Bro

Intrusion detection system.

https://github.com/bro

https://github.com/LiamRandall/bro-training

Bro training has pcaps with sample things like malware hiding shells in HTTP traffic.

https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan%3AWin32%2FYayih.A