DrKeithJones.com

Zeek, Malware Analysis & PCAP Walkthroughs

Open source security tools and malware analysis — plus Zeek guides, DuckDB threat hunts and detection engineering write-ups.

Social Media

Filter by

  • Drone Flight @ BWI Airport Sept 8, 2024

    Enjoy some runway 33L activity at the Baltimore Washington International Airport in Maryland. The FAA authorized me to fly and photograph airport activity with my part 107 commercial drone license.

  • Detect STRRAT Malware With Zeek And Suricata

    Join me in learning how to detect the STRRAT malware family with Zeek and Suricata. Corelight Blog: https://corelight.com/blog/newsroom/news/strrat-malware Source Code: https://github.com/corelight/zeek-strrat-detector 00:00:10:18 – 00:00:37:17Dr. Keith JonesHey, welcome. We’re going to talk about how to detect STRRAT, which is a malware family. This…

  • Detect Gozi Banking Malware With Zeek!

    Join the Old Grizzled FBI Agent to hear how to detect the Gozi Banking Malware Family with Zeek! Corelight Blog: https://corelight.com/blog/gozi-banking-malware Transcript: 00:00:10:47 – 00:00:41:11Old Grizzled FBI AgentHi there. This is your favorite obligatory grizzled FBI agent again. You may wonder why…

  • Detecting AsyncRAT Malware C2 With Zeek And Suricata

    Please join the “Old Grizzled FBI Agent” to hear how you can detect the AsyncRAT malware family with Suricata and Zeek! Corelight blog: https://corelight.com/blog/newsroom/news/hunt-of-the-month-detecting-async-rat-malware Zeek: https://zeek.org/ Source code: https://github.com/corelight/zeek-asyncrat-detector Transcript: 00:00:00:10 – 00:00:31:31Grizzled FBI AgentHello. I’m your obligatory grizzled FBI agent. Never…

  • Analyzing QBot/QakBot Malware With Zeek

    In this short article I’ll outline some analysis I performed on the QBot/QakBot malware family with Zeek. I took a look at the following PCAPs from this family of malware, hoping to make it into a Zeek Roulette: You will see that…

  • Detecting njRAT/Bladabindi Malware With Zeek – Zeek Roulette #1

    Welcome to the first edition of Zeek Roulette, where I pick a random Zeek topic and try to solve it! For this article I picked njRAT malware from Any.Run and tried to write a detector for it. There is a copy of…

  • Zeek Clustering How-To Video

    I put together a Zeek clustering video over at Youtube (https://youtu.be/g-QvpYHgh1c). You can get to the slides through: https://docs.google.com/presentation/d/1HHHF4-FNhoSuy-YPMOWka3EGvfOW7CJAFeS9VHxBg_E/edit?usp=sharing The source code is available at: https://github.com/corelight/CVE-2022-24491

  • Using Zeek Signatures To Detect CVEs

    I put a video together (https://www.youtube.com/watch?v=PcXjkUt3rZA) discussing a method I have used to detect CVEs using just Zeek signatures: https://docs.zeek.org/en/master/frameworks/signatures.html This method is useful when trying to detect a CVE exploit in a protocol that is not fully parsed by Zeek. In…

  • Zeek’s suspend_processing Quirk With PCAPs

    In the comments of an earlier blog: … we found an interesting situation. Even when you call “suspend_processing” in zeek_init, like this: … Zeek will still process the first packet. The “new_connection” and “connection_state_remove” events will still fire for that first packet/connection.…

  • How To Profile A Zeek Spicy Protocol Analyzer

    This is a good page over at the Zeek Spicy Wiki on how to profile protocol analyzers: https://github.com/zeek/spicy/wiki/Performance-profiling-of-Spicy-parsers