mcpField
A
analyzing-ransomware-network-indicators

analyzing-ransomware-network-indicators

github.com/mukul975Security35.2k314 installsUpdated 8w ago
Repository

About analyzing-ransomware-network-indicators

A security-analysis skill for SOC analysts and threat hunters examining ransomware-related network indicators in Zeek conn.log or NetFlow data. It correlates beaconing, TOR connections, outbound transfers, and DNS patterns into a risk-scored report with MITRE ATT&CK mapping.

Key features

  1. 01Parse Zeek and NetFlow records
  2. 02Detect periodic beaconing
  3. 03Check connections to TOR exit nodes
  4. 04Flag unusual outbound data transfers
  5. 05Analyze suspicious DNS patterns
  6. 06Generate risk-scored reports with MITRE mapping

Use cases

  1. 01Investigate ransomware incidents
  2. 02Develop network threat-hunting queries
  3. 03Validate monitoring coverage for ransomware indicators

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-ransomware-network-indicators

After installing, type/analyzing-ransomware-network-indicatorsin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Analyzing Ransomware Network Indicators

Overview

Before and during ransomware execution, adversaries establish C2 channels, exfiltrate data, and download encryption keys. This skill analyzes Zeek conn.log and NetFlow data to detect beaconing patterns (regular-interval callbacks), connections to known TOR exit nodes, large outbound data transfers, and suspicious DNS activity associated with ransomware families.

When to Use

  • When investigating security incidents that require analyzing ransomware network indicators
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Zeek conn.log files or NetFlow CSV/JSON exports
  • Python 3.8+ with standard library
  • TOR exit node list (fetched from Tor Project or threat intel feeds)
  • Optional: Known ransomware C2 IOC list

Steps

  1. Parse Connection Logs — Ingest Zeek conn.log (TSV) or NetFlow records into structured format
  2. Detect Beaconing Patterns — Calculate connection interval statistics (mean, stddev, coefficient of variation) to identify periodic callbacks
  3. Check TOR Exit Node Connections — Cross-reference destination IPs against current TOR exit node list
  4. Identify Data Exfiltration — Flag connections with unusually high outbound byte ratios to external IPs
  5. Analyze DNS Patterns — Detect DGA-like domain queries and high-entropy subdomains
  6. Score and Correlate — Apply composite risk scoring across all indicator types
  7. Generate Report — Produce structured report with timeline and MITRE ATT&CK mapping

Expected Output

  • JSON report with beaconing detections and interval statistics
  • TOR exit node connection alerts
  • Data exfiltration flow analysis
  • Composite ransomware risk score with MITRE mapping (T1071, T1573, T1041)

Comments

Markdown supported