Results for “packet-analysis”

Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.

Automates packet capture analysis using tshark and pyshark to extract protocol statistics, detect suspicious flows, identify IOCs, and analyze DNS anomalies from PCAP files.

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts.

Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.

Analyzes malware-generated network traffic from PCAP files to identify C2 protocols, data exfiltration, DNS tunneling, and beaconing patterns using Wireshark, Zeek, Suricata, and Python.

Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure for detection development and threat intelligence.

Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly/daily traffic pattern profiling.

Analyzes email sequence performance metrics. Evaluates open rates, click rates, reply rates, and conversion by step. Identifies drop-off points, benchmarks against industry averages, and recommends optimizations.

Analyzes .NET project code coverage and CRAP (Change Risk Anti-Patterns) scores to identify risk hotspots, methods blocking coverage gains, and prioritize where to add tests.

Perform evidence-backed security audits for the Adobe Dispatcher Apache HTTP Server module and related HTTPD configuration in AMS workflows.

Provides file paths to language-specific reference files for polyglot test analysis skills, enabling framework-aware detection of test markers, assertions, and patterns across .NET, Python, TypeScript, Java, Go, Ruby, Rust, Swift, Kotlin, PowerShell, and C++.

Inspect, profile, clean, reconcile, analyze, visualize, and verify spreadsheet data while preserving formulas, formatting, types, and source files. Use when working with .xlsx, .xlsm, .xls, .ods, .csv, or .tsv files; answering questions from a workbook; auditing formulas or data quality; comparing sheets or versions; producing pivots, charts, forecasts, or summary workbooks; repairing malformed tables; or validating that spreadsheet edits and calculations are accurate.

Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications.

Analyze suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior detection.

Communications-domain literature review with Claude-style knowledge-base-first retrieval. Use when the task is about communications, wireless, networking, satellite/NTN, Wi-Fi, cellular, transport protocols, congestion control, routing, scheduling, MAC/PHY, rate adaptation, channel estimation, beamforming, or communication-system research and the user wants papers, related work, a survey, or a landscape summary. Search Zotero, Obsidian, and local paper folders first when available, then search IEEE Xplore, ScienceDirect, ACM Digital Library, and broader web in that order.

`analysis-agent`/`task-agent`/`review-agent`: use when latency, throughput, bundle, memory, CPU, query, rendering, or resource cost needs a budget; skip without performance risk.

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns using the Python netflow library.

Plan and execute large refactor or rewrite efforts efficiently with parallel multi-agent analysis and implementation.

Guide through a structured data analysis workflow: define the question, validate data quality, select the appropriate analytical method, and produce decision-ready findings with caveats.

`analysis-agent`/`task-agent`/`review-agent`: use when uploads, object storage, streaming, MIME, scanning, access, retention, or cleanup changes; skip without file/storage impact.

Evaluates Base ERC-20 tokens by contract address, returning a 0-100 score across five criteria, launch protocol classification, security flags, and a narrative interpretation.

PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.

Organize email inbox, draft replies, send messages, and verify delivery with evidence-based confirmation.

Deploy and query Arkime for full packet capture network traffic analysis, including session search, PCAP download, beaconing detection, DNS tunneling analysis, and TLS anomaly identification.

Use this skill for on-chain data, explorers, Dune-style queries, wallets, transfers, contract events. Trigger when the task involves crypto work related to Onchain Data Analytics, production implementation, audits, debugging, strategy, or validation.

Maps intrusion activity to the Lockheed Martin Cyber Kill Chain framework to identify adversary phase completion, detection gaps, and defensive controls for post-incident analysis and prevention.

Deploy Zeek network security monitor to capture, parse, and analyze network traffic metadata for threat detection, anomaly identification, and forensic investigation.

Cleans datasets, detects anomalies, generates reports, and creates visualizations using pandas, scikit-learn, and plotting libraries to turn raw data into client-ready deliverables.

Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, and protocol abuse for C2 and data exfiltration.

Internal network assessment. VLAN hopping, ARP spoofing detection, broadcast protocol abuse (LLMNR/NBT-NS/mDNS), network segmentation verification, SNMP enumeration, NFS exposure, router/switch audit, and internal service mapping. Assumes attacker has network access. Uses nmap, arp-scan, nbtscan, snmpwalk, onesixtyone, smbmap, nfs-common, masscan, hping3, and netexec.