Turn malware traffic into detection rules.
What it does
Decodes malware command-and-control traffic and produces network detection signatures.
When to use it
Use when malware reverse engineering reveals traffic needing protocol analysis, or when building detection signatures and mapping command-and-control infrastructure.
How to use it
Give it a malware traffic capture; it returns findings about beaconing, HTTP requests, DNS queries, framework identification, and detection rules.
What you provide
- Your files
Uses
Good to know
- sends a credential to a server: api_key; VT_API_KEY
Latest review
What you need · 10
Requires Python 3.8 or later for protocol analysis and replay.
Requires Wireshark or its tshark command for packet-level analysis.
Access · 2
This skill
Shodan
Read
Looks up hosts on Shodan
VirusTotal
Read
Looks up domains on VirusTotal