📚 Documentation

Complete guide to using PCaptor Pro for network analysis and threat detection

🚀 Getting Started

Welcome to PCaptor Pro! This guide will help you get up and running quickly with network analysis and threat detection.

What is PCaptor Pro?

PCaptor Pro is an advanced network packet analyzer that combines multiple detection engines to identify threats, malware, and suspicious activity in network traffic. It processes PCAP files and generates comprehensive HTML reports with actionable intelligence.

✨ Key Capabilities

  • 25 C2 Framework Detection - Cobalt Strike, Metasploit, Brute Ratel C4, and 22 more
  • 92 YARA Rules - Web shells, data exfiltration, exploit kits, APT activity, backdoors
  • 16 Ransomware Families - WannaCry, Ryuk, REvil, Conti, LockBit, and more
  • Crypto Mining Detection - 8 wallet types, 20+ pools, browser mining
  • LOLBin Detection - 82 patterns across 7 tools with MITRE ATT&CK mapping
  • IoT/OT Security - Modbus, MQTT, BACnet, CoAP protocol monitoring
  • 13 Intelligent Plugins - Protocol decoders, GeoIP, threat intelligence
  • 18 Threat Feeds - Automatic download and matching

Quick Start

Get started with PCaptor Pro in 3 simple steps:

Step 1: Run Basic Analysis

pcaptor.exe -f capture.pcap -html

This will analyze your PCAP file and generate an HTML report.

Step 2: View the Report

Open the generated HTML file in your browser. The report includes:

  • Interactive dashboard with threat score
  • Detected threats and anomalies
  • Protocol analysis and statistics
  • Plugin results and insights

Step 3: Explore Advanced Features

Enable additional detection engines for comprehensive analysis:

pcaptor.exe -f capture.pcap -html -yara-dir ./yara/ -ti-feeds

💻 Installation

System Requirements

Minimum Requirements

  • OS: Windows 10, Linux (Ubuntu 20.04+), macOS 11+
  • CPU: 2 cores
  • RAM: 4GB
  • Disk: 500MB free space

💡 Recommended Specifications

  • OS: Windows 11, Linux (Ubuntu 22.04+), macOS 13+
  • CPU: 8+ cores for optimal performance
  • RAM: 16GB+ for large PCAP files
  • Disk: 2GB free space, SSD recommended

Installation Steps

Windows

  1. Download PCaptor.exe from your purchase email
  2. Place the executable in your preferred directory
  3. Open Command Prompt or PowerShell
  4. Navigate to the directory: cd C:\path\to\pcaptor
  5. Run: pcaptor.exe -version to verify installation

Linux / macOS

  1. Download the appropriate binary for your platform
  2. Make it executable: chmod +x pcaptor
  3. Move to /usr/local/bin (optional): sudo mv pcaptor /usr/local/bin/
  4. Verify: pcaptor -version

Directory Structure

PCaptor Pro automatically creates and uses these directories:

PCaptor/ ├── pcaptor.exe # Main executable ├── yara/ # YARA rules (auto-loaded) ├── signatures/ # Custom signatures (auto-loaded) ├── intel_db/ # Threat intelligence databases ├── plugins/ # Plugin files └── output/ # Generated reports (default)

📖 Basic Usage

Command Line Syntax

pcaptor.exe -f <pcap_file> [options]

Common Commands

1. Basic Analysis with HTML Report

pcaptor.exe -f capture.pcap -html

Generates an interactive HTML report with all basic detections.

2. Full Analysis with All Features

pcaptor.exe -f capture.pcap -html -yara-dir ./yara/ -ti-feeds

Enables YARA scanning and threat intelligence feeds.

3. Export Multiple Formats

pcaptor.exe -f capture.pcap -html -csv -json

Generates HTML, CSV, and JSON reports simultaneously.

4. Custom Output Directory

pcaptor.exe -f capture.pcap -html -o ./reports/

Saves reports to a specific directory.

