Bro/Zeek Detection Script Collection

A collection of bro/zeek detection scripts. This is just a list.

Detection of techniques

• Mitre BZAR
• Detection of Long Connections
• Ransomware Filenames
• PingBack
• Cryptomining

Detection of Vulnerabilities

• CVE-2020-0601
  • 0xxon
• CVE-2020-1472 - Zerologon
  • Corelight
• CVE-2020-12695 - CallStranger
  • Corelight
• CVE-2020-13777
  • 0xxon

Threat Intelligence

• Zeek Intelligence Feeds

Custom Protocol Dissectors

• Ethernet/IP + Common Industrial Protocol/CIP
  • Amazon
  • CISA
• PROFINET
• BACNET
• STEP7
• Tabular Data Stream
• IKEv2

Other

• Plaintext Password Sniffer