恶意流量析微
原名：analyzing-network-traffic-of-malware
分析恶意软件在沙箱执行期间生成的网络流量。
- 分类
- 开发提效
- 版本
- v1.0.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 1
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-09-06
- TRACE 评分
- 3.6 / 5
内容概览
- Sandbox execution has captured a PCAP file and the network behavior needs detailed analysis - Identifying the C2 protocol structure for writing network detection signatures - Determining what data the malware exfiltrates and to which external infrastructure - Analyzing DNS tunneling, domain generation algorithms (DGA), or fast-flux behavior - Creating Suricata/Snort signatures based on observed malware network patterns Do not use for host-based analysis of malware behavior; use Cuckoo sandbox reports or Volatility memory analysis for process-level activity. - Wireshark 4.x installed for interactive PCAP analysis - tshark (Wireshark CLI) for scripted packet extraction - Zeek installed for automated metadata generation from PCAPs - Suricata with ET Open/ET Pro rulesets for signature matching - NetworkMiner for file extraction and credential detection from PCAPs - Python 3.8+ with scapy a…