analyzing-ransomware-network-indicators

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-ransomware-network-indicators/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-structured into clear sections, but it under-delivers on actionability and navigation: it references neither the provided script nor the API reference, and its multi-step workflow lacks validation checkpoints for batch alerting operations.

Suggestions

Reference the bundle files in the body — e.g. under Steps add 'Run scripts/agent.py --input conn.log --format zeek' and point to references/api-reference.md for field and algorithm details.

Add validation/verification checkpoints in the workflow, such as confirming parsed connection counts before detection and reviewing the composite risk score against expected ranges before reporting.

Tighten the 'When to Use' list by removing generic filler lines like 'When SOC analysts need structured procedures for this analysis type' that do not add actionable triggers.

Dimension	Reasoning	Score
Conciseness	The body is lean and sectioned with little padding; only a few generic lines in 'When to Use' ('When SOC analysts need structured procedures...') could be trimmed, so it sits above the efficient midpoint.	4 / 5
Actionability	Steps name concrete techniques (e.g. 'mean, stddev, coefficient of variation') but the body contains no executable code or commands — all runnable guidance lives in scripts/agent.py and references/api-reference.md, which are never referenced, leaving the reader with instructions rather than copy-paste-ready material.	3 / 5
Workflow Clarity	The 7-step sequence is clearly ordered, but there are no validation or verification checkpoints for batch alerting operations; per the destructive/batch guideline this caps workflow_clarity at 3.	3 / 5
Progressive Disclosure	Sections are well organized, but bundle files (scripts/agent.py, references/api-reference.md) exist yet are never signaled or referenced from the body, so navigation to the actual executable detail is missing.	3 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinct: it names concrete indicator types, the data sources used, and an explicit 'Use when' trigger covering both threat hunting and incident response. Minor synonyms could broaden the trigger surface.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange' — plus concrete data sources (Zeek conn.log, NetFlow), giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both what ('Identify ransomware-related network indicators...by analyzing Zeek conn.log and NetFlow data') and when ('Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response').	5 / 5
Trigger Term Quality	Strong natural SOC vocabulary ('ransomware', 'C2 beaconing', 'TOR', 'exfiltration', 'threat hunting', 'incident response'), but lacks a few common synonyms (e.g. 'IR', 'compromise', file extensions) users might say.	4 / 5
Distinctiveness Conflict Risk	A clearly bounded niche (ransomware network indicators via Zeek/NetFlow) with distinct triggers and minimal overlap with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-ransomware-network-indicators/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.