domains / families / security / analyzing-network-traffic-of-malware

analyzing-network-traffic-of-malware

separate

'Analyzes network traffic generated by malware during sandbox execution

When to use

• Sandbox execution has captured a PCAP file and the network behavior needs detailed analysis
• Identifying the C2 protocol structure for writing network detection signatures
• Determining what data the malware exfiltrates and to which external infrastructure
• Analyzing DNS tunneling, domain generation algorithms (DGA), or fast-flux behavior
• Creating Suricata/Snort signatures based on observed malware network patterns

When not to use

• host-based analysis of malware behavior
• process-level activity analysis

Skill page

Source