Re: Bro/Zeek ATT&CK-based Analytics and Reporting (BZAR), by MITRE
Alex Kefallonitis <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAHv=Muo6k=f+O-PMgboqhE6VQPeX-0ab=cB1ozNNC3Er=CDgVw@mail.gmail.com> |
Hi Mark, Thanks for sharing these gj! Just two questions: - Is the repository going to be maintain and updated e.g new attacks and categories techniques ? - Second isn't possible to detect pth attack throught *bzar_smb.bro ?* Alex Kefallonitis Στις Τετ, 27 Μαρ 2019 στις 10:34 μ.μ., ο/η Fernandez, Mark I < [email protected]> έγραψε: > Gary, > > >> bzar_smb.bro, line 39: "redef" used but not previously defined > (SMB::write_cmd_log) > > Looks like "SMB::write_cmd_log" is removed from v2.6.x. > > Mark > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek