├── LICENSE ├── README.md ├── __load__.bro ├── auth_bruteforcing.bro ├── bugzilla_bruteforce.bro ├── chrome-sha1.bro ├── cipher_stats.bro ├── conn-add-country.bro ├── conn-peer.bro ├── conn_bad_subnet.bro ├── conn_bad_subnet_input.bro ├── counttable.bro ├── detect-bruteforcing-ext.bro ├── detect_open_proxies.bro ├── dhcpr.bro ├── dlp.bro ├── dlp_input.bro ├── dlp_input.txt ├── excessive_http_errors_topk.bro ├── extract-interesting-files.bro ├── filter_input.bro ├── filter_noise_conn.bro ├── filter_noise_dns.bro ├── filter_noise_files.bro ├── filter_noise_http.bro ├── filter_noise_intel.bro ├── filter_noise_mysql.bro ├── filter_noise_ssl.bro ├── filter_noise_x509.bro ├── find_non_aes_clients.bro ├── find_non_aes_servers.bro ├── heartbleed_mozillaca.bro ├── http_auth_base64.bro ├── http_headers_lb.bro ├── intel-dns.bro ├── intel-ext ├── LICENSE ├── __load__.bro ├── conn-udp-icmp.bro ├── dns-answers.bro ├── ftp-username.bro ├── radius.bro ├── smtp-subject.bro └── ssl.bro ├── livecheck.bro ├── perfect_forward_secrecy.bro ├── radius_bruteforcing.bro ├── sqli.bro ├── sshverlong.bro ├── ssl-ciphers.bro ├── ssl-log-ext.bro ├── ssl-log-ext1.bro ├── sslproto_stats.bro ├── subnettopk.bro ├── unix_commands.bro ├── unusual_http_methods.bro ├── validate-certs-cache-intermediates.bro ├── verify_wpad.bro ├── weak-keys-mozilla.bro ├── weak_ciphers.bro ├── weak_protocols.bro ├── whitelist_scan_detection.bro ├── whitelist_scan_detection_input.bro └── whitelist_scan_ip.txt /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/LICENSE -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/README.md -------------------------------------------------------------------------------- /__load__.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/__load__.bro -------------------------------------------------------------------------------- /auth_bruteforcing.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/auth_bruteforcing.bro -------------------------------------------------------------------------------- /bugzilla_bruteforce.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/bugzilla_bruteforce.bro -------------------------------------------------------------------------------- /chrome-sha1.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/chrome-sha1.bro -------------------------------------------------------------------------------- /cipher_stats.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/cipher_stats.bro -------------------------------------------------------------------------------- /conn-add-country.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/conn-add-country.bro -------------------------------------------------------------------------------- /conn-peer.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/conn-peer.bro -------------------------------------------------------------------------------- /conn_bad_subnet.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/conn_bad_subnet.bro -------------------------------------------------------------------------------- /conn_bad_subnet_input.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/conn_bad_subnet_input.bro -------------------------------------------------------------------------------- /counttable.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/counttable.bro -------------------------------------------------------------------------------- /detect-bruteforcing-ext.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/detect-bruteforcing-ext.bro -------------------------------------------------------------------------------- /detect_open_proxies.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/detect_open_proxies.bro -------------------------------------------------------------------------------- /dhcpr.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/dhcpr.bro -------------------------------------------------------------------------------- /dlp.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/dlp.bro -------------------------------------------------------------------------------- /dlp_input.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/dlp_input.bro -------------------------------------------------------------------------------- /dlp_input.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/dlp_input.txt -------------------------------------------------------------------------------- /excessive_http_errors_topk.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/excessive_http_errors_topk.bro -------------------------------------------------------------------------------- /extract-interesting-files.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/extract-interesting-files.bro -------------------------------------------------------------------------------- /filter_input.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/filter_input.bro -------------------------------------------------------------------------------- /filter_noise_conn.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/filter_noise_conn.bro -------------------------------------------------------------------------------- /filter_noise_dns.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/filter_noise_dns.bro -------------------------------------------------------------------------------- /filter_noise_files.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/filter_noise_files.bro -------------------------------------------------------------------------------- /filter_noise_http.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/filter_noise_http.bro -------------------------------------------------------------------------------- /filter_noise_intel.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/filter_noise_intel.bro -------------------------------------------------------------------------------- /filter_noise_mysql.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/filter_noise_mysql.bro -------------------------------------------------------------------------------- /filter_noise_ssl.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/filter_noise_ssl.bro -------------------------------------------------------------------------------- /filter_noise_x509.