Zeek
Detecting Zerologon (CVE-2020-1472) with Zeek
To assist in detecting Zerologon (CVE-2020-1472), we’ve open sourced a Zeek package that detects both attempted and successful exploits.
Featured
When the fuzzers come knocking on port 389: Hunting injection canaries in LDAP
Core protocols like LDAP are often left unmonitored. See how Zeek's ldap_search and DNS logs expose injection canaries and confirm whether attacks...