Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs (conn, dns, http, ssl, files) to surface long connections, rare JA3s, suspicious downloads, and beaconing. Activates for requests to build Zeek analytics, write a Zeek hunting script, or analyze Zeek logs for threats.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
설치 방법 보기설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
Do not use Zeek to actively probe hosts — it is passive analysis of captured/sensor traffic.
python scripts/analyst.py analyze conn.log --kind conn
For conn, surfaces long-duration and high-byte connections; for ssl, counts JA3 rarity; for
http, flags executable/script downloads and rare user-agents; for dns, flags long/high-entropy
queries.
Translate a confirmed pattern into a Zeek script using the appropriate event
(connection_state_remove, ssl_established, http_reply).
Corroborate anomalies with destination reputation and other logs (pivot by uid).
Stage the Zeek script or scheduled log query as a durable detection.
#fields) and JSON Zeek logs.#fields) parsing — column order varies by deployment.references/api-reference.md for the analyzer.아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting the packer, locating the embedded archive, and identifying bundled .pyc modules for extraction and decompilation. Activates for requests to analyze compiled Python malware, unpack a PyInstaller binary, or extract pyc modules from a frozen Python executable.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. Activates for requests to analyze a cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.