Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.
SkillScore29Maintained
Automatic
◆Security & AppSec pack
Last verified 7/27/2026
What it changes
Passed 7 of 24 test cases with the skill, and 4 of 24 without it.
Without skill17%
With skill29%
3 fixed4 passed either way17 still failing0 broke
Pass-rate lift
+13 pp
Tokens
+256%
Agent turns
0%
Response time
-26%
Model gemini-3.6-flashMeasured 7/27/2026v17 of 24 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
What's inside
The instructions your model reads when the skill loads.
SKILL.md371 lines3 filesincludes scripts
Analyzing Command-and-Control Communication
When to Use
Reverse engineering a malware sample has revealed network communication that needs protocol analysis
Building network-level detection signatures for a specific C2 framework (Cobalt Strike, Metasploit, Sliver)
Mapping C2 infrastructure including primary servers, fallback domains, and dead drops
Analyzing encrypted or encoded C2 traffic to understand the command set and data format
Attributing malware to a threat actor based on C2 infrastructure patterns and tooling
Do not use for general network anomaly detection; this is specifically for understanding known or suspected C2 protocols from malware analysis.
Prerequisites
PCAP capture of malware network traffic (from sandbox, network tap, or full packet capture)
Wireshark/tshark for packet-level analysis
Reverse engineering tools (Ghidra, dnSpy) for understanding C2 code in the malware binary
Python 3.8+ with scapy, dpkt, and requests for protocol analysis and replay
Threat intelligence databases for C2 infrastructure correlation (VirusTotal, Shodan, Censys)
JA3/JA3S fingerprint databases for TLS-based C2 identification
Workflow
Step 1: Identify the C2 Channel
Determine the protocol and transport used for C2 communication:
C2 Communication Channels:
━━━━━━━━━━━━━━━━━━━━━━━━━
HTTP/HTTPS: Most common; uses standard web traffic to blend in
Indicators: Regular POST/GET requests, specific URI patterns, custom headers
DNS: Tunneling data through DNS queries and responses
Indicators: High-volume TXT queries, long subdomain names, high entropy
Custom TCP/UDP: Proprietary binary protocol on non-standard port
Indicators: Non-HTTP traffic on high ports, unknown protocol
ICMP: Data encoded in ICMP echo/reply payloads