware-network-indicators

Restart Cursor to activate analyzing-ransomware-network-indicators. Access via /analyzing-ransomware-network-indicators in your agent's command palette.

Security Notice

We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.

Skills execute code in your environment. Always review source, verify the publisher, and test in isolation before production.

Documentation

name
analyzing-ransomware-network-indicators
description
Identify ransomware network indicators including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange via Zeek conn.log and NetFlow analysis
domain
cybersecurity
subdomain
threat-hunting
tags
- ransomware - c2-beaconing - zeek - netflow - tor - exfiltration - network-forensics
version
'1.0'
author
mahipal
license
Apache-2.0
d3fend_techniques
- File Metadata Consistency Validation - Certificate Analysis - Application Protocol Command Analysis - Content Format Conversion - File Content Analysis
nist_csf
- DE.CM-01 - DE.AE-02 - DE.AE-07 - ID.RA-05

Analyzing Ransomware Network Indicators

Overview

Before and during ransomware execution, adversaries establish C2 channels, exfiltrate data, and download encryption keys. This skill analyzes Zeek conn.log and NetFlow data to detect beaconing patterns (regular-interval callbacks), connections to known TOR exit nodes, large outbound data transfers, and suspicious DNS activity associated with ransomware families.

When to Use

  • When investigating security incidents that require analyzing ransomware network indicators
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Zeek conn.log files or NetFlow CSV/JSON exports
  • Python 3.8+ with standard library
  • TOR exit node list (fetched from Tor Project or threat intel feeds)
  • Optional: Known ransomware C2 IOC list

Steps

  1. Parse Connection Logs — Ingest Zeek conn.log (TSV) or NetFlow records into structured format
  2. Detect Beaconing Patterns — Calculate connection interval statistics (mean, stddev, coefficient of variation) to identify periodic callbacks
  3. Check TOR Exit Node Connections — Cross-reference destination IPs against current TOR exit node list
  4. Identify Data Exfiltration — Flag connections with unusually high outbound byte ratios to external IPs
  5. Analyze DNS Patterns — Detect DGA-like domain queries and high-entropy subdomains
  6. Score and Correlate — Apply composite risk scoring across all indicator types
  7. Generate Report — Produce structured report with timeline and MITRE ATT&CK mapping

Expected Output

  • JSON report with beaconing detections and interval statistics
  • TOR exit node connection alerts
  • Data exfiltration flow analysis
  • Composite ransomware risk score with MITRE mapping (T1071, T1573, T1041)

List & Monetize Your Skill

Submit your Claude Code skill and start earning

Get started →

Use Cases

Task Automation & Efficiency

Automate repetitive workflows and reduce manual effort

Example

Generate reports, summarize documents, draft communications

Save 3-5 hours per week on routine tasks

Knowledge Enhancement

Learn new skills, understand complex topics, get expert guidance

Example

Explain concepts, provide examples, suggest learning resources

Accelerate learning and skill development by 2x

Quality Improvement

Enhance output quality through reviews, suggestions, and refinements

Example

Review drafts, suggest improvements, catch errors

Improve work quality by 30-40% with less effort

Implementation Guide

Prerequisites

  • Claude Desktop or compatible AI client with skill support
  • Clear understanding of task or problem to solve
  • Willingness to iterate and refine outputs

Time Estimate

15-45 minutes depending on use case complexity

Steps

  1. 1Install skill using provided installation command
  2. 2Test with simple use case relevant to your work
  3. 3Evaluate output quality and relevance
  4. 4Iterate on prompts to improve results
  5. 5Integrate into regular workflow if valuable

Common Pitfalls

  • Expecting perfect results without iteration
  • Not providing enough context in prompts
  • Using skill for tasks outside its intended scope
  • Accepting outputs without review and validation

Best Practices

✓ Do

  • +Start with clear, specific prompts
  • +Provide relevant context and constraints
  • +Review and refine all outputs before using
  • +Iterate to improve output quality
  • +Document successful prompt patterns

✗ Don't

  • Don't use without understanding skill limitations
  • Don't skip validation of outputs
  • Don't share sensitive information in prompts
  • Don't expect skill to replace human judgment

💡 Pro Tips

  • Be specific about desired format and style
  • Ask for multiple options to choose from
  • Request explanations to understand reasoning
  • Combine AI efficiency with human expertise

When to Use This

✓ Use when

Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.

✗ Avoid when

Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.

Learning Path

  1. 1Familiarize yourself with skill capabilities and limitations
  2. 2Start with low-risk, non-critical tasks
  3. 3Progress to more complex and valuable use cases
  4. 4Build expertise through regular use and experimentation

Related Skills

Reviews

4.653 reviews
  • C
    Charlotte ThomasDec 28, 2024

    Keeps context tight: analyzing-ransomware-network-indicators is the kind of skill you can hand to a new teammate without a long onboarding doc.

  • C
    Chen LopezDec 28, 2024

    I recommend analyzing-ransomware-network-indicators for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.

  • A
    Aditi ShahDec 20, 2024

    analyzing-ransomware-network-indicators has been reliable in day-to-day use. Documentation quality is above average for community skills.

  • D
    Dhruvi JainDec 12, 2024

    Keeps context tight: analyzing-ransomware-network-indicators is the kind of skill you can hand to a new teammate without a long onboarding doc.

  • C
    Chinedu SinghDec 12, 2024

    analyzing-ransomware-network-indicators reduced setup friction for our internal harness; good balance of opinion and flexibility.

  • L
    Liam TandonNov 19, 2024

    Registry listing for analyzing-ransomware-network-indicators matched our evaluation — installs cleanly and behaves as described in the markdown.

  • I
    Ishan KhanNov 11, 2024

    analyzing-ransomware-network-indicators fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.

  • O
    OshnikdeepNov 3, 2024

    Registry listing for analyzing-ransomware-network-indicators matched our evaluation — installs cleanly and behaves as described in the markdown.

  • M
    Mei AndersonNov 3, 2024

    analyzing-ransomware-network-indicators is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.

  • G
    Ganesh MohaneOct 22, 2024

    analyzing-ransomware-network-indicators reduced setup friction for our internal harness; good balance of opinion and flexibility.

showing 1-10 of 53

1 / 6

Discussion

Comments — not star reviews
  • No comments yet — start the thread.