Command Line Options

Required Options

  • -f <file> - PCAP file to analyze (required)

Output Options

  • -html - Generate HTML report
  • -csv - Export CSV files
  • -json - Export JSON report
  • -o <dir> - Output directory

Detection Engines

  • -yara-dir <dir> - YARA rules directory
  • -yara-file <file> - Single YARA rule file
  • -sig-dir <dir> - Custom signatures directory
  • -ti-feeds - Enable threat intelligence feeds
  • -vt-api <key> - VirusTotal API key
  • -otx-api <key> - AlienVault OTX API key

Performance Options

  • -w <num> - Number of worker threads (default: 24)
  • -config <file> - Configuration file

Logging Options

  • -log-level <level> - debug, info, warn, error
  • -log-file <file> - Log file path
  • -q - Quiet mode
  • -v - Verbose mode

⚡ Advanced Features

YARA Integration

PCaptor Pro includes 92 network-optimized YARA rules across 10 categories:

  • Malware C2 (11 rules) - C2 framework detection
  • Credential Theft (9 rules) - Credential harvesting
  • Network Threats (11 rules) - Network-based attacks
  • Recon Scanners (10 rules) - Reconnaissance tools
  • Web Shells (8 rules) - PHP, ASP, JSP webshells
  • Data Exfiltration (8 rules) - Cloud uploads, DNS tunneling
  • Exploit Kits (10 rules) - Angler, RIG, Magnitude, etc.
  • APT Network (10 rules) - Cobalt Strike, Mimikatz, etc.
  • Backdoors (12 rules) - Netcat, SSH tunnels, C2 channels
  • HTTP Exploits (1 rule) - Command injection

Using YARA Rules

# Auto-load all rules from yara/ directory pcaptor.exe -f capture.pcap -html -yara-dir ./yara/ # Load specific rule file pcaptor.exe -f capture.pcap -html -yara-file ./yara/malware_c2.yar
💡 Performance Tip: The 92 included rules add only ~10% overhead. Avoid loading thousands of generic rules (like yara-rules-full.yar) which can slow analysis by 90%+.

Custom Signatures

Create targeted detection signatures in JSON format. PCaptor Pro includes 62 default signatures.

Example Signature

{ "id": "C2-001", "name": "Cobalt Strike Beacon", "description": "Detects Cobalt Strike C2 traffic", "severity": "critical", "category": "c2", "enabled": true, "conditions": { "user_agent_contains": "Mozilla/5.0 (compatible; MSIE 9.0", "uri_regex": "^/(updates|submit\\.php)" } }

Using Custom Signatures

# Load from directory pcaptor.exe -f capture.pcap -html -sig-dir ./signatures/ # Load specific file pcaptor.exe -f capture.pcap -html -sig-file ./my-signatures.json

Threat Intelligence

PCaptor Pro integrates with 18 threat intelligence feeds:

  • Feodo Tracker (Botnet C2)
  • SSL Blacklist (Malicious SSL certs)
  • URLhaus (Malicious URLs)
  • Tor Exit Nodes
  • ThreatView (6 feeds: Ransomware, Phishing, Malware, Botnets, Exploits, APT)
  • Custom feeds support

Enable Threat Intelligence

# Auto-download free feeds pcaptor.exe -f capture.pcap -html -ti-feeds # Use VirusTotal pcaptor.exe -f capture.pcap -html -vt-api YOUR_API_KEY # Use AlienVault OTX pcaptor.exe -f capture.pcap -html -otx-api YOUR_API_KEY

🔍 Detection Engines

C2 Framework Detection (25 Frameworks)

Industry-leading detection of Command & Control frameworks:

Commercial Frameworks

  • Cobalt Strike
  • Brute Ratel C4
  • Nighthawk

Open Source Frameworks

  • Metasploit, PowerShell Empire, Sliver, Covenant
  • Mythic, Havoc, PoshC2, Pupy RAT, Koadic
  • Merlin, Villain, Silver, Deimos, Ninja
  • Ares, Faction, Apfell, SharpC2, Athena
  • Octopus, SilentTrinity

