Hunt Tls C2 | Agent Skills Atlas

About this skill

Hunt for malicious TLS in Suricata eve.json (eventtype:tls). Detects DGA / high-entropy / word-list SNI, IP-literal and malformed SNI, high-abuse TLDs (.xyz/.cc/.cyou/.sbs/.cfd/.top/.online/.icu/etc.), IP-literal and invalid cert Subject/Issuer CN, self-signed and OpenSSL-default certificates (subject==issuer, "Internet Widgits", "Default City", CN=localhost/0.0.0.0), then correlates each suspicious SNI to eventtype:flow via flowid to surface long-lived C2 sessions (flow.age > 5 min) and repetitive single-destination beacons, and pivots on shared JA3/JA4 fingerprints. Prints a structured report with an evidence table. Use when asked to hunt malicious/C2/DGA TLS, find suspicious SNI or certificates, or triage HTTPS beaconing in a Suricata log.

Quick start

Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.

Installation guide →

Review, license & listing details

Review the source before using this skill

This is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.

Automated security scan: Partial

Only SKILL.md was scanned. Supporting files and scripts were not checked. No safety grade has been assigned.

0 potential findings · Scanned 11/4/2026 · Scanner 0.2.1

Content SHA-256: 655d98f531035c927e82a5bd216078f0373e4f8a6d86662a7dcc978b358536b5

About scan coverage and limitations

Original listing metadata

Original name

hunt-tls-c2

Original description

Hunt for malicious TLS in Suricata eve.json (event_type:tls). Detects DGA / high-entropy / word-list SNI, IP-literal and malformed SNI, high-abuse TLDs (.xyz/.cc/.cyou/.sbs/.cfd/.top/.online/.icu/etc.), IP-literal and invalid cert Subject/Issuer CN, self-signed and OpenSSL-default certificates (subject==issuer, "Internet Widgits", "Default City", CN=localhost/0.0.0.0), then correlates each suspicious SNI to event_type:flow via flow_id to surface long-lived C2 sessions (flow.age > 5 min) and repetitive single-destination beacons, and pivots on shared JA3/JA4 fingerprints. Prints a structured report with an evidence table. Use when asked to hunt malicious/C2/DGA TLS, find suspicious SNI or certificates, or triage HTTPS beaconing in a Suricata log.

About this listing

Category: Security
Reported license: Apache-2.0
Listing language (estimated): English
Review status: Not individually reviewed
Agent compatibility: Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.