Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-network-packet-capture-analysis/references/standards.md

@@ -0,0 +1,13 @@
+# Standards - Network Packet Capture Analysis
+## Standards
+- NIST SP 800-86: Guide to Integrating Forensic Techniques
+- RFC 791 (IP), RFC 793 (TCP), RFC 768 (UDP)
+- PCAP file format: https://wiki.wireshark.org/Development/LibpcapFileFormat
+- PCAPNG format: https://pcapng.com/
+## Tools
+- Wireshark: GUI packet analyzer
+- tshark: Command-line packet analyzer
+- tcpdump: Packet capture utility
+- Scapy (Python): Packet manipulation library
+- Zeek (Bro): Network security monitoring
+- NetworkMiner: Network forensic analysis tool

skills/performing-network-packet-capture-analysis/references/workflows.md

@@ -0,0 +1,21 @@
+# Workflows - Packet Capture Analysis
+## Workflow: PCAP Forensic Investigation
+```
+Open PCAP in Wireshark
+    |
+Review protocol hierarchy (Statistics > Protocol Hierarchy)
+    |
+Identify top talkers (Statistics > Endpoints)
+    |
+Filter for suspicious protocols/ports
+    |
+Extract files (File > Export Objects)
+    |
+Analyze DNS for C2 domains
+    |
+Detect beaconing patterns
+    |
+Extract credentials from clear-text protocols
+    |
+Generate investigation report
+```