Network Covert Channel Analyzer
Teaches an agent to spot hidden malware traffic in DNS, ICMP and HTTP captures
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 6 files
What it does
This skill gives an AI agent a structured procedure for examining packet capture files (PCAPs) to find malware that hides command-and-control messages or stolen data inside ordinary-looking network traffic, such as DNS queries, ICMP pings, or HTTP headers. The agent scores suspicious domains and flows using signals like unusually long subdomains, high randomness (entropy), and heavy use of TXT queries, then explains what it found. It is aimed at analysts investigating incidents rather than general users.
Great for
- SOC analysts or incident responders reviewing captured network traffic for suspected tunneling
- Security students learning how DNS and ICMP tunneling are detected
- Threat hunters writing detection heuristics for covert C2 channels
Skip it if
- Blocking or cleaning up live malware on a machine, since the skill only analyzes captures and is not a remediation tool (it does not contain such steps)
- Confirming an attack on its own: the heuristics produce candidates that can include benign traffic such as CDN or antivirus lookups and need human review
- Analyzing captures that contain sensitive personal data without authorization, because the agent will read full packet contents
Try asking
- “Analyze this PCAP file and list domains with suspicious DNS tunneling indicators”
- “Check my capture for ICMP flows with unusually large payloads and explain why they look suspicious”
- “Score the DNS queries in this capture by entropy and subdomain length and map findings to MITRE ATT&CK”
- “Summarize covert channel indicators in this Wireshark export for an incident report”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 6 original files, the Apache-2.0 licence and an attribution note.
analyzing-network-covert-channels-in-malware.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-network-covert-channels-in-malware.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-network-covert-channels-in-malware.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run the analysis on a copy of the capture in an isolated analysis environment, since captures may contain live malicious content
- Treat scores as leads: verify flagged domains against threat intelligence and known-good baselines before concluding anything
- Ask the agent to explain each reason for a finding so you can judge whether the heuristic fits your network
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.