恶意流量与C2通信分析

---
name: network-traffic-analysis
description: >
  Analyze network traffic captures (PCAP/PCAPNG) to identify malicious communications including
  C2 traffic, data exfiltration, DNS tunneling, and beaconing behavior. Use when investigating
  suspicious network activity, analyzing malware communications, or performing incident response
  on captured traffic. Supports Wireshark/tshark, Scapy, and custom Python analysis scripts.
---

# Network Traffic Analysis

Analyze packet captures to identify malicious network communications, extract indicators of
compromise, and understand malware command-and-control protocols.

## Prerequisites

- Python 3.10+ with `scapy`, `dpkt` packages
- [Wireshark/tshark](https://www.wireshark.org/) (recommended)
- PCAP or PCAPNG capture file
- Optional: `pyshark`, `cryptography` for TLS analysis

Install Python dependencies:
```bash
pip install scapy dpkt pyshark cryptography
```

## Steps

### 1. Load and Assess the Capture

Open the PCAP file and get an overview of the traffic volume, time range, and protocols.

```bash
# Quick statistics with tshark
tshark -r capture.pcap -q -z io,stat,0

# Protocol hierarchy
tshark -r capture.pcap -q -z io,phs

# Endpoint statistics
tshark -r capture.pcap -q -z endpoints,ip

# Conversation statistics
tshark -r capture.pcap -q -z conv,tcp
```

Or use the automated analyzer:
```bash
python scripts/pcap_analyzer.py --pcap capture.pcap --output report.json
```

### 2. Identify Protocols in Use

Determine which protocols are present to guide further analysis.

```bash
# Protocol distribution
tshark -r capture.pcap -q -z io,phs

# Filter by specific protocol
tshark -r capture.pcap -Y "dns" -c 20
tshark -r capture.pcap -Y "http" -c 20
tshark -r capture.pcap -Y "tls" -c 20
```

**Suspicious protocol usage:**
- IRC on non-standard ports (older botnet C2)
- DNS with unusually large queries or responses (DNS tunneling)
- HTTP/HTTPS to raw IP addresses (no domain)
- Custom protocols on high-numbered ports
- Encrypted traffic on ports not typically encrypted

### 3. Extract DNS Queries

DNS queries reveal domain lookups that can identify C2 infrastructure and DGA activity.

```bash
# All DNS queries
tshark -r capture.pcap -Y "dns.qr==0" -T fields -e dns.qry.name | sort | uniq -c | sort -rn

# DNS responses with IPs
tshark -r capture.pcap -Y "dns.qr==1 && dns.a" -T fields -e dns.qry.name -e dns.a

# Focused DNS analysis
python scripts/dns_analyzer.py --pcap capture.pcap --output dns_report.json
```

**What to look for:**
- Domains with high entropy (DGA indicators)
- Unusually long subdomains (DNS tunneling)
- Queries to known malicious domains
- Fast-flux DNS (same domain resolving to many IPs)
- DNS TXT record queries with encoded data
- High volume of NXDOMAIN responses (DGA miss rate)

### 4. Analyze HTTP/HTTPS Connections

Examine web traffic for C2 communication, payload downloads, and data exfiltration.

```bash
# HTTP requests
tshark -r capture.pcap -Y "http.request" -T fields \
    -e ip.src -e http.host -e http.request.uri -e http.request.method

# HTTP responses with content types
tshark -r capture.pcap -Y "http.response" -T fields \
    -e ip.src -e http.response.code -e http.content_type

# HTTP POST data (potential exfiltration)
tshark -r capture.pcap -Y "http.request.method==POST" -T fields \
    -e ip.dst -e http.host -e http.request.uri -e http.file_data

# User-Agent strings
tshark -r capture.pcap -Y "http.user_agent" -T fields -e http.user_agent | sort | uniq -c
```

**Suspicious HTTP indicators:**
- User-Agent strings that do not match the system's browser
- POST requests to raw IP addresses
- Encoded/encrypted data in URL parameters or POST bodies
- Requests to newly registered domains
- Regular-interval requests (beaconing)
- Large POST requests (data exfiltration)

### 5. Identify C2 Traffic Patterns

Look for command-and-control communication patterns.

```bash
# Detect beaconing (regular interval connections)
python scripts/beacon_detector.py --pcap capture.pcap --output beacons.json

# Long-duration connections
tshark -r capture.pcap -q -z conv,tcp | sort -t'|' -k5 -rn | head -20
```

