About

Imported from mukul975/anthropic-cybersecurity-skills (skills/analyzing-ransomware-network-indicators/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-ransomware-network-indicators. Copyright stays with the author (Apache-2.0).

Analyzing Ransomware Network Indicators

Name: analyzing-ransomware-network-indicators
Author: mukul975

Overview

Before and during ransomware execution, adversaries establish C2 channels, exfiltrate data, and download encryption keys. This skill analyzes Zeek conn.log and NetFlow data to detect beaconing patterns (regular-interval callbacks), connections to known TOR exit nodes, large outbound data transfers, and suspicious DNS activity associated with ransomware families.

When to Use

When investigating security incidents that require analyzing ransomware network indicators
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Zeek conn.log files or NetFlow CSV/JSON exports
Python 3.8+ with standard library
TOR exit node list (fetched from Tor Project or threat intel feeds)
Optional: Known ransomware C2 IOC list

Steps

Parse Connection Logs — Ingest Zeek conn.log (TSV) or NetFlow records into structured format
Detect Beaconing Patterns — Calculate connection interval statistics (mean, stddev, coefficient of variation) to identify periodic callbacks
Check TOR Exit Node Connections — Cross-reference destination IPs against current TOR exit node list
Identify Data Exfiltration — Flag connections with unusually high outbound byte ratios to external IPs
Analyze DNS Patterns — Detect DGA-like domain queries and high-entropy subdomains
Score and Correlate — Apply composite risk scoring across all indicator types
Generate Report — Produce structured report with timeline and MITRE ATT&CK mapping

Expected Output

JSON report with beaconing detections and interval statistics
TOR exit node connection alerts
Data exfiltration flow analysis
Composite ransomware risk score with MITRE mapping (T1071, T1573, T1041)

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-ransom-b6e81c/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-analyzing-ransom-b6e81c.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-analyzing-ransom-b6e81c",
  "kind": "skill",
  "name": "analyzing-ransomware-network-indicators",
  "description": "Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "ransomware",
      "c2-beaconing",
      "zeek",
      "netflow",
      "tor",
      "exfiltration",
      "network-forensics",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/analyzing-ransomware-network-indicators/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/analyzing-ransomware-network-indicators/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/analyzing-ransomware-network-indicators/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Analyzing Ransomware Network Indicators\n\n## Overview\n\nBefore and during ransomware execution, adversaries establish C2 channels, exfiltrate data, and download encryption keys. This skill analyzes Zeek conn.log and NetFlow data to detect beaconing patterns (regular-interval callbacks), connections to known TOR exit nodes, large outbound data transfers, and suspicious DNS activity associated with ransomware families.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing ransomware network indicators\n- When building detection rules or threat hunting queries for this d",
  "cost": {
    "context_tokens": 484
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-ransom-b6e81c/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.