icannTLD

icannTLD Corelight-update ahora se puede utilizar para crear y mantener los archivos de entrada de icannTLD. Descripción del script Script de Zeek que utiliza la lista oficial de dominios de nivel superior TLD de ICANN con el Input Framework para extraer la información relevante de una consulta D...

Zeek-Endpoint-Enrichment-conn

Zeek-Endpoint-Enrichment-conn Enrich the conn.log with EDR data For detailed documentation, see https://docs.corelight.com...

cve-2020-0601

Zeek test script for CVE-2020-0601 This script can detect exploit attempts for CVE-2020-0601. It performs a simple check to see if a known curve is used in a certificate - if this is not the case a notice is raised. Example notice in notice.log: root@kitploit: 1579043477.791522 CHhAvVGS1DHFjwGM9...

CVE-2022-21449

CVE-2022-21449 Zeek script to detect exploitation attempts of CVE-2022-21449 targeting TLS clients. Only works for TLS 1.2 and below. Install zkg install https://github.com/thack1/CVE-2022-21449 Run Run against supplied pcap file: $ zeek -Cr pcaps/CVE-2022-21449.pcap CVE-2022-21449 Example Notice...

Exploit for CVE-2021-38647

cve-2021-38647 https://github.com/corelight/CVE-2021-38647 wit...

Exploit for CVE-2021-1675

PrintNightmare CVE-2021-1675 This Zeek script detects succe...