mindmap
  root((Malware Traffic <br/> Analysis))

    Traffic Capture
      PCAP
      Wireshark
      tcpdump
      Zeek

    Network Protocols
      DNS
      HTTP
      HTTPS
      FTP
      SMTP
      SMB

    Malware Communication
      Command and Control
      Beaconing
      Data Exfiltration
      Lateral Movement

    Network Indicators
      IP Addresses
      Domains
      URLs
      JA3 Fingerprints
      User Agents

    Analysis Techniques
      Flow Analysis
      Protocol Analysis
      Payload Analysis
      Session Reconstruction

    Threat Hunting
      IOC Search
      Anomaly Detection
      Beacon Detection
      DNS Tunneling

    Detection Engineering
      Suricata Rules
      Snort Rules
      Sigma Rules
      IDS Signatures

    Reporting
      IOC Extraction
      MITRE ATT&CK Mapping
      Threat Intelligence
      Incident Reports

Loading

Awesome Malware Traffic Analysis

   

Contents

• Malware Traffic Analysis Exercises
• Online PCAP Scanners
• Network Traffic Analysis Tool
• Online Network Traffic Analysis Tool
• Malware Traffic Scientific Research
• Scientific Research
• My Other Awesome Lists

Malware Traffic Analysis Exercises

• activecountermeasures.com/malware-of-the-day
• malware-traffic-analysis.net/training-exercises

Online PCAP Scanners

• CAPE Sandbox - CAPE Sandbox is an Open Source software for automating analysis of suspicious files. To do so it makes use of custom components that monitor the behavior of the malicious processes while running in an isolated environment.
• DynamiteLab - DynamiteLab delivers the easiest way to explore network behavior from packet captures. The platform is a successor to PacketTotal with over 100,000 PCAP files in its repository, allowing to research and publicly share traffic samples.
• MetaDefender Cloud - MetaDefender Cloud is an advanced threat prevention platform developed by OPSWAT.
• Red Hand Online PCAP Analyzer - Red Hand Analyzer runs your PCAP file through an automated behavior analysis model to identify network patterns commonly associated with malicious hacker techniques, often missed by signature-based detection engines.

Network Traffic Analysis Tool

• Malcolm - Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
• NetworkMiner - NetworkMiner is an open source network forensics tool that extracts artifacts, such as files, images, emails and passwords, from captured network traffic in PCAP files.
• PcapViz - PcapViz draws networks as device topologies and as information flows using the packet information in pcap files captured from a network device using tcpcap or other capture software. It filters and optionally displays the captured packets at any one of 3 "layers".

Online Network Traffic Analysis Tool

• A-Packets - Explore and analyze PCAP files online using A-Packets, designed to provide comprehensive insights into network protocols like IPv4/IPv6, HTTP, Telnet, FTP, DNS, SSDP, and WPA2. This tool allows users to easily view details of network communications and dissect layers of data transmission.
• PacketSafari - PacketSafari makes it easy to collect, share, and analyze your packet captures (PCAPs). Online PCAP analayer now supports AI-assisted packet analysis.
• Zeek Online - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Network Traffic Datasets

You can access the datasets here.

Malware Traffic Scientific Research

You can access the Scientific Research here.

My Other Awesome Lists

You can access the my other awesome lists here

Contributing

Contributions of any kind welcome, just follow the guidelines!

Contributors

Thanks goes to these contributors!

License

🔼 Back to top