**C2 indicators:**
- Regular interval connections to the same host (beaconing)
- Small request/large response pattern (command/result)
- Encrypted traffic on non-standard ports
- Keep-alive connections with periodic small data transfers
- Traffic to IPs in hosting/VPS ranges (not CDN)
- Connections that survive system reboots

### 6. Detect Data Exfiltration

Identify potential data theft through various channels.

```bash
# Large outbound transfers
tshark -r capture.pcap -q -z conv,tcp | awk -F'|' '{if($6>1000000) print}'

# DNS exfiltration (large TXT records, long queries)
tshark -r capture.pcap -Y "dns.qry.name matches \"^[a-zA-Z0-9]{30,}\"" \
    -T fields -e dns.qry.name

# HTTPS volume analysis
tshark -r capture.pcap -Y "tls" -T fields -e ip.src -e ip.dst -e frame.len | \
    awk '{sum[$1"->"$2]+=$3} END {for(k in sum) print sum[k], k}' | sort -rn
```

**Exfiltration channels:**
- DNS TXT queries with encoded data
- HTTP POST with base64-encoded bodies
- HTTPS to cloud storage services (Dropbox, Google Drive, OneDrive)
- ICMP data tunneling
- Steganography in image downloads
- Custom protocols on allowed outbound ports

### 7. Extract Transferred Files

Carve files from the network traffic for further analysis.

```bash
# Export HTTP objects with tshark
tshark -r capture.pcap --export-objects http,./exported_files/

# Export SMB objects
tshark -r capture.pcap --export-objects smb,./exported_smb/

# Export TFTP objects
tshark -r capture.pcap --export-objects tftp,./exported_tftp/
```

After extraction:
1. Calculate hashes of all extracted files
2. Check file types with `file` command
3. Submit hashes to VirusTotal
4. Analyze suspicious executables with static/dynamic analysis

### 8. Analyze TLS Certificates

Examine TLS handshakes for self-signed certificates and known malicious fingerprints.

```bash
# Extract TLS certificate information
tshark -r capture.pcap -Y "tls.handshake.certificate" -T fields \
    -e ip.src -e ip.dst \
    -e x509ce.dNSName \
    -e x509af.serialNumber

# Extract SNI (Server Name Indication)
tshark -r capture.pcap -Y "tls.handshake.extensions_server_name" -T fields \
    -e ip.src -e ip.dst -e tls.handshake.extensions_server_name

# JA3 fingerprints (requires tshark 3.x+)
tshark -r capture.pcap -Y "tls.handshake.type==1" -T fields \
    -e ip.src -e ip.dst -e tls.handshake.ja3
```

**Suspicious TLS indicators:**
- Self-signed certificates
- Certificates with very short validity periods
- Certificates with unusual subject fields
- Known malicious JA3/JA3S fingerprints
- Certificate chain issues
- TLS on non-standard ports

### 9. Identify Beaconing Behavior

Detect regular-interval communication that indicates automated C2 check-ins.

```bash
python scripts/beacon_detector.py --pcap capture.pcap \
    --min-connections 10 \
    --max-jitter 0.2 \
    --output beacons.json
```

**Analysis approach:**
1. Group connections by source-destination pair
2. Calculate time deltas between connections
3. Compute standard deviation of intervals
4. Low deviation relative to mean = likely beaconing
5. Account for jitter (intentional randomization by malware)

### 10. Correlate with Known Malicious Infrastructure

Cross-reference network indicators with threat intelligence.

```bash
# Extract all unique IPs
tshark -r capture.pcap -T fields -e ip.dst | sort -u > external_ips.txt

# Extract all DNS domains
tshark -r capture.pcap -Y "dns.qr==0" -T fields -e dns.qry.name | sort -u > domains.txt

# Check against threat intel (requires API keys)
# Use the ioc-extraction and threat-intelligence skills for enrichment
```

## Offline vs Online Mode

**Offline mode (default):** All traffic analysis is performed locally on the PCAP file.
Pattern detection, statistical analysis, and protocol parsing work without internet access.

**Online mode:** Enrich findings with external threat intelligence:
- Check IPs/domains against VirusTotal, AbuseIPDB
- Look up JA3 fingerprints in ja3er.com database
- Query Shodan for infrastructure details
- Cross-reference with known C2 IP lists

## Tips

- Filter early and often to reduce noise in large captures
- Start with DNS and HTTP for quick wins before analyzing encrypted traffic
- Use Wireshark's "Follow TCP Stream" to reconstruct conversations
- Export suspicious sessions for detailed protocol analysis
- Compare traffic timestamps with system event logs
- Look for traffic that does not match normal business hours
- Check for geographic anomalies in destination IPs