
CVE-2022-26937
A Zeek package to detect CVE-2022-26937, a vulnerability in the Network Lock Manager (NLM) protocol in Windows NFS server.

A Zeek package to detect CVE-2022-26937, a vulnerability in the Network Lock Manager (NLM) protocol in Windows NFS server.

A tool to assist with network-based hunting for GRU's Drovorub malware c2

Suricata LUA scripts to detect CVE-2019-12255, CVE-2019-12256, CVE-2019-12258, and CVE-2019-12260

A Zeek package to detect CVE-2021-42292, a Microsoft Excel local privilege escalation exploit.

Detection of attempts to exploit Microsoft Windows DNS server via CVE-2020-1350 (AKA SIGRed)

An eBPF program to detect attacks on CVE-2022-0847

Zeek plugin to detect and decrypt XOR-encrypted EXEs

Zeek package that uses OpenSSL to detect CVE-2020-0601 exploit attempts

CVE-2026-24207 — NVIDIA Triton SageMaker auth bypass to unauth RCE. Detection script, bypass demo, RCE-chain PoC, and IDS rules.

Different rules to detect if CVE-2021-31166 is being exploited

A Zeek package to detect CVE-2022-23270, a PPTP vulnerability in Windows.

Exploring CVE-2021-42013, using Suricata and OpenVAS to gather info

to catch cve-2021-1675-printnightmare

Repo containing lua scripts and PCAP to find CVE-2020-0601 exploit attempts via network traffic

Zeek Package to detect cve-2017-2741

Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications.

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those…

Daemon to ban hosts that cause multiple authentication errors