Ransomware Detection (16 Families)

  • WannaCry, Ryuk, REvil/Sodinokibi, Conti
  • LockBit (2.0, 3.0), BlackCat/ALPHV, Hive
  • Maze/Egregor, DarkSide/BlackMatter, Ragnar Locker
  • Cerber, Locky, GandCrab, Dharma, Phobos, STOP/Djvu
Detection Methods:
  • Shadow copy deletion detection
  • Backup deletion detection
  • 70+ file extension monitoring
  • SMB enumeration tracking
  • C2 beaconing detection

Crypto Mining Detection

  • 8 Wallet Types: Bitcoin, Ethereum, Monero, Litecoin, Dogecoin, Ripple, Zcash, Dash
  • 20+ Mining Pools: Monero, Ethereum, Bitcoin, multi-coin pools
  • Browser Cryptojacking: Coinhive, Cryptoloot, JSEcoin
  • Mining Software: XMRig, Claymore, Phoenix, GMiner, LOLMiner, NBMiner, TeamRedMiner, ETHMiner
  • Stratum Protocol: Session tracking with method detection

LOLBin Detection (82 Patterns)

Living-off-the-Land Binary abuse detection across 7 tools:

  • PowerShell (32 patterns) - Download cradles, Invoke-Expression, encoded commands
  • Certutil (11 patterns) - File downloads, decode operations
  • Bitsadmin (8 patterns) - File transfers
  • WMI (11 patterns) - Remote execution, reconnaissance
  • Mshta (7 patterns) - Remote script execution
  • Regsvr32 (6 patterns) - Squiblydoo technique
  • Rundll32 (7 patterns) - Script execution
💡 MITRE ATT&CK Mapping: All LOLBin patterns are mapped to 20 MITRE ATT&CK techniques for threat intelligence correlation.

IoT/OT Security (4 Protocols)

  • Modbus/TCP: Write attacks, illegal function codes
  • MQTT: Command injection, suspicious topics
  • BACnet: Unauthorized write operations
  • CoAP: Suspicious URI access

🔌 Plugins

PCaptor Pro includes 13 intelligent plugins that auto-load and provide specialized analysis:

Threat Detection Plugins

1. Ransomware Detection v2.0.0

  • 16 ransomware families
  • Shadow copy deletion detection
  • 70+ file extensions monitored
  • Behavioral detection

2. Crypto Wallet Detection v3.0.0

  • 8 cryptocurrency types
  • 20+ mining pools
  • Browser cryptojacking detection
  • Mining software detection (17 tools)
  • Stratum protocol session tracking

3. LOLBin Detection v2.0.0

  • 82 patterns across 7 tools
  • MITRE ATT&CK mapping (20 techniques)
  • Attack chain detection
  • Targeted host tracking

4. IoT/OT Detection v1.0.0

  • Modbus/TCP security monitoring
  • MQTT command injection detection
  • BACnet unauthorized write detection
  • CoAP suspicious URI detection

5. ML C2 Detection v1.0.0

  • Machine learning-based C2 identification
  • 10,000+ historical flow patterns
  • Unknown C2 framework detection
  • Behavioral analysis

6. Messaging C2 Detection v1.0.0

  • Telegram C2 detection (13 CIDRs)
  • WhatsApp abuse detection (13 CIDRs)
  • Discord, Slack monitoring

Intelligence & Analysis Plugins

7. Geo Intelligence v1.0.0

  • Binary search GeoIP (10-100x faster)
  • 10M+ IP ranges
  • High-risk country detection
  • VPN detection

