analyzing-ransomware-network-indicators

name	analyzing-ransomware-network-indicators
description	Identify ransomware network indicators including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange via Zeek conn.log and NetFlow analysis. Use when working with analyzing ransomware network indicators.
domain	cybersecurity
subdomain	threat-hunting
tags	["ransomware","c2-beaconing","zeek","netflow","tor","exfiltration","network-forensics"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Analyzing Ransomware Network Indicators

Overview

Before and during ransomware execution, adversaries establish C2 channels, exfiltrate data, and download encryption keys. This skill analyzes Zeek conn.log and NetFlow data to detect beaconing patterns (regular-interval callbacks), connections to known TOR exit nodes, large outbound data transfers, and suspicious DNS activity associated with ransomware families.

When to Use

Trigger phrases:

• "analyzing ransomware network indicators"

• "Identify ransomware network indicators including C2 beaconing patterns, TOR exit"

• When investigating security incidents that require analyzing ransomware network indicators

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

Prerequisites

• Zeek conn.log files or NetFlow CSV/JSON exports
• Python 3.8+ with standard library
• TOR exit node list (fetched from Tor Project or threat intel feeds)
• Optional: Known ransomware C2 IOC list

Steps

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Parse Connection Logs — Ingest Zeek conn.log (TSV) or NetFlow records into structured format
2. Detect Beaconing Patterns — Calculate connection interval statistics (mean, stddev, coefficient of variation) to identify periodic callbacks