mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-26 06:10:57 +03:00
mukul975
cb8d79e068
- Add validated mitre_attack frontmatter to all 754 skills (286 distinct techniques), verified against MITRE ATT&CK v19.1 via the official mitreattack-python library: 0 revoked, deprecated, or invalid IDs - Curate precise per-skill technique IDs for forensics, malware-analysis, threat-intel, and red-team skills (e.g. DCSync -> T1003.006, Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003) - Reconcile v19.1 tactic restructuring: Defense Evasion split into Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.* family and T1070.001/.002 remapped to active equivalents (T1685.*) - Normalize word-split tags across 35 skills (remove filename-derived stopword tags, add semantic cybersecurity tags) - Add api-reference.md for 3 skills that were missing it - Update README ATT&CK section with accurate v19.1 tactic distribution
67 lines
2.2 KiB
Markdown
67 lines
2.2 KiB
Markdown
---
|
|
name: performing-network-traffic-analysis-with-tshark
|
|
description: Automate network traffic analysis using tshark and pyshark for protocol
|
|
statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction
|
|
from PCAP files
|
|
domain: cybersecurity
|
|
subdomain: network-security
|
|
tags:
|
|
- tshark
|
|
- pyshark
|
|
- pcap
|
|
- packet-analysis
|
|
- network-forensics
|
|
- wireshark
|
|
- traffic-analysis
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
nist_csf:
|
|
- PR.IR-01
|
|
- DE.CM-01
|
|
- ID.AM-03
|
|
- PR.DS-02
|
|
mitre_attack:
|
|
- T1046
|
|
- T1040
|
|
- T1557
|
|
- T1071
|
|
- T1005
|
|
---
|
|
|
|
# Performing Network Traffic Analysis with TShark
|
|
|
|
## Overview
|
|
|
|
This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.
|
|
|
|
|
|
## When to Use
|
|
|
|
- When conducting security assessments that involve performing network traffic analysis with tshark
|
|
- When following incident response procedures for related security events
|
|
- When performing scheduled security testing or auditing activities
|
|
- When validating security controls through hands-on testing
|
|
|
|
## Prerequisites
|
|
|
|
- tshark (Wireshark CLI) installed and in PATH
|
|
- Python 3.8+ with pyshark library
|
|
- PCAP or PCAPNG capture file for analysis
|
|
|
|
## Steps
|
|
|
|
1. **Extract Protocol Statistics** — Generate protocol hierarchy and conversation statistics from the capture
|
|
2. **Identify Top Talkers** — Rank source/destination IPs by volume and connection count
|
|
3. **Detect Suspicious Flows** — Flag port scanning patterns, unusual port usage, and high-frequency connections
|
|
4. **Extract Network IOCs** — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic
|
|
5. **Analyze DNS Traffic** — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records
|
|
6. **Generate Analysis Report** — Produce structured report with flow summaries and threat indicators
|
|
|
|
## Expected Output
|
|
|
|
- JSON report with protocol statistics and top talkers
|
|
- Suspicious flow detections with severity ratings
|
|
- Extracted IOCs (IPs, domains, URLs)
|
|
- DNS anomaly analysis results
|