8. VirusTotal Integration v1.0.0

  • IP/Domain/Hash reputation checks
  • Paid API support
  • Automatic caching

9. AlienVault OTX Integration v1.0.0

  • Open threat intelligence
  • Pulse-based threat feeds
  • Community indicators

10. Protocol Decoders v1.0.0

  • 12+ protocols (IRC, SNMP, LDAP, SIP, XMPP, TFTP, Syslog)
  • Message extraction
  • Rich protocol analysis

11. HTTP Content Analysis v1.0.0

  • API endpoint extraction
  • Credential detection
  • POST data analysis

12. Connection Graph v1.0.0

  • Network topology mapping
  • Communication patterns
  • Node and edge analysis

13. Protocol Anomaly v1.0.0

  • Unusual protocol behavior
  • Behavioral analysis
  • Anomaly scoring
💡 Auto-Discovery: All plugins are automatically discovered and loaded. No configuration needed!

📊 Reports

HTML Reports

Interactive HTML reports are the primary output format, featuring:

Report Components

  • Executive Dashboard: Threat score, risk level, key metrics
  • Threat Summary: Critical findings, C2 detections, malware alerts
  • Protocol Analysis: Traffic breakdown, top talkers, port usage
  • Detection Results: YARA matches, signature hits, anomalies
  • Plugin Insights: Ransomware, crypto mining, LOLBin activity
  • Threat Intelligence: Feed matches, reputation scores
  • Timeline View: Chronological event sequence
  • Network Graph: Visual topology and connections

Generate HTML Report

pcaptor.exe -f capture.pcap -html -o ./reports/

CSV Exports

Export structured data for analysis in Excel, databases, or SIEM systems:

  • connections.csv: All network connections with metadata
  • threats.csv: Detected threats with severity and details
  • dns.csv: DNS queries and responses
  • http.csv: HTTP requests and responses
  • tls.csv: TLS/SSL connections and certificates

Generate CSV Exports

pcaptor.exe -f capture.pcap -csv -o ./exports/

JSON Format

Machine-readable JSON output for automation and integration:

{ "metadata": { "filename": "capture.pcap", "packets": 243586, "duration": "2h 15m", "threat_score": 85 }, "threats": [ { "type": "c2_detection", "name": "Cobalt Strike Beacon", "severity": "critical", "confidence": 0.95 } ], "statistics": {...}, "plugins": {...} }

Generate JSON Report

pcaptor.exe -f capture.pcap -json -o ./data/

Report Customization

Control what appears in reports:

# Minimal report (faster generation) pcaptor.exe -f capture.pcap -html -q # Full report with all details pcaptor.exe -f capture.pcap -html -v # Multiple formats simultaneously pcaptor.exe -f capture.pcap -html -csv -json

⚙️ Configuration

Configuration Files

PCaptor Pro supports JSON configuration files for persistent settings:

Basic Configuration (pcaptor.json)

{ "workers": 24, "output_dir": "./reports/", "log_level": "info", "yara_dir": "./yara/", "signatures_dir": "./signatures/", "enable_ti_feeds": true, "html_report": true, "csv_export": false, "json_export": false }

High-Memory Configuration (pcaptor-highmem.json)

For large PCAP files (1GB+) and systems with 16GB+ RAM:

{ "workers": 48, "buffer_size": 10485760, "max_packets_in_memory": 1000000, "enable_streaming": true, "chunk_size": 100000, "memory_limit": "8GB" }

Using Configuration Files

# Standard config pcaptor.exe -f capture.pcap -config pcaptor.json # High-memory config for large files pcaptor.exe -f large_capture.pcap -config pcaptor-highmem.json

Performance Tuning

Worker Threads

Adjust based on your CPU cores:

# Auto-detect (default: 24) pcaptor.exe -f capture.pcap -html # Manual setting (recommended: 2x CPU cores) pcaptor.exe -f capture.pcap -html -w 48
💡 Performance Tip: PCaptor Pro achieves 88,000+ packets/second with all features enabled. For optimal performance:
  • Use SSD storage for large PCAP files
  • Set workers to 2x your CPU core count
  • Enable high-memory mode for files over 1GB
  • Use network-optimized YARA rules (included 92 rules)

