zeek-spicy-ospf

zeek-spicy-ospf This is a Spicy based OSPF v2 & v3 packet analyzer for Zeek. You must install Spicy to use this package. Links: Original logic imported from https://github.com/s-wells/spicyparsers/tree/main/ospf, with author's permission. https://datatracker.ietf.org/doc/html/rfc2328...

zeek-strrat-detector

A Zeek Based STRRAT Malware Detector This is a Zeek Spicy based STRRAT malware detector. PCAP https://app.any.run/tasks/4423258f-59bc-4a88-bfec-d8ac08c88538/ Example Output % zeek -Cr strrat-4423258f-59bc-4a88-bfec-d8ac08c88538.pcap zeek-strrat-detector % cat notice.log separator \x09 setseparato...

zeek-spicy-openvpn

zeek-spicy-openvpn This is a protocol analyzer that detects OpenVPN traffic. You must install Spicy to use this package. Blogs and webinars detailing the development of this protocol analyzer: https://zeek.org/2021/03/16/a-zeek-openvpn-protocol-analyzer/...

zeek-spicy-wireguard

zeek-spicy-wireguard This package provides a Spicy based Wireguard protocol analyzer for Zeek. You must install Spicy to use this package. This is a straightforward implementation following https://www.wireguard.com/protocol/ Wireguard Wireguard Logs separator \x09 setseparator , emptyfield empty...

zeek-spicy-ipsec

IPSec This is a Zeek protocol analyzer that detects IPSec VPN based on Spicy. You must install Spicy to use this package. A blog detailing the development of this analyzer: https://zeek.org/2021/04/20/zeeks-ipsec-protocol-analyzer/ RFCs: https://tools.ietf.org/html/rfc2406 ESP...

zeek-spicy-facefish

FacefishRootkit This Zeek+Spicy analyzer will detect the Facefish Linux rootkit C2 as described in: https://blog.netlab.360.com/sshstealerfacefishen/ https://blogs.juniper.net/en-us/threat-research/linux-servers-hijacked-to-implant-ssh-backdoor...

zeek-spicy-openvpn

zeek-spicy-openvpn Questo è un analizzatore di protocollo che rileva il traffico OpenVPN. Per usare questo pacchetto è necessario installare Spicy. Blog e webinar che descrivono lo sviluppo di questo analizzatore di protocollo: https://zeek.org/2021/03/16/a-zeek-openvpn-protocol-analyzer/...

zeek-spicy-stun

STUN Session Traversal Utilities for NAT STUN Questo è un analizzatore di protocollo Zeek che rileva STUN basato su Spicy. Devi installare Spicy per usare questo pacchetto. Questo pacchetto creerà due log: stun.log - Questo log contiene ogni messaggio STUN. stunnat.log - Questo log contiene le...