zeek-spicy-facefish

FacefishRootkit This Zeek+Spicy analyzer will detect the Facefish Linux rootkit C2 as described in: https://blog.netlab.360.com/sshstealerfacefishen/ https://blogs.juniper.net/en-us/threat-research/linux-servers-hijacked-to-implant-ssh-backdoor...