agentsclimarketplace
Sign in

Hunting unusual outbound connections

Skill meltedinhex/analyst-ai-pack/skills/hunting-unusual-outbound-connections

Hunts for unusual outbound network connections by flagging direct-to-IP traffic, uncommon ports, rare destinations, high data-egress ratios, and connections from unexpected processes in network telemetry. Activates for requests to hunt unusual outbound traffic, detect suspicious egress, or find anomalous external connections.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-unusual-outbound-connections

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.6 KB, 410 tokens by cl100k_base, as published. Nobody here has run it

Hunting Unusual Outbound Connections

When to Use

  • You have connection/flow telemetry (Sysmon EID 3, firewall, Zeek conn) and want to surface anomalous egress: direct-to-IP, non-standard ports, rare destinations, and large uploads.
  • You are hunting C2 and exfiltration channels.

Do not use this to block on raw destination novelty alone — many new destinations are benign. Combine signals (port + process + egress ratio) before alerting.

Prerequisites

  • Outbound connection telemetry with destination IP/port, process, and (ideally) byte counts.

Workflow

Step 1: Score outbound connections

python scripts/analyst.py hunt conns.csv

Flags direct-to-IP (no domain), uncommon ports (not 80/443/53/...), high sent:received byte ratio (possible exfil), and connections from unexpected processes (e.g., notepad.exe egressing).

Step 2: Rank destinations by rarity

Aggregate per-destination connection counts to surface low-prevalence endpoints.

Step 3: Confirm

Investigate top-scoring connections; corroborate with reputation and process context.

Step 4: Operationalize

Tune thresholds and write a detection for the strongest combined signals.

Validation

  • Direct-to-IP and non-standard-port connections are flagged.
  • High egress-ratio connections are surfaced for exfil review.
  • Unexpected-process egress is identified.

Pitfalls

  • CDNs and cloud services producing many benign direct-IP/new destinations.
  • Standard ports (443) used by C2 — port alone is insufficient.
  • Asymmetric-but-benign traffic (backups, uploads) inflating egress ratio.

References

What ships with it: 3 files

5.5 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.