mitre-attack / bzar Goto Github PK
View Code? Open in Web Editor NEWA set of Zeek scripts to detect ATT&CK techniques.
License: BSD 3-Clause "New" or "Revised" License
bzar's People
Contributors
Stargazers
Watchers
Forkers
goldentan jingqiangliu magnologan dbuentello benhe119 kisses99 corelight-ricky gtrunsec justinazoff blue-infosec cybertaoflow jack51706 fate9091 hartescout intelthreat invokethreatguy xiaoruiguo itzdan gplay1 masterscott ace-arch weiwhy criticalpathsecurity jyxl nusiloot heraldt amarjitghuman shamimrezasohag apython123 megatronga ng-isa dk47os3r trzaidi leche671 bigbrobro matry11 hiendv quangnc2k neoned71 br3ach3r-fff ammasajan tjleach webvul okadahiro0621 greenwoodjw ashloftis3 ofmendi greylegion07 otnms cyanitol-backup eodsampson laithsamara mmguero-dev 721574n papasmurff415 starrysec musaddiqs sebastianopiyo ethicalsecurity-agency ndrtd 5l1v3r1 sethmisenar gmmos yannisdevon mjmcphee mahdi3126 solucionestux chriss-0x01 gmh5225 emadyaybzar's Issues
Add new endpoint::operation to persistence
winreg::baseregcreatekey
winreg::baseregsetvalue
does not work with Zeek v5.0
Zeek v5.0.0 was recently released. Here are the errors/warnings I get when using this package with that release:
> zeek -NN local 2>&1 | grep -i bzar
warning in /opt/zeek/share/zeek/site/packages/./bzar/./main.zeek, lines 126-130: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::orig_h, BZAR::w (when ((BZAR::n1 = lookup_addr(BZAR::orig_h)) && (BZAR::n1 in BZAR::w$orig_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
warning in /opt/zeek/share/zeek/site/packages/./bzar/./main.zeek, lines 137-141: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::resp_h, BZAR::w (when ((BZAR::n2 = lookup_addr(BZAR::resp_h)) && (BZAR::n2 in BZAR::w$resp_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25: type clash (string and drsuapi::DRSReplicaSync)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25 and string: type mismatch (drsuapi::DRSReplicaSync and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: inconsistent type in set constructor (set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: type clash in assignment (BZAR::t1003_006_rpc_strings = set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 42: type clash (string and eventlog::ElfrClearELFW)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 42 and string: type mismatch (eventlog::ElfrClearELFW and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 43-44: inconsistent type in set constructor (set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 43-44: type clash in assignment (BZAR::t1070_001_rpc_strings = set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 62: type clash (string and svcctl::CreateServiceWOW64W)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 62 and string: type mismatch (svcctl::CreateServiceWOW64W and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 66-67: inconsistent type in set constructor (set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 66-67: type clash in assignment (BZAR::t1569_002_rpc_strings = set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 73: type clash (string and IWbemServices::ExecMethod)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 73 and string: type mismatch (IWbemServices::ExecMethod and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 73-74: inconsistent type in set constructor (set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 73-74: type clash in assignment (BZAR::t1047_rpc_strings = set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: type clash (string and atsvc::JobAdd)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80 and string: type mismatch (atsvc::JobAdd and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: inconsistent type in set constructor (set(atsvc::JobAdd))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: type clash in assignment (BZAR::t1053_002_rpc_strings = set(atsvc::JobAdd))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 86: type clash (string and ITaskSchedulerService::SchRpcRegisterTask)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 86 and string: type mismatch (ITaskSchedulerService::SchRpcRegisterTask and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 87-88: inconsistent type in set constructor (set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 87-88: type clash in assignment (BZAR::t1053_005_rpc_strings = set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 103: type clash (string and winreg::BaseInitiateSystemShutdown)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 103 and string: type mismatch (winreg::BaseInitiateSystemShutdown and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 108-109: inconsistent type in set constructor (set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 108-109: type clash in assignment (BZAR::t1529_rpc_strings = set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 125: type clash (string and ISecLogon::SeclCreateProcessWithLogonW)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 125 and string: type mismatch (ISecLogon::SeclCreateProcessWithLogonW and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 125-126: inconsistent type in set constructor (set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 125-126: type clash in assignment (BZAR::t1547_004_rpc_strings = set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 132: type clash (string and spoolss::RpcAddMonitor)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 132 and string: type mismatch (spoolss::RpcAddMonitor and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 134-135: inconsistent type in set constructor (set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 134-135: type clash in assignment (BZAR::t1547_010_rpc_strings = set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 159: type clash (string and srvsvc::NetrServerTransportEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 159 and string: type mismatch (srvsvc::NetrServerTransportEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 159-160: inconsistent type in set constructor (set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 159-160: type clash in assignment (BZAR::t1016_rpc_strings = set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 166: type clash (string and srvsvc::NetrServerGetInfo)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 166 and string: type mismatch (srvsvc::NetrServerGetInfo and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 167-168: inconsistent type in set constructor (set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 167-168: type clash in assignment (BZAR::t1018_rpc_strings = set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 174: type clash (string and lsarpc::LsarGetUserName)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 174 and string: