Which Python libraries are used for the analysis?

The skill utilizes the Zeek Analysis Tools (ZAT) library for log ingestion and Pandas for high-performance statistical data manipulation.

How does it distinguish a beacon from normal traffic?

It calculates the standard deviation of the time intervals between connections; a very low standard deviation relative to the mean indicates a highly regular, automated pattern characteristic of a beacon.

What log format does this skill require?

This skill is specifically designed to process Zeek (formerly Bro) conn.log files, typically exported in TSV or JSON format.

Can this skill handle large log files?

Yes, by leveraging Pandas DataFrames, it can efficiently process and group hundreds of thousands of connection records for statistical evaluation.

Zeek C2 Beaconing Detection

Name: Zeek C2 Beaconing Detection
Author: micsapp

bymicsapp

0•

보안 및 테스팅

Detects command-and-control beaconing patterns by performing statistical analysis on Zeek network connection logs.

This skill enables security professionals and SOC analysts to identify potential command-and-control (C2) traffic by analyzing the regularity of connection intervals within Zeek's conn.log. By utilizing the ZAT (Zeek Analysis Tools) library to process logs into Pandas DataFrames, it calculates the standard deviation and coefficient of variation of inter-arrival times between source and destination pairs. This statistical approach effectively flags periodic connections with low jitter, which are often indicative of automated malware callbacks and persistent threats.

주요 기능

01Automated Zeek conn.log parsing via ZAT library

02Jitter detection using coefficient of variation

03Statistical inter-arrival time (IAT) analysis

04Source/Destination pair grouping for targeted hunting

050 GitHub stars

06Pandas-integrated processing for large-scale log data

사용 사례

01Validating network monitoring coverage against known C2 techniques

02Investigating security incidents involving suspected compromised hosts

03Threat hunting for persistent malware callbacks in enterprise networks

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills detecting-beaconing-patterns-with-zeek

For use in Claude.ai and ChatGPT

주요 기능

01Automated Zeek conn.log parsing via ZAT library

02Jitter detection using coefficient of variation

03Statistical inter-arrival time (IAT) analysis

04Source/Destination pair grouping for targeted hunting

050 GitHub stars

06Pandas-integrated processing for large-scale log data

사용 사례

01Validating network monitoring coverage against known C2 techniques

02Investigating security incidents involving suspected compromised hosts

03Threat hunting for persistent malware callbacks in enterprise networks

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills detecting-beaconing-patterns-with-zeek

For use in Claude.ai and ChatGPT