agentsclimarketplace
Sign in

Tracking adversary infrastructure

Skill meltedinhex/analyst-ai-pack/skills/tracking-adversary-infrastructure

Tracks adversary C2 and staging infrastructure by clustering indicators on shared attributes (TLS/JARM, certificate fields, favicon hashes, ASN, registration patterns) to find related hosts. Activates for requests to track adversary infrastructure, cluster C2 servers, or pivot on infrastructure attributes to find related hosts.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill tracking-adversary-infrastructure

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.6 KB, 393 tokens by cl100k_base, as published. Nobody here has run it

Tracking Adversary Infrastructure

When to Use

  • You have a set of suspected C2/staging hosts with attributes (JARM/JA3S, TLS cert fields, favicon hash, ASN, ports, registrar) and want to cluster them to find related infrastructure.
  • You are expanding from a few known indicators to the adversary's broader footprint.

Do not use clustering as confirmed attribution — shared hosting/attributes can be coincidental. Corroborate before attributing.

Prerequisites

  • Host records (CSV/JSON) with shared-attribute fields to cluster on.

Workflow

Step 1: Cluster on shared attributes

python scripts/analyst.py cluster hosts.json --attrs jarm,cert_cn,favicon_hash,asn

Groups hosts that share one or more pivot attributes into clusters, defanging host indicators.

Step 2: Score cluster cohesion

Rank clusters by how many distinct attributes the members share (more shared attributes → stronger relationship).

Step 3: Expand and confirm

Use the strongest shared attributes (e.g., a unique self-signed cert CN or favicon hash) to pivot in internet-scan data for more hosts; corroborate.

Step 4: Document

Record clusters, the shared pivots, and confidence; feed confirmed indicators to detection.

Validation

  • Clustering keys on explicit shared attributes, not loose similarity.
  • Cluster strength reflects the count of distinct shared attributes.
  • Host indicators are defanged in output.

Pitfalls

  • Common CDN/cloud JARM/ASN values creating huge false clusters — exclude generic pivots.
  • Default certificates shared by unrelated servers.
  • Treating one weak shared attribute as a strong link.

References

What ships with it: 3 files

4.4 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.