type mismatch (lsarpc::LsarGetUserName and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 185-186: inconsistent type in set constructor (set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 185-186: type clash in assignment (BZAR::t1033_rpc_strings = set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 192: type clash (string and srvsvc::NetrConnectionEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 192 and string: type mismatch (srvsvc::NetrConnectionEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 192-193: inconsistent type in set constructor (set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 192-193: type clash in assignment (BZAR::t1049_rpc_strings = set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 199: type clash (string and lsarpc::LsarEnumerateAccountRights)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 199 and string: type mismatch (lsarpc::LsarEnumerateAccountRights and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 209-210: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 209-210: type clash in assignment (BZAR::t1069_rpc_strings = set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 216: type clash (string and lsarpc::LsarQueryInformationPolicy)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 216 and string: type mismatch (lsarpc::LsarQueryInformationPolicy and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 219-221: inconsistent type in set constructor (set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 219-221: type clash in assignment (BZAR::t1082_rpc_strings = set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: type clash (string and srvsvc::NetrFileEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227 and string: type mismatch (srvsvc::NetrFileEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: inconsistent type in set constructor (set(srvsvc::NetrFileEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: type clash in assignment (BZAR::t1083_rpc_strings = set(srvsvc::NetrFileEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 233: type clash (string and lsarpc::LsarEnumerateAccounts)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 233 and string: type mismatch (lsarpc::LsarEnumerateAccounts and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 252-254: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 252-254: type clash in assignment (BZAR::t1087_rpc_strings = set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: type clash (string and srvsvc::NetrRemoteTOD)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260 and string: type mismatch (srvsvc::NetrRemoteTOD and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: inconsistent type in set constructor (set(srvsvc::NetrRemoteTOD))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: type clash in assignment (BZAR::t1124_rpc_strings = set(srvsvc::NetrRemoteTOD))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 266: type clash (string and srvsvc::NetrShareEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 266 and string: type mismatch (srvsvc::NetrShareEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 266-267: inconsistent type in set constructor (set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 266-267: type clash in assignment (BZAR::t1135_rpc_strings = set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))
PR to Zeek for the UUID/Endpoint Mapping
First great work! This is awesome.
Have you all thought about creating a PR to Zeek for the UUID & Endpoint mappings you all have in this project?
The BZAR project adds 144 more Microsoft DCE-RPC Interface UUIDs (a.k.a. "endpoints") to the Bro/Zeek DCE_RPC::uuid_endpoint_map.
The BZAR project also adds 1,145 Microsoft DCE-RPC Interface Methods (a.k.a. "operations") to the Bro/Zeek DCE_RPC::operations.
reference:
https://github.com/mitre-attack/bzar#additional-dce-rpc-interfaces-and-methods
reference added things:
bzar/scripts/bzar_dce-rpc_consts.bro
Line 261 in 4be8432
bzar/scripts/bzar_dce-rpc_consts.bro
Line 420 in 4be8432
Fix Zeek 3.1 Deprecations
Any interest in a PR with Zeek 3.1 changes? Rename .bro scripts to .zeek to eliminate deprecation warnings, switch to the new smb2_write_response event (thanks for the great comments to help with that), and switch from bro-pkg to zkg. It's incompatible with Bro, of course.
installation
Hello i install bzar with zkg but how can i sure that loaded and work ?
Persistence detection question
Hello,
I ran "T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL" and "T1547.010 Boot or Logon Autostart Execution" and did not see any of the expected RPC traffic. I took a pcap and zeeked it with zeek 4.0. Do you all have an example or a pcap where these show up? Do you know why it didn't work for me? The first image is the results of Winlogon and the second is port monitor. Thanks!
error with latest zeek
- zeek verion : 6.0.2
error in /opt/zeek/share/zeek/site/scripts/bzar/./main.zeek, lines 126-130: BZAR::match is used inside "when" statement but not captured (when ((BZAR::n1 = lookup_addr(BZAR::orig_h)) && (BZAR::n1 in BZAR::w$orig_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
error in /opt/zeek/share/zeek/site/scripts/bzar/./main.zeek, lines 137-141: BZAR::w is used inside "when" statement but not captured (when ((BZAR::n2 = lookup_addr(BZAR::resp_h)) && (BZAR::n2 in BZAR::w$resp_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
No notice logs
Hello, Im testing the scripts on zeek with some pcaps but no notice log is being generated.
How can I assure the installition was properly done?
Automated suppression with $identifier?
Hello,
I am working to suppress identical alerts, is there any built-in suppression in BZAR? Is there any way to hook the $identifier into the BZAR NOTICE?
type error issue (bzar_dce-rpc_consts.zeek)
There is type mismatching errors when parsing Sets type arrays.
It should be like : [" "], > " ",
the error messages are here:
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25: type clash (string and drsuapi::DRSReplicaSync) error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25 and string: type mismatch (drsuapi::DRSReplicaSync and string) error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: inconsistent type in set constructor (set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges)) error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: type clash in assignment (BZAR::t1003_006_rpc_strings = set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
ATTACK::Lateral_Movement_Extracted_File whitelists not working
Hello,
I am excluding addresses using the bzar_config_options.bro.
The attack_lm_extracted_file_whitelist_orig_addrs is not correctly excluding IP addresses, and we are still receiving alerts for ones which are in the set.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.