Discover corelight/C2-detection-manjusaka Open Source project

164

threat-hunting-guide

raspi-corelight

Corelight@Home script

Mapping Corelight or Zeek data to Elastic Common Schema fields

ecs-mapping

ripple20

A Zeek package for the passive detection of "Ripple20" vulnerabilities in the Treck TCP/IP stack.

A Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for further processing!

zeek2es

Zeek support for Community ID flow hashing.

zeek-community-id

Detects attempts and successful exploitation of CVE-2022-26809

cve-2022-26809

Auto wrap C and C++ functions with instrumentation

cwrap

Perl

zeek-long-connections

Zeek package for tracking long connections to report them before they have completed.

Elastic version of SOC prime watcher rules

Elasticsearch_rules

json-streaming-logs

Bro script package to create JSON formatted logs to stream into data analysis systems.

A Python implementation of the Community ID flow hashing standard

pycommunityid

Log4j Exploit Detection Logic for Zeek

cve-2021-44228

Detect HTTP stalling attacks like slowloris with Bro

http-stalling-detector

detect-ransomware-filenames

A Zeek package to detect CVE-2021-42292, a Microsoft Excel local privilege escalation exploit.

CVE-2021-42292

Corelight Sensor API command-line client

corelight-client

DNS Dashboard for hunting and identifying beaconing

Dashboards-Splunk-DNS-Hunting-Beaconing

log-add-http-post-bodies

Add POST body excerpt to Bro's HTTP log

Corelight-Ansible-Roles are a collection of Ansible Roles and playbooks that install, configure, run and manage a variety of Corelight, Suricata and Zeek solutions.

Corelight-Ansible-Roles

Jinja

json-tcp-lb

line based tcp load balancing proxy.

CVE-2021-31166

HTTP Protocol Stack CVE-2021-31166

A Bro package to identify connections that are bursting (lots of data and transferring quickly).

conn-burst

A Prometheus Exporter for Suricata

suricata_exporter

got_zoom

A Zeek package that detects Zoom logins and meeting joins

Zeek package to detect Zerologon

zerologon

zeek-elf

A Zeek ELF File Analyzer

Bro analyzer that detects Google's QUIC protocol

zeek-quic

JavaScript

ecs-logstash-mappings

Mapping Corelight or Zeek data to Elastic Common Schema logs

top-dns

Top DNS Measurement for Bro

Detection of attempts to exploit Microsoft Windows DNS server via CVE-2020-1350 (AKA SIGRed)

SIGRed

CVE-2021-1675

A network detection package for CVE-2020-16898 (Windows TCP/IP Remote Code Execution Vulnerability)

CVE-2020-16898

A Zeek OpenVPN protocol analyzer, based on Spicy.

zeek-spicy-openvpn

ZeekJS - Experimental JavaScript support for Zeek.

zeekjs

C++

phantom-playbooks

A Zeek package to detect the Pingback malware ICMP tunnel command and control (C2) network traffic.

ecs-dashboards

pingback

Corelight or Zeek Elastic Common Schema Templates

ecs-templates

A Zeek OpenVPN protocol analyzer plugin.

zeek-openvpn

JavaScript

zeek-spicy-ospf

A Zeek OSPF packet analyzer based on Spicy.

Ubuntu-based builder including Go, NPM and Ruby tool FPM (for fleet-api)

docker-fleet-api-ci

Dockerfile

zeek-jpeg

A Zeek JPEG File Analyzer

Detection of RCE in Oracle's WebLogic Server CVE-2020-14882 / CVE-2020-14750

CVE-2020-14882-weblogicRCE

Plugin to support libmaxminddb in Bro

bro-maxminddb

CMake

zeek-spicy-ipsec

A Zeek IPSec protocol analyzer based on Spicy.