Memory Management

For large PCAP files:

  • Streaming Mode: Process packets in chunks to reduce memory usage
  • Buffer Size: Increase for better throughput on fast systems
  • Packet Limit: Set max packets in memory to prevent OOM errors

Logging Configuration

# Debug logging pcaptor.exe -f capture.pcap -html -log-level debug -log-file debug.log # Quiet mode (errors only) pcaptor.exe -f capture.pcap -html -q # Verbose mode (detailed progress) pcaptor.exe -f capture.pcap -html -v

Environment Variables

Set default behavior via environment variables:

# Windows set PCAPTOR_WORKERS=48 set PCAPTOR_OUTPUT_DIR=C:\Reports # Linux/macOS export PCAPTOR_WORKERS=48 export PCAPTOR_OUTPUT_DIR=/var/reports

🔧 Troubleshooting

Common Issues

Issue: "Failed to open PCAP file"

Symptoms: Error message when trying to open PCAP file

Solutions:
  • Verify file exists and path is correct
  • Check file permissions (read access required)
  • Ensure file is valid PCAP format (not PCAPNG)
  • Try absolute path instead of relative path

Issue: Slow Performance

Symptoms: Processing speed below 10,000 pkt/s

Solutions:
  • Increase worker threads: -w 48
  • Use high-memory config for large files
  • Disable unnecessary features (e.g., skip YARA if not needed)
  • Check disk I/O (use SSD for best performance)
  • Avoid loading thousands of generic YARA rules

Issue: Out of Memory

Symptoms: Process crashes or system becomes unresponsive

Solutions:
  • Use high-memory configuration: -config pcaptor-highmem.json
  • Enable streaming mode for large files
  • Reduce worker threads: -w 12
  • Process file in chunks (split large PCAP)
  • Close other applications to free memory

Issue: YARA Rules Not Loading

Symptoms: No YARA matches in report

Solutions:
  • Verify YARA directory path: -yara-dir ./yara/
  • Check .yar files exist in directory
  • Validate YARA rule syntax
  • Check log file for YARA compilation errors

Issue: Threat Intelligence Feeds Not Working

Symptoms: No TI matches or download errors

Solutions:
  • Check internet connectivity
  • Verify API keys are correct (VT, OTX)
  • Check intel_db/ directory permissions
  • Manually download feeds to test connectivity
  • Review log file for specific error messages

Performance Tips

💡 Optimization Checklist

  • ✅ Use SSD storage for PCAP files
  • ✅ Set workers to 2x CPU cores
  • ✅ Use included 92 YARA rules (optimized)
  • ✅ Enable high-memory mode for files over 1GB
  • ✅ Pre-download threat intelligence feeds
  • ✅ Use quiet mode (-q) for faster processing
  • ✅ Disable CSV/JSON if only HTML needed

Error Messages

"Invalid PCAP format"

File is PCAPNG format. Convert to PCAP using:

tshark -F pcap -r input.pcapng -w output.pcap

"Permission denied"

Run with appropriate permissions or move file to accessible location.

"YARA compilation failed"

Check YARA rule syntax. Use -log-level debug to see specific errors.

Getting Help

If you encounter issues not covered here:

  • Check log files with -log-level debug
  • Review documentation files in installation directory
  • Contact support with log file and error details
  • Include system specs and PCAP file size

❓ FAQ

General Questions

Q: What file formats are supported?

A: PCaptor Pro supports standard PCAP format. PCAPNG files need to be converted to PCAP first using tools like tshark or Wireshark.

Q: How large of a PCAP file can I analyze?

A: PCaptor Pro can handle multi-gigabyte PCAP files. For files over 1GB, use the high-memory configuration. The largest tested file is 50GB with streaming mode enabled.

Q: What's the processing speed?

A: PCaptor Pro processes up to 88,000+ packets/second with all features enabled on modern hardware (8+ cores, 16GB RAM, SSD storage).

