By keithjjones

A Zeek based Amadey malware detector.


By captainGeech42

Label bogon IPs in conn.log


By corelight

"Community ID" flow hash support in conn.log


By awelzel

Regularly log footprints of long running connections.


By jsiwek

Detects Bitcoin, Litecoin, or other cryptocurrency mining traffic that uses getwork, getblocktemplate, or Stratum mining protocols over TCP or HTTP. This package used to be named "bro_bitcoin".


By endace

Packet source plugin that provides native support for Endace DAG card and EndaceProbe Application Dock packet capture.


By corelight

This package provides some basic analysis for ELF files.


By 0xl3x1

EternalSafety is a Zeek package for detecting potentially-dangerous SMBv1 protocol violations that encapsulate bugs exploited by the infamous Eternal* family of Windows exploits. It is capable of detecting EternalBlue, EternalSynergy/EternalRomance, EternalChampion, and the DoublePulsar backdoor. However, rather than identifying these exploits via simple signature-matching, *EternalSafety* instead implements a set of SMBv1 protocol invariants that encapsulate techniques used by each Eternal* exploit to trigger bugs in unpatched Windows systems. EternalSafety accurately and reliably identifies the EternalBlue, EternalSynergy and EternalRomance exploits, and the DoublePulsar backdoor implant. Due to limitations in Zeek's SMBv1 support, it has limited support for detecting EternalChampion via signature-matching. EternalSafety also identifies a range of other protocol violations, such as the use of unimplemented/unused SMBv1 commands, server-initiated changes in values that may only be set by an SMBv1 client, and incorrect interleaving of transaction types.


By esnet

Prometheus exporter for Zeek performance data


By corelight

This plugin adds support for shell-style glob patterns when loading Zeek scripts. For example, saying "@load startup.d/*.zeek" will load any Zeek scripts with a .zeek suffix from the startup.d folder.


By corelight

A Zeek based Gozi malware detector.


By precurse

Checks for HTTP anomalies typically used for attacking.


By captainGeech42

Extend Intel framework to alert on URL paths


By justinazoff

A broctl plugin that enables jemalloc profiling


By dopheide

Detect exploit attempt of HP JetDirect printers


By corelight

This package provides some basic analysis for JPEG files.


By seisollc

A Zeek log writer plugin that publishes to Kafka.


By dopheide

This script expands the base known-hosts policy to include reverse DNS queries and syncs it across all workers.

Page 9 of 13, showing 20 record(s) out of 241 total