Category: Open Source Tools
-
NanoCore Screen Exfiltration — The Rat That Filmed Its Own Jail
A 58 KB NanoCore RAT takes a 1920×1080 screenshot every 30.7 seconds, base64-encodes it, and POSTs it back to its command and control server in plaintext HTTP — five times in two and a half minutes, all of it inside a 1.5…
-
Introducing zenv: venv for Zeek
If you’ve worked with Zeek for more than a few months, you’ve probably lived this: one ~/zeek install, one ~/.zkg, and a constant juggling act every time you need to test a package against a different Zeek version, try a dev branch,…
-
How To Profile A Zeek Spicy Protocol Analyzer
This is a good page over at the Zeek Spicy Wiki on how to profile protocol analyzers: https://github.com/zeek/spicy/wiki/Performance-profiling-of-Spicy-parsers
-
How To Connect Zeek To Python
I was recently asked how to send data from Zeek to Python. After flipping through the Zeek Broker documentation I couldn’t find a good example to reference, so here is my example. The code for this demo is available here: https://github.com/keithjjones/zeek-python-broker-demo The…
-
Easily Run Zeek and Spicy in a Docker Container
Here you will learn to run Zeek and Spicy in a Docker container. I do this often to test my code on different versions of Zeek without having to fully install each version.