Q: Can I use PCaptor Pro for live capture?

A: PCaptor Pro analyzes PCAP files. For live capture, use tools like tcpdump or Wireshark to capture traffic, then analyze with PCaptor Pro.

Features & Detection

Q: How many C2 frameworks can PCaptor Pro detect?

A: PCaptor Pro detects 25 C2 frameworks including Cobalt Strike, Metasploit, Brute Ratel C4, and 22 others. It uses 62 signatures with 90%+ real-world threat coverage.

Q: What ransomware families are detected?

A: 16 ransomware families including WannaCry, Ryuk, REvil, Conti, LockBit, BlackCat, Hive, Maze, DarkSide, and more. Detection includes behavioral analysis and C2 communication patterns.

Q: How accurate is the crypto mining detection?

A: Very high accuracy with 8 wallet types, 20+ mining pools, and 17 mining software signatures. Includes browser cryptojacking detection (Coinhive, Cryptoloot, JSEcoin).

Q: What are YARA rules and do I need them?

A: YARA rules are pattern-matching signatures for threat detection. PCaptor Pro includes 92 network-optimized rules that add only ~10% overhead. They're optional but highly recommended for comprehensive analysis.

Q: Can I create custom detection signatures?

A: Yes! PCaptor Pro supports custom JSON signatures. See the CUSTOM_SIGNATURES_GUIDE.md for detailed instructions and examples.

Licensing & Pricing

Q: What's the difference between Free and Pro versions?

A: Free version includes basic packet analysis and 5 YARA rules. Pro version adds 25 C2 frameworks, 92 YARA rules, 16 ransomware families, crypto mining detection, LOLBin detection, IoT/OT security, 13 plugins, and 18 threat intelligence feeds.

Q: Is the pricing one-time or subscription?

A: PCaptor Pro uses annual subscription pricing. Regular price is $599/year, currently available for $189/year (68% discount).

Q: Can I use PCaptor Pro commercially?

A: Yes, the Pro license includes commercial use rights for security analysis, incident response, and threat hunting.

Technical Questions

Q: Does PCaptor Pro require internet connectivity?

A: No, PCaptor Pro works offline. Internet is only needed for threat intelligence feed downloads (optional feature).

Q: What operating systems are supported?

A: Windows 10+, Linux (Ubuntu 20.04+), and macOS 11+. Binaries are provided for each platform.

Q: Can I integrate PCaptor Pro with my SIEM?

A: Yes, use CSV or JSON export formats for SIEM integration. The structured output includes all detection results and metadata.

Q: How often are threat intelligence feeds updated?

A: Free feeds (Feodo, URLhaus, SSL Blacklist, Tor nodes) update daily. Premium feeds (ThreatView) update hourly. PCaptor Pro caches feeds locally for offline analysis.

Q: Are plugins automatically loaded?

A: Yes, all 13 plugins are auto-discovered and loaded. No configuration needed.

Best Practices

Q: What's the recommended workflow for incident response?

A:

  1. Capture traffic during incident (tcpdump, Wireshark)
  2. Run full analysis: pcaptor.exe -f capture.pcap -html -yara-dir ./yara/ -ti-feeds
  3. Review HTML report for threats and anomalies
  4. Export CSV/JSON for detailed investigation
  5. Use findings to guide remediation

Q: Should I enable all features for every analysis?

A: For comprehensive threat hunting, yes. For quick triage, start with basic analysis then enable specific features as needed.

Q: How do I optimize for large PCAP files?

A: Use high-memory configuration, increase worker threads, enable streaming mode, and use SSD storage. See Configuration section for details.

💡 Pro Tips

  • Always enable YARA rules for comprehensive detection
  • Use threat intelligence feeds for IOC matching
  • Export multiple formats (HTML + CSV) for different audiences
  • Review plugin results for specialized threats
  • Keep threat feeds updated for latest IOCs