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/filter_noise_x509.bro -------------------------------------------------------------------------------- /find_non_aes_clients.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/find_non_aes_clients.bro -------------------------------------------------------------------------------- /find_non_aes_servers.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/find_non_aes_servers.bro -------------------------------------------------------------------------------- /heartbleed_mozillaca.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/heartbleed_mozillaca.bro -------------------------------------------------------------------------------- /http_auth_base64.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/http_auth_base64.bro -------------------------------------------------------------------------------- /http_headers_lb.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/http_headers_lb.bro -------------------------------------------------------------------------------- /intel-dns.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/intel-dns.bro -------------------------------------------------------------------------------- /intel-ext/LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/intel-ext/LICENSE -------------------------------------------------------------------------------- /intel-ext/__load__.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/intel-ext/__load__.bro -------------------------------------------------------------------------------- /intel-ext/conn-udp-icmp.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/intel-ext/conn-udp-icmp.bro -------------------------------------------------------------------------------- /intel-ext/dns-answers.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/intel-ext/dns-answers.bro -------------------------------------------------------------------------------- /intel-ext/ftp-username.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/intel-ext/ftp-username.bro -------------------------------------------------------------------------------- /intel-ext/radius.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/intel-ext/radius.bro -------------------------------------------------------------------------------- /intel-ext/smtp-subject.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/intel-ext/smtp-subject.bro -------------------------------------------------------------------------------- /intel-ext/ssl.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/intel-ext/ssl.bro -------------------------------------------------------------------------------- /livecheck.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/livecheck.bro -------------------------------------------------------------------------------- /perfect_forward_secrecy.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/perfect_forward_secrecy.bro -------------------------------------------------------------------------------- /radius_bruteforcing.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/radius_bruteforcing.bro -------------------------------------------------------------------------------- /sqli.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/sqli.bro -------------------------------------------------------------------------------- /sshverlong.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/sshverlong.bro -------------------------------------------------------------------------------- /ssl-ciphers.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/ssl-ciphers.bro -------------------------------------------------------------------------------- /ssl-log-ext.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/ssl-log-ext.bro -------------------------------------------------------------------------------- /ssl-log-ext1.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/ssl-log-ext1.bro -------------------------------------------------------------------------------- /sslproto_stats.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/sslproto_stats.bro -------------------------------------------------------------------------------- /subnettopk.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/subnettopk.bro -------------------------------------------------------------------------------- /unix_commands.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/unix_commands.bro -------------------------------------------------------------------------------- /unusual_http_methods.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/unusual_http_methods.bro -------------------------------------------------------------------------------- /validate-certs-cache-intermediates.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/validate-certs-cache-intermediates.bro -------------------------------------------------------------------------------- /verify_wpad.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/verify_wpad.bro -------------------------------------------------------------------------------- /weak-keys-mozilla.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/weak-keys-mozilla.bro -------------------------------------------------------------------------------- /weak_ciphers.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/weak_ciphers.bro -------------------------------------------------------------------------------- /weak_protocols.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/weak_protocols.bro -------------------------------------------------------------------------------- /whitelist_scan_detection.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/whitelist_scan_detection.bro -------------------------------------------------------------------------------- /whitelist_scan_detection_input.bro: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/whitelist_scan_detection_input.bro -------------------------------------------------------------------------------- /whitelist_scan_ip.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/michalpurzynski/zeek-scripts/HEAD/whitelist_scan_ip.txt --------------------------------------------------------------------------------