threat-detection

What problem does it solve?

This Skill provides exact detection thresholds for identifying malicious network patterns like port scans, DoS attacks, and C2 beaconing, ensuring accurate threat identification.

Core Features & Use Cases

• Port Scan Detection: Identifies port scans based on port entropy, SYN-only ratio, and unique ports.
• DoS Pattern Detection: Detects Denial of Service attacks by analyzing the ratio of maximum to average packets per minute.
• C2 Beaconing Detection: Identifies Command and Control beaconing by analyzing the Coefficient of Variation of inter-arrival times.
• Use Case: Security analysts can use this skill to automatically analyze network traffic logs to pinpoint and classify various types of cyber threats.

Quick Start

Analyze the provided TCP packets to detect any port scan, DoS pattern, or C2 beaconing.