SHub Stealer PCAP Analysis: Finding C2 in Encrypted Traffic
A SHub Stealer infection read without decrypting a byte: fake-software lure, .cfd C2 behind Cloudflare, a 2.2 MB loot upload, a 61-second beacon.
Pcap AI Insights
Explore in-depth guides and case studies on machine-learning PCAP analysis, AI packet inspection, and automated security reporting.
Atomic macOS Stealer (AMOS): Reading the C2 Protocol from a PCAP
A real AMOS (Atomic macOS Stealer) infection read straight off the wire: the curl boot beacon, eight plaintext collection stages, a 3.4 MB loot upload, and the C2 tasking loop — all to one DigitalOcean VPS over plain HTTP.
How to Reduce a PCAP File for Analysis (editcap & tshark)
Got a capture too big to upload or open? Trim it to the packets that matter with editcap and tshark — strip payloads or isolate one conversation — without losing the TCP signal that explains a slow transfer.
AgentTesla FTP Exfiltration: A PCAP Walkthrough
We run a real GuLoader-to-AgentTesla capture through PcapAI: cleartext FTP credentials (T1040) and FTP data exfiltration (T1048.003), traced packet by packet.
macOS ClickFix Stealer: A PCAP Walkthrough
A fake Claude installer used ClickFix to drop a macOS stealer. We trace its curl HTTP C2 beacon and 11 MB of plaintext exfiltration packet by packet.
PcapAI vs Wireshark: AI-Powered Analysis vs Manual Inspection
Compare PcapAI and Wireshark for PCAP analysis. AI-generated MITRE-mapped PDF reports in under 5 minutes vs hours of manual packet inspection.
10 Essential Insights Every PCAP Analysis Report Needs
Learn the 10 critical insights every PCAP analysis report must include. From risk scores to remediation roadmaps, discover what separates pro reports.
MCP Server Integration: AI-Powered Network Forensics
Enable AI agents like Claude to perform deep packet inspection and network forensics securely on your local machine with the PcapAI MCP Server integration.
Why Automated PCAP Reporting Is No Longer Optional
Automated PCAP reporting cuts analysis time from 5 hours to 4 minutes. Why SOC teams are replacing manual Wireshark workflows with AI-driven analysis.
AI-Powered PCAP Analysis Benefits for Security Teams
AI-powered PCAP analysis cuts mean-time-to-resolution, surfaces credential leaks, and maps findings to MITRE ATT&CK — no Wireshark required.
PCAP Analysis Guides
Step-by-step tutorials on detecting malware, C2 beaconing, credential exposure, and protocol anomalies in packet captures.
Threat Intelligence
Real-world case studies mapping observed network traffic to MITRE ATT&CK techniques and compliance frameworks like PCI-DSS and HIPAA.
MCP & API Integration
Guides on integrating AI-powered deep packet inspection into SOC workflows, Claude Desktop, and custom security automation pipelines.