ng-isa Goto Github PK

bro-long-connections

Zeek package for tracking long connections to report them before they have completed.

bro-scripts

Misc. Bro scripts

bro-scripts-1

Various Bro scripts

bzar

A set of Zeek scripts to detect ATT&CK techniques.

c3

Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

community-id-spec

An open standard for hashing network flows into identifiers, a.k.a "Community IDs".

dashboards-splunk-dns-hunting-beaconing

DNS Dashboard for hunting and identifying beaconing

detect-ransomware-filenames

domainfrontinglists

A list of Domain Frontable Domains by CDN

dref

DNS Rebinding Exploitation Framework

dscompromised

findfrontabledomains

Search for potential frontable domains

icanntld

Zeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and mark whether it's trusted or not. The source of the ICANN TLD's can be found here: https://publicsuffix.org/list/effective_tld_names.dat. The Trusted Domains list is a custom list, created by the user, to filter domains during searches.

icmptunnel

Tunnel IP over ICMP.

ldap-analyzer

Bro analyzer for LDAP write operations

metasploit-framework

Metasploit Framework

pcap-attack

PCAP Samples for Different Post Exploitation Techniques

sharpmeter

shuffle

Shuffle: A general purpose security automation platform platform. We focus on accessibility for all.

shuffle-apps

Apps to be used for Shuffle SOAR

shuffle-workflows

Workflows for Shuffle

sigma

Generic Signature Format for SIEM Systems

streamingphish

Python-based utility that uses supervised machine learning to detect phishing domains from the Certificate Transparency log network.

sysmon

whids

Open Source EDR for Windows

zeek-attack

Gathering of scripts that explore using Zeek to detect MITRE ATT&CK techniques.

ztest

Zeek Unit Testing. Provides a framework to write unit tests for Zeek scripts.