mitre-attack / bzar Goto Github PK
View Code? Open in Web Editor NEWA set of Zeek scripts to detect ATT&CK techniques.
License: BSD 3-Clause "New" or "Revised" License
A set of Zeek scripts to detect ATT&CK techniques.
License: BSD 3-Clause "New" or "Revised" License
Hello,
I ran "T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL" and "T1547.010 Boot or Logon Autostart Execution" and did not see any of the expected RPC traffic. I took a pcap and zeeked it with zeek 4.0. Do you all have an example or a pcap where these show up? Do you know why it didn't work for me? The first image is the results of Winlogon and the second is port monitor. Thanks!
Hello,
I am working to suppress identical alerts, is there any built-in suppression in BZAR? Is there any way to hook the $identifier into the BZAR NOTICE?
First great work! This is awesome.
Have you all thought about creating a PR to Zeek for the UUID & Endpoint mappings you all have in this project?
The BZAR project adds 144 more Microsoft DCE-RPC Interface UUIDs (a.k.a. "endpoints") to the Bro/Zeek DCE_RPC::uuid_endpoint_map.
The BZAR project also adds 1,145 Microsoft DCE-RPC Interface Methods (a.k.a. "operations") to the Bro/Zeek DCE_RPC::operations.
reference:
https://github.com/mitre-attack/bzar#additional-dce-rpc-interfaces-and-methods
reference added things:
bzar/scripts/bzar_dce-rpc_consts.bro
Line 261 in 4be8432
bzar/scripts/bzar_dce-rpc_consts.bro
Line 420 in 4be8432
Zeek v5.0.0 was recently released. Here are the errors/warnings I get when using this package with that release:
> zeek -NN local 2>&1 | grep -i bzar
warning in /opt/zeek/share/zeek/site/packages/./bzar/./main.zeek, lines 126-130: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::orig_h, BZAR::w (when ((BZAR::n1 = lookup_addr(BZAR::orig_h)) && (BZAR::n1 in BZAR::w$orig_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
warning in /opt/zeek/share/zeek/site/packages/./bzar/./main.zeek, lines 137-141: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::resp_h, BZAR::w (when ((BZAR::n2 = lookup_addr(BZAR::resp_h)) && (BZAR::n2 in BZAR::w$resp_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25: type clash (string and drsuapi::DRSReplicaSync)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25 and string: type mismatch (drsuapi::DRSReplicaSync and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: inconsistent type in set constructor (set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: type clash in assignment (BZAR::t1003_006_rpc_strings = set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 42: type clash (string and eventlog::ElfrClearELFW)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 42 and string: type mismatch (eventlog::ElfrClearELFW and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 43-44: inconsistent type in set constructor (set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 43-44: type clash in assignment (BZAR::t1070_001_rpc_strings = set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 62: type clash (string and svcctl::CreateServiceWOW64W)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 62 and string: type mismatch (svcctl::CreateServiceWOW64W and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 66-67: inconsistent type in set constructor (set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 66-67: type clash in assignment (BZAR::t1569_002_rpc_strings = set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 73: type clash (string and IWbemServices::ExecMethod)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 73 and string: type mismatch (IWbemServices::ExecMethod and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 73-74: inconsistent type in set constructor (set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 73-74: type clash in assignment (BZAR::t1047_rpc_strings = set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: type clash (string and atsvc::JobAdd)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80 and string: type mismatch (atsvc::JobAdd and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: inconsistent type in set constructor (set(atsvc::JobAdd))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: type clash in assignment (BZAR::t1053_002_rpc_strings = set(atsvc::JobAdd))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 86: type clash (string and ITaskSchedulerService::SchRpcRegisterTask)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 86 and string: type mismatch (ITaskSchedulerService::SchRpcRegisterTask and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 87-88: inconsistent type in set constructor (set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 87-88: type clash in assignment (BZAR::t1053_005_rpc_strings = set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 103: type clash (string and winreg::BaseInitiateSystemShutdown)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 103 and string: type mismatch (winreg::BaseInitiateSystemShutdown and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 108-109: inconsistent type in set constructor (set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 108-109: type clash in assignment (BZAR::t1529_rpc_strings = set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 125: type clash (string and ISecLogon::SeclCreateProcessWithLogonW)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 125 and string: type mismatch (ISecLogon::SeclCreateProcessWithLogonW and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 125-126: inconsistent type in set constructor (set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 125-126: type clash in assignment (BZAR::t1547_004_rpc_strings = set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 132: type clash (string and spoolss::RpcAddMonitor)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 132 and string: type mismatch (spoolss::RpcAddMonitor and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 134-135: inconsistent type in set constructor (set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 134-135: type clash in assignment (BZAR::t1547_010_rpc_strings = set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 159: type clash (string and srvsvc::NetrServerTransportEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 159 