CVE-2021-38647 AKA "OMIGOD" vulnerability in Windows OMI

CVE-2021-38647

Add VLAN tags to all Zeek logs

log-add-vlan-everywhere

Zeek Plugin that detects CallStranger (CVE-2020-12695) attempts (http://callstranger.com/)

callstranger-detector

Zeek plugin to detect and decrypt XOR-encrypted EXEs

zeek-xor-exe-plugin

C++

CVE-2022-26937

A Zeek package to detect CVE-2022-26937, a vulnerability in the Network Lock Manager (NLM) protocol in Windows NFS server.

A network detection package for CVE-2020-5902, a CVE10.0 vulnerability affecting F5 Networks, Inc BIG-IP devices.

CVE-2020-5902-F5BigIP

Detects attempts at exploitation of CVE-2022-3602, a remote code execution vulnerability in OpenSSL v 3.0.0 through v.3.0.6

CVE-2022-3602

cve-2022-21907

Plot packet and data rates over time given a PCAP file, with gnuplot.

plotcap

Rust

c-community-id

A reusable C implementation of the Community ID standard

zeek-spicy-stun

A Zeek STUN protocol analyzer based on Spicy.

A Zeek Wireguard protocol analyzer based on Spicy.

zeek-spicy-wireguard

A Zeek Mach-o File Analyzer

zeek-macho

Zeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and mark whether it's trusted or not. The source of the ICANN TLD's can be found here: https://publicsuffix.org/list/effective_tld_names.dat. The Trusted Domains list is a custom list, created by the user, to filter domains during searches.

icannTLD

A Zeek detector for CVE-2022-24497.

CVE-2022-24497

Detection of Linux Malware C2 RedXOR - demonstration

redxor

A python package to indent Zeek scripts per the Whitesmiths coding style.

zeek-indenter

reduce amount of tracked smb state

zeek-smb-clear-state

Chronicle parser for CORELIGHT and related information.

Chronicle

Hardware description script module for Bro.

bro-hardware

A Zeek CVE-2022-24491 detector.

CVE-2022-24491

Dockerfile building Serverless with Terraform for CI/CD

docker-terraform-serverless

Dockerfile

ztest

Zeek Unit Testing. Provides a framework to write unit tests for Zeek scripts.

ShellShock attack and exploit detector for Bro.

bro-shellshock

Zeek Notice Telegram (ZeekJS edition)

zeekjs-notice-telegram

JavaScript

PetitPotam

Add more filenames to files.log from HTTP requests

http-more-files-names

Dr. Watson catcher script for Bro.

bro-drwatson

Clear SSL State earlier to reduce memory usage

ansible-awx-docker-bundle

Jinja

zeek-ssl-clear-state

Fingerprint SSH clients and servers.

hassh

Purely signature based protocol detection for Bro

bro-protosigs

Standard ML

CVE-2022-23270-PPTP

A Zeek package to detect CVE-2022-23270, a PPTP vulnerability in Windows.

A Go library for using zeek broker's websocket API

go-zeek-broker-ws

softsensor-docker-prototype

Softsensor Docker prototype

Send Notices as messages over Telegram

zeek-notice-telegram

cve-2022-22954

A vulnerable Boa web server detector.

boa-detector

A Zeek protocol analyzer for the Facefish rootkit, based on Spicy.

zeek-spicy-facefish

CMake

zeek-globload

Zeek package to support glob patterns in the @load directive

Alpine docker container preloaded with AWS CLI and Git for CI/CD

alpine-aws

Dockerfile

zeek-ta-splunk

Zeek TA Splunk

zeek-spicy-radius

A Zeek Radius protocol analyzer, written in Spicy.

Zeek detection logic for CVE-2022-30216.

CVE-2022-30216

A Zeek package which raises notices for Path Traversal/RCE in Apache HTTP Server 2.4.49 (CVE-2021-41773) and 2.4.50 (CVE-2021-42013)

CVE-2021-41773

A Zeek based AsyncRAT malware detector.

zeek-asyncrat-detector