Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

pingback

Pingback C2 Detection A Zeek package and Suricata rules for detection of ICMP ping tunnels created by the Pingback C2 tool. Accompanying blog post: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Installation The easiest way to install this package is through zkg: zkg install...

cve-2021-44228

CVE-2021-44228 A Zeek package which raises notices, tags HTTP connections and optionally generates a log for Log4J CVE-2021-44228 attempts. Detects payload contained in HTTP headers: See Simplifying Detection of Log4Shell for details. Uses Zeek signatures to generate notices when a Java file is...

zeek-long-connections

Long Connections Zeek normally logs connections at the end of the connection, but this can cause trouble for incident responders in the case of very long lived connections that end up being unknown to defenders until too late. This package provides a new log named connlong which will log...

CVE-2022-26937

CVE-2022-26937 A package to detect CVE-2022-26937, a vulnerability in Microsoft's NFS implementation. Example You can run this logic on the included PCAP in the testing\traces directory: root@kitploit: $ zeek -Cr CVE-2022-26937-exploited.pcap /Source/CVE-2022-26937/scripts/load.zeek $ cat...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

beacon-hunter

Beacon Hunter Detecting Non-Periodic Structured C2 via Additive Recurrence Beacon Hunter detects command-and-control beaconing that uses phi-compatible additive recurrence scheduling — a growing, non-periodic timing pattern where each inter-connection interval approximately equals the sum of the...

zeek-spicy-openvpn

zeek-spicy-openvpn This is a protocol analyzer that detects OpenVPN traffic. You must install Spicy to use this package. Blogs and webinars detailing the development of this protocol analyzer: https://zeek.org/2021/03/16/a-zeek-openvpn-protocol-analyzer/...

threat-hunting-guide

Corelight Threat Hunting Guide working copy This repository serves as the working data for the Corelight Threat Hunting Guide. The source prose which is maintained here is periodically put through editing, layout, and graphic design, and then published as a PDF file and distributed by Corelight,...

CVE-2021-41773

CVE-2021-41773 A Zeek package which raises notices for Path Traversal/RCE in Apache HTTP Server 2.4.49 CVE-2021-41773 and 2.4.50 CVE-2021-42013 References https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-41773 https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-42013...

SIGRed

CVE-2020-1350 AKA SIGRed v0.30 Summary: A Zeek package for detection of attempts to exploit Microsoft Windows DNS server via CVE-2020-1350 AKA SIGRed - CVE Score of 10.0 References:...

CVE-2021-31166

CVE-2021-31166 Detection of attempts to exploit CVE-2021-31166 HTTP Protocol Stack vulnerability Suricata rule Zeek Package References https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

zeek-spicy-ipsec

IPSec This is a Zeek protocol analyzer that detects IPSec VPN based on Spicy. You must install Spicy to use this package. A blog detailing the development of this analyzer: https://zeek.org/2021/04/20/zeeks-ipsec-protocol-analyzer/ RFCs: https://tools.ietf.org/html/rfc2406 ESP...

zeek

The Zeek Network Security Monitor...

CVE-2021-38647

CVE-2021-38647 AKA "OMIGOD" A Zeek package which detects CVE-2021-38647 AKA OMIGOD exploit attempts. https://corelight.com/blog/detecting-cve-2021-38647-omigod https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647...

CVE-2022-23270-PPTP

CVE-2022-23270 A package to detect CVE-2022-23270, a vulnerability in Microsoft's PPTP implementation. Example You can run this logic on the included PCAP in the testing\traces directory: root@kitploit: $ zeek -Cr CVE-2022-23270-exploited.pcap packages $ cat notice.log separator \x09 setseparator...

zeek-spicy-stun

STUN Session Traversal Utilities for NAT STUN This is a Zeek protocol analyzer that detects STUN based on Spicy. You must install Spicy to use this package. This package will create two logs: stun.log - This log has every STUN message. stunnat.log - This log has NAT detections from mapped...

ecs-logstash-mappings

Corelight ECS Logstash Pipeline The repository is compromised of Logstash Pipeline files required to be used with the installer script in the repository https://github.com/corelight/ecs-templates The installer in that repository will download the files from this repository therefore using this...

ExtendIntel

ExtendIntel This package extends the Intel package to log more fields If the intel file contains the following fields, the data will automatically be added to the intel.log. threatscore verdict verdictsource confidence desc lastseen firstseen url reports campaigns associated category...