and string: type mismatch (srvsvc::NetrServerTransportEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 159-160: inconsistent type in set constructor (set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 159-160: type clash in assignment (BZAR::t1016_rpc_strings = set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 166: type clash (string and srvsvc::NetrServerGetInfo)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 166 and string: type mismatch (srvsvc::NetrServerGetInfo and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 167-168: inconsistent type in set constructor (set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 167-168: type clash in assignment (BZAR::t1018_rpc_strings = set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 174: type clash (string and lsarpc::LsarGetUserName)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 174 and string: type mismatch (lsarpc::LsarGetUserName and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 185-186: inconsistent type in set constructor (set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 185-186: type clash in assignment (BZAR::t1033_rpc_strings = set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 192: type clash (string and srvsvc::NetrConnectionEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 192 and string: type mismatch (srvsvc::NetrConnectionEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 192-193: inconsistent type in set constructor (set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 192-193: type clash in assignment (BZAR::t1049_rpc_strings = set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 199: type clash (string and lsarpc::LsarEnumerateAccountRights)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 199 and string: type mismatch (lsarpc::LsarEnumerateAccountRights and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 209-210: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 209-210: type clash in assignment (BZAR::t1069_rpc_strings = set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 216: type clash (string and lsarpc::LsarQueryInformationPolicy)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 216 and string: type mismatch (lsarpc::LsarQueryInformationPolicy and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 219-221: inconsistent type in set constructor (set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 219-221: type clash in assignment (BZAR::t1082_rpc_strings = set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: type clash (string and srvsvc::NetrFileEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227 and string: type mismatch (srvsvc::NetrFileEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: inconsistent type in set constructor (set(srvsvc::NetrFileEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: type clash in assignment (BZAR::t1083_rpc_strings = set(srvsvc::NetrFileEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 233: type clash (string and lsarpc::LsarEnumerateAccounts)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 233 and string: type mismatch (lsarpc::LsarEnumerateAccounts and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 252-254: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 252-254: type clash in assignment (BZAR::t1087_rpc_strings = set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: type clash (string and srvsvc::NetrRemoteTOD)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260 and string: type mismatch (srvsvc::NetrRemoteTOD and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: inconsistent type in set constructor (set(srvsvc::NetrRemoteTOD))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: type clash in assignment (BZAR::t1124_rpc_strings = set(srvsvc::NetrRemoteTOD))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 266: type clash (string and srvsvc::NetrShareEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 266 and string: type mismatch (srvsvc::NetrShareEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 266-267: inconsistent type in set constructor (set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 266-267: type clash in assignment (BZAR::t1135_rpc_strings = set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))
There is type mismatching errors when parsing Sets type arrays.
It should be like : [" "], > " ",
the error messages are here:
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25: type clash (string and drsuapi::DRSReplicaSync) error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25 and string: type mismatch (drsuapi::DRSReplicaSync and string) error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: inconsistent type in set constructor (set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges)) error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: type clash in assignment (BZAR::t1003_006_rpc_strings = set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
Any interest in a PR with Zeek 3.1 changes? Rename .bro scripts to .zeek to eliminate deprecation warnings, switch to the new smb2_write_response event (thanks for the great comments to help with that), and switch from bro-pkg to zkg. It's incompatible with Bro, of course.
error in /opt/zeek/share/zeek/site/scripts/bzar/./main.zeek, lines 126-130: BZAR::match is used inside "when" statement but not captured (when ((BZAR::n1 = lookup_addr(BZAR::orig_h)) && (BZAR::n1 in BZAR::w$orig_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
error in /opt/zeek/share/zeek/site/scripts/bzar/./main.zeek, lines 137-141: BZAR::w is used inside "when" statement but not captured (when ((BZAR::n2 = lookup_addr(BZAR::resp_h)) && (BZAR::n2 in BZAR::w$resp_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
Hello i install bzar with zkg but how can i sure that loaded and work ?
winreg::baseregcreatekey
winreg::baseregsetvalue
Hello,
I am excluding addresses using the bzar_config_options.bro.
The attack_lm_extracted_file_whitelist_orig_addrs is not correctly excluding IP addresses, and we are still receiving alerts for ones which are in the set.
Hello, Im testing the scripts on zeek with some pcaps but no notice log is being generated.
How can I assure the installition was properly done?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.