New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Analyzing Ransomware Network Indicators

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and…

Apache-2.0Auto-check passedSecurity

Install Analyzing Ransomware Network Indicators

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-ransomware-network-indicators -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-ransomware-network-indicators --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/analyzing-ransomware-network-indicators .claude/skills/analyzing-ransomware-network-indicators && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
analyzing-ransomware-network-indicators
GitHub stars
34k
Token cost
~796 tokens
SKILL.md length
252 words
Files
4 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and…

  • Works in 7 steps: Parse Connection Logs — Ingest Zeek… → Detect Beaconing Patterns — Calculate… → Check TOR Exit Node Connections —… → …
  • Threat hunting for active ransomware network activity
  • SKILL.md covers Overview, When to Use, Prerequisites and Steps, plus 1 more section
  • Runs Python scripts from its folder

What it does

Analyzing Ransomware Network Indicators is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.

Its SKILL.md is about 800 tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Security, covering Security operations and Incident response. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Threat hunting for active ransomware network activity
  • Investigating suspected pre-encryption exfiltration during incident response

Example prompts

  • “/analyzing-ransomware-network-indicators”

Requirements

  • Python 3

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Parse Connection Logs — Ingest Zeek conn.log (TSV) or NetFlow records into structured format
  2. Detect Beaconing Patterns — Calculate connection interval statistics (mean, stddev, coefficient of variation) to identify periodic callbacks
  3. Check TOR Exit Node Connections — Cross-reference destination IPs against current TOR exit node list
  4. Identify Data Exfiltration — Flag connections with unusually high outbound byte ratios to external IPs
  5. Analyze DNS Patterns — Detect DGA-like domain queries and high-entropy subdomains
  6. Score and Correlate — Apply composite risk scoring across all indicator types
  7. Generate Report — Produce structured report with timeline and MITRE ATT&CK mapping

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Analyzing Ransomware Network Indicators loads about 796 tokens when it runs, and up to ~1.4k if it reads all its reference files. Until then it costs about 98 tokens; SKILL.md has 252 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~98
When it runs · the whole SKILL.md, loaded when a task matches
~796
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 252 words, ~796 tokens.

Download SKILL.mdSave it as .claude/skills/analyzing-ransomware-network-indicators/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
analyzing-ransomware-network-indicators
description
Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.
domain
cybersecurity
subdomain
threat-hunting
tags
ransomware, c2-beaconing, zeek, netflow, tor, exfiltration, network-forensics
version
1.0
author
mahipal
license
Apache-2.0
d3fend_techniques
File Metadata Consistency Validation, Certificate Analysis, Application Protocol Command Analysis, Content Format Conversion, File Content Analysis
nist_csf
DE.CM-01, DE.AE-02, DE.AE-07, ID.RA-05
mitre_attack
T1071.001, T1573, T1048, T1567.002, T1486
mitre_f3.version
1.1

Analyzing Ransomware Network Indicators

Overview

Before and during ransomware execution, adversaries establish C2 channels, exfiltrate data, and download encryption keys. This skill analyzes Zeek conn.log and NetFlow data to detect beaconing patterns (regular-interval callbacks), connections to known TOR exit nodes, large outbound data transfers, and suspicious DNS activity associated with ransomware families.

When to Use

  • When investigating security incidents that require analyzing ransomware network indicators
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Zeek conn.log files or NetFlow CSV/JSON exports
  • Python 3.8+ with standard library
  • TOR exit node list (fetched from Tor Project or threat intel feeds)
  • Optional: Known ransomware C2 IOC list

Steps

  1. Parse Connection Logs — Ingest Zeek conn.log (TSV) or NetFlow records into structured format
  2. Detect Beaconing Patterns — Calculate connection interval statistics (mean, stddev, coefficient of variation) to identify periodic callbacks
  3. Check TOR Exit Node Connections — Cross-reference destination IPs against current TOR exit node list
  4. Identify Data Exfiltration — Flag connections with unusually high outbound byte ratios to external IPs
  5. Analyze DNS Patterns — Detect DGA-like domain queries and high-entropy subdomains
  6. Score and Correlate — Apply composite risk scoring across all indicator types
  7. Generate Report — Produce structured report with timeline and MITRE ATT&CK mapping

Expected Output

  • JSON report with beaconing detections and interval statistics
  • TOR exit node connection alerts
  • Data exfiltration flow analysis
  • Composite ransomware risk score with MITRE mapping (T1071, T1573, T1041)

