By corelight
CVE-2022-26809 is a DCE/RPC RCE exploit. This package detects both attempts and successful exploits.
By corelight
Watch SMB transactions for files whose filename matches patterns known to be used by ransomware
By dovehawk
MISP+Zeek. Dovehawk is a Zeek Module to import MISP indicators to the Intel Framework and Signature Framework automatically. Reports sightings directly back to MISP as they happen. Supports Zeek Clusters.
By mvlnetdev
Zeek package to add a destination port to the meta fields in Zeek. It creates a notice when both the intel and the destination port matches. This adds a feature that can be used to reduce false positives.
By bricata
Provides mechanisms for managing and using institutional knowledge about a monitored environment to make informed observations of normal and abnormal network activity.