Guide · Agent skill
How to use the Ransomware Network Indicator Analysis skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the Ransomware Network Indicator Analysis agent skill, which teaches an AI agent to review Zeek conn.log files or NetFlow exports for ransomware-linked network patterns. It is written for security analysts and engineers who may never have installed an agent skill before. By the end you will know how to install it, ask for an analysis in plain language, and read the report it produces.
Ransomware Network Indicator Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it. The folder should be named analyzing-ransomware-network-indicators.
- 2Place the folder. Copy the folder into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Or upload in the apps. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill.
- 4Check requirements. Confirm Python 3.8 or later is available and that you have Zeek conn.log files or NetFlow exports ready.
- 5Ask for an analysis. Describe the threat hunt or incident in plain language and point the agent at your log files.
- 6Review the report. Read the JSON report, check each beaconing, Tor and exfiltration flag, and validate the risk score against your context.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions and optional scripts that an AI agent can load when a task matches the skill's description. This one is for examining network traffic logs for signs of ransomware activity before or during an attack.
The skill looks for regular 'phone home' callbacks to attacker servers (beaconing), connections to Tor exit nodes, unusually large outbound transfers that may indicate data theft before encryption, and suspicious DNS activity. The agent follows a set procedure and can produce a structured JSON report with a composite risk score mapped to MITRE ATT&CK techniques.
- Beaconing: groups connections by source IP, destination IP and destination port, then checks how regular the intervals are
- Tor: cross-references destination IPs against a Tor exit node list
- Exfiltration: flags connections with unusually high outbound byte ratios to external IPs
- DNS: looks for DGA-like domain queries and high-entropy subdomains
Install the skill from the ZIP or the Claude apps
Download the ZIP for this skill from this page and unzip it. For a personal setup, place the folder in ~/.claude/skills/. To share it with one project, place it in that project's .claude/skills/ folder instead.
If you use the Claude apps, you can upload the skill instead. Open Settings, go to Capabilities, then Skills, and add the skill from the ZIP.
- Personal: ~/.claude/skills/
- Project only: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills
~/.claude/skills/analyzing-ransomware-network-indicators/Check what you need before you start
The skill needs Python 3.8 or later. According to its SKILL.md, it uses only the Python standard library. You also need input data: Zeek conn.log files (tab-separated) or NetFlow records exported as CSV or JSON.
Looking up Tor exit nodes requires internet access to fetch the list from check.torproject.org. This step is optional. You can also supply an optional list of known ransomware command-and-control IP addresses or domains.
- Python 3.8+ (standard library only)
- Zeek conn.log files or NetFlow CSV/JSON exports
- Internet access to check.torproject.org (only for Tor checks)
- Optional: a known ransomware C2 IOC list
Ask the agent for an analysis in plain language
You do not need special syntax. Describe the task and point the agent at your log files. The skill's description says it is meant for threat hunting for active ransomware network activity and for investigating suspected pre-encryption exfiltration during incident response, so phrase your request that way.
Be specific about the data. Tell the agent which log file or export to analyze and what you are trying to answer. If you want a report, say so.
- 'Use the ransomware network indicator skill to check this conn.log for beaconing.'
- 'Hunt for Tor exit node connections and large outbound transfers in these NetFlow exports.'
- 'Investigate whether this host shows pre-encryption exfiltration. Give me a JSON report with a risk score and MITRE ATT&CK mapping.'
Read the report and the risk score
The expected output is a JSON report containing beaconing detections with interval statistics, Tor exit node alerts, a data exfiltration flow analysis, and a composite ransomware risk score with a MITRE ATT&CK mapping. The skill's reference notes that beaconing is flagged when the coefficient of variation of connection intervals is below 0.3.
Treat the score as a prioritisation aid. Each flagged item should be checked against your own context, because regular traffic such as software updates can look like beaconing.
- Beaconing detections include interval statistics (mean, standard deviation, coefficient of variation)
- Techniques referenced include T1071, T1573 and T1041 in the skill's Expected Output section
- Every alert needs analyst review before action
Safety notes before running scripts
The skill includes scripts (scripts/agent.py) and makes network requests to fetch the Tor exit list. Read the scripts before running them, and run them on a system and data set you are authorised to analyse.
The skill works on exported log files after the fact. It is not a live blocking or prevention product, and it does not stop traffic.
- Review scripts/agent.py before first use
- Only the Tor exit list lookup needs internet access, according to the requirements
- Keep sensitive logs on systems approved for incident data
Tips for better results
Give the agent complete logs for the time window you care about. Beaconing detection depends on enough connections between the same source, destination and port to measure intervals.
Compare results against known-good traffic in your environment, such as update servers and backup services, to reduce false positives. Keep the Tor list fresh if you rely on those checks.
- Use a consistent time window for each host you investigate
- Add a known C2 IOC list when you have one
- Ask the agent to explain any high-scoring item before escalating
What people use it for
- Hunting for regular callbacks from a workstation to an external server over Zeek conn.log data
- Checking a suspected incident for large outbound transfers that could be data theft before encryption
- Reviewing NetFlow exports for connections to Tor exit nodes
- Prototyping detection logic for ransomware network behaviour before writing production rules
Frequently asked questions
Is the ransomware network indicator analysis skill free?
The skill is published under the Apache-2.0 licence, according to the listing. Check the licence file in the downloaded ZIP for the full terms before using it in your organisation.
What do I need to run this skill?
You need Python 3.8 or later, Zeek conn.log files or NetFlow CSV/JSON exports, and an agent that can load skills. Internet access is only needed if you want the Tor exit node check to fetch the current list.
Where do I put the skill folder?
Place it in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings, Capabilities, then Skills.
Does this skill block ransomware in real time?
No. It analyses exported log files after the fact and is not an intrusion prevention product. It is meant to help analysts find suspicious patterns in historical or collected traffic.
Why does the skill flag normal traffic?
Periodic traffic such as software updates can match the beaconing pattern of regular intervals. Outputs need expert interpretation, so check each flag against what you know about the host.
How is this different from a SIEM or IDS?
The skill is a set of instructions and scripts for an AI agent to analyse log files you already have. It does not collect traffic, run continuously or send alerts, so it complements rather than replaces monitoring tools.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits SOC analysts running threat hunts over existing Zeek or NetFlow logs, incident responders checking for pre-encryption exfiltration, and engineers prototyping ransomware detection logic. It is not suitable for live blocking, and anyone without log data or security context will struggle to interpret its output correctly, so pick a dedicated detection product for real-time prevention.
Download the skill