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/analyzing-ransomware-network-indicators of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Analyzing Ransomware Network Indicators next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Analyzing Ransomware Network Indicators compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Analyzing Ransomware Network Indicators this skillmukul975/Anthropic-Cybersecurity-Skills34k—~796Automated safety check: PassApache-2.0
Msp HelpdeskRTFM-IT-Services-LLC/msp-claude-skills115—~3.3kAutomated safety check: PassCustom licence
Incident Triagebriiirussell/cybersecurity-skills413—~1.5kAutomated safety check: NotesMIT
Breach Detection Systemmukul975/Privacy-Data-Protection-Skills297—~3kAutomated safety check: PassApache-2.0
Sentinelvinayaklatthe/microsoft-security-skills175—~2.2kAutomated safety check: PassMIT
Forensics OsqueryAgentSecOps/SecOpsAgentKit2201 repos~4.9kAutomated safety check: NotesCustom licence

Similar skills

  • Msp Helpdesk

    RTFM-IT-Services-LLC/msp-claude-skills

    A skill your agent uses for anything about how your MSP runs day-to-day support: setting or questioning a ticket's priority, response and resolution targets, "the client says everything is down"…

    115 GitHub stars~3.3k tokensUpdated 6 days ago
    SecurityAuto-check passed

  • Incident Triage

    briiirussell/cybersecurity-skills

    Guide rapid triage and initial response to security incidents following NIST SP 800-61 methodology.

    413 GitHub stars~1.5k tokensUpdated 4 mo ago
    SecurityAuto-check: notes

  • Breach Detection System

    mukul975/Privacy-Data-Protection-Skills

    Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring.

    297 GitHub stars~3k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Sentinel

    vinayaklatthe/microsoft-security-skills

    Guidance for designing and operating Microsoft Sentinel, the cloud-native SIEM and SOAR delivered through the Defender portal.

    175 GitHub stars~2.2k tokensUpdated 3 mo ago
    SecurityAuto-check passed

  • Forensics Osquery

    AgentSecOps/SecOpsAgentKit

    SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.

    220 GitHub starsUsed in 1 repo~4.9k tokens
    SecurityAuto-check: notes

  • Ir Velociraptor

    AgentSecOps/SecOpsAgentKit

    Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale.

    220 GitHub starsUsed in 1 repo~3.1k tokens
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Analyzing Ransomware Network Indicators

What does Analyzing Ransomware Network Indicators do?

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and…. Analyzing Ransomware Network Indicators is an agent skill from mukul975/Anthropic-Cybersecurity-Skills.log and NetFlow data.

When should I use Analyzing Ransomware Network Indicators?

Analyzing Ransomware Network Indicators fits situations like: threat hunting for active ransomware network activity; investigating suspected pre-encryption exfiltration during incident response.

How do I install Analyzing Ransomware Network Indicators in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-ransomware-network-indicators -a claude-code`. Or copy the skill folder (skills/analyzing-ransomware-network-indicators in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/analyzing-ransomware-network-indicators in your project. Claude Code loads it when a task matches its description.

How do I install Analyzing Ransomware Network Indicators in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-ransomware-network-indicators -a codex`. Or copy the skill folder (skills/analyzing-ransomware-network-indicators in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/analyzing-ransomware-network-indicators in your project. Codex loads it when a task matches its description.

Can I use Analyzing Ransomware Network Indicators in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-ransomware-network-indicators -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/analyzing-ransomware-network-indicators, .gemini/skills/analyzing-ransomware-network-indicators, .github/skills/analyzing-ransomware-network-indicators and .opencode/skills/analyzing-ransomware-network-indicators in your project.

What does Analyzing Ransomware Network Indicators need to run?

Going by SKILL.md and its folder, Analyzing Ransomware Network Indicators needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Analyzing Ransomware Network Indicators access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Analyzing Ransomware Network Indicators safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Analyzing Ransomware Network Indicators use?

Analyzing Ransomware Network Indicators is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Analyzing Ransomware Network Indicators use?

About 796 tokens (SKILL.md is roughly 3.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 591 tokens, read only when the agent opens those files.

What are the alternatives to Analyzing Ransomware Network Indicators?

Skills that share tags, products or a category with Analyzing Ransomware Network Indicators: Msp Helpdesk (RTFM-IT-Services-LLC/msp-claude-skills, 115 stars), Incident Triage (briiirussell/cybersecurity-skills, 413 stars), Breach Detection System (mukul975/Privacy-Data-Protection-Skills, 297 stars) and Sentinel (vinayaklatthe/microsoft-security-skills, 175 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Analyzing Ransomware Network Indicators?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,993 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.