Analyzing Ransomware Network Indicators
FreeDetect ransomware network activity through log analysis.
Free · Opens the source repo
What Analyzing Ransomware Network Indicators does
This skill is designed for cybersecurity professionals who need to identify ransomware-related network indicators by analyzing logs from Zeek and NetFlow data. It focuses on detecting patterns associated with command and control (C2) communications, data exfiltration, and suspicious DNS activities that may indicate ransomware operations. By parsing connection logs and applying statistical analysis, users can uncover periodic callbacks, large outbound data transfers, and connections to known TOR exit nodes, which are critical for understanding the behavior of ransomware attacks.
The skill operates by first ingesting Zeek conn.log files or NetFlow data in CSV or JSON format. It then calculates connection interval statistics to detect beaconing patterns, checks for connections to TOR exit nodes, and flags any unusual data exfiltration activities. Additionally, it analyzes DNS queries for signs of domain generation algorithms (DGAs) that are often used by ransomware. The output includes a structured JSON report detailing the findings, along with a composite risk score that maps to the MITRE ATT&CK framework, providing context for the identified indicators.
This tool is particularly useful for security operations center (SOC) analysts and threat hunters who are investigating potential ransomware incidents or validating their security monitoring capabilities. By providing structured procedures and clear outputs, it aids in the identification and analysis of ransomware network activity, making it an essential resource for those involved in incident response and threat detection.
Overall, this skill streamlines the process of threat hunting for ransomware-related activities, enabling analysts to respond more effectively to incidents and bolster their organization's defenses against such attacks.
When to use it
Use this skill when investigating security incidents involving ransomware or when building detection rules for threat hunting.
When not to use it
This skill is not suitable for general-purpose network analysis or for environments without Zeek or NetFlow data.
What you can build with it
Incident Response Investigation
Use this skill to analyze network logs during a ransomware incident to identify malicious activity.
Threat Hunting
Leverage the skill to build detection rules and queries targeting known ransomware behaviors.
Security Monitoring Validation
Validate your organization's security monitoring coverage by assessing the detection of ransomware indicators.
How to install Analyzing Ransomware Network Indicators
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-ransomware-network-indicators --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Ransomware Network Indicators
Overview
Before and during ransomware execution, adversaries establish C2 channels, exfiltrate data, and download encryption keys. This skill analyzes Zeek conn.log and NetFlow data to detect beaconing patterns (regular-interval callbacks), connections to known TOR exit nodes, large outbound data transfers, and suspicious DNS activity associated with ransomware families.
When to Use
- When investigating security incidents that require analyzing ransomware network indicators
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Zeek conn.log files or NetFlow CSV/JSON exports
- Python 3.8+ with standard library
- TOR exit node list (fetched from Tor Project or threat intel feeds)
- Optional: Known ransomware C2 IOC list
Steps
- Parse Connection Logs — Ingest Zeek conn.log (TSV) or NetFlow records into structured format
- Detect Beaconing Patterns — Calculate connection interval statistics (mean, stddev, coefficient of variation) to identify periodic callbacks
- Check TOR Exit Node Connections — Cross-reference destination IPs against current TOR exit node list
- Identify Data Exfiltration — Flag connections with unusually high outbound byte ratios to external IPs
- Analyze DNS Patterns — Detect DGA-like domain queries and high-entropy subdomains
- Score and Correlate — Apply composite risk scoring across all indicator types
- Generate Report — Produce structured report with timeline and MITRE ATT&CK mapping
Expected Output
- JSON report with beaconing detections and interval statistics
- TOR exit node connection alerts
- Data exfiltration flow analysis
- Composite ransomware risk score with MITRE mapping (T1071, T1573, T1041)
Frequently asked questions about Analyzing Ransomware Network Indicators
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.