
detect-ransomware-filenames
Zeek script that monitors SMB traffic and alerts on known ransomware filenames using the Anti-Ransomware File System Resource Manager list.

Zeek script that monitors SMB traffic and alerts on known ransomware filenames using the Anti-Ransomware File System Resource Manager list.

Source code for a BPFDoor backdoor controller supporting TCP, UDP, ICMP, and HTTPS covert communication channels with magic packet activation,…

A Zeek package to detect the Pingback malware ICMP tunnel command and control (C2) network traffic.

A Zeek ELF File Analyzer

Bro/Zeek script for detecting Apache Struts CVE-2017-5638 reconnaissance, compromise, and malware download tracking with automated IP extraction.

Batch-mode checker for Shadowhammer malware indicators, scanning local or provided MAC addresses against known malicious hashes, with offline support…

A Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.

Zeek detector for QuasarRat

Detection for SUNBURST C2 Stage-1 using Shannon Entropy

A Zeek based AsyncRAT malware detector.

Originally a Honeypot for CVE-2026-20131

A Zeek based STRRAT malware detector.

A Zeek based Agent Tesla malware C2 detector.

A Zeek based Gozi banking malware detector.

A Zeek protocol analyzer for the Facefish rootkit, based on Spicy.

CVE-2023-46604 (Apache ActiveMQ RCE Vulnerability) and focused on getting Indicators of Compromise.

TLS checking component of purpleteam