traffic-analyze

name	traffic-analyze
description	Use when testing Stage 4-6 of auto-analyze in isolation: FakeNet capture, HTML report reading, and WireMCP PCAP analysis. Triggers on 'traffic_analyze @<sample>', 'fakenet @<sample>', 'capture traffic from <sample>', or 'analyse the capture <pcap>'.

Traffic Analyze

Testing entrypoint for auto-analyze Stages 4-6. Runs fakenet_capture.ps1, reads the HTML report, and analyzes the PCAP with WireMCP — without touching IDA or x64dbg.

Triggered by:

• traffic_analyze @<sample_name>
• fakenet @<sample_name>
• capture traffic from <sample_name>
• analyse the capture <pcap_path> — skip to Stage 2

For the full workflow including static + dynamic analysis, use auto-analyze.

---

Stage 1 — Run fakenet_capture.ps1

cd D:\sourcecode\vibe\Module_connection
.\fakenet_capture.ps1 -Sample <sample_path>
.\fakenet_capture.ps1 -Sample <path> -CaptureSecs 180   # shorter capture
.\fakenet_capture.ps1 -Sample <path> -Arch 32            # force 32-bit

See auto-analyze skill Stage 4 for full script documentation.

Expected output:

[OK] Capture complete.
     Sample    : evil.exe
     Duration  : 300 s
     PCAP      : D:\sourcecode\vibe\Module_connection\captures\evil.exe_20260504_143022.pcap
     HTML      : D:\sourcecode\vibe\Module_connection\captures\evil.exe_20260504_143022_report.html

---

Stage 2 — Read FakeNet HTML Report

Read the HTML report before the PCAP — it contains pre-digested NBI (Network-Based Indicators) organized by process.

Get-Content <host_html_path> -Raw

What to extract

Section	Focus on
Per-process NBI table	Non-Windows processes making connections
Protocol per connection	dns, http, https, tcp
Domain names (DNS entries)	Real C2 domains — FakeNet resolved them to its own IP
SSL encrypted = Yes	Check SNI for the real domain name
Query type + domain	A, AAAA, HTTPS — random-looking names = DGA

C2 beacon example to look for

Process: malware.exe (PID 1234)
  Protocol: http
    Method: POST  URI: /gate.php  Host: c2domain.evil
    User-Agent: Mozilla/4.0 (custom)

Windows noise to ignore

svchost.exe → windowsupdate.com, msftconnecttest.com, wpad.localdomain, DESKTOP-5SA0936.local, 239.255.255.250 SSDP msedge.exe → any Microsoft/Bing domains

---

Stage 3 — PCAP Analysis (WireMCP + tshark)

analyze_pcap fails on large PCAPs (stdout maxBuffer exceeded) — use tshark directly.

$tshark = 'D:\Application\wireshark\tshark.exe'
$pcap   = '<host_pcap_path>'

& $tshark -r $pcap -q -z io,stat,0                                                           # packet count + duration
& $tshark -r $pcap -Y 'dns.flags.response == 0' -T fields -e dns.qry.name 2>$null | Where-Object { $_ -ne '' } | Group-Object | Sort-Object Count -Descending   # DNS queries
& $tshark -r $pcap -q -z io,phs                                                              # protocol hierarchy
& $tshark -r $pcap -Y 'http.request and not (http.host contains "microsoft" or http.host contains "windowsupdate" or http.host contains "msftconnect" or http.host contains "wpad" or http.host contains "live.com")' -T fields -e ip.dst -e http.host -e http.request.method -e http.request.uri -e http.user_agent 2>$null   # non-Windows HTTP
& $tshark -r $pcap -Y 'tls.handshake.type == 1' -T fields -e ip.dst -e tls.handshake.extensions_server_name 2>$null | Sort-Object -Unique   # TLS SNI

Threat intel on external IPs:

mcp__wiremcp__check_ip_threats(ip=<external_ip>)

Credential extraction:

mcp__wiremcp__extract_credentials(pcapPath=<host_pcap_path>)

FakeNet context

• 192.0.2.x = FakeNet's listener (RFC 5737) — not real C2
• Focus on DNS domain names and HTTP content, not destination IPs
• Only Windows-noise PCAP → sample detected sandbox → run debug pass first