Zeek
Detecting the new CallStranger UPnP vulnerability with Zeek
By allowing the attacker to essentially force a connection to an arbitrary URL, CallStranger can be used in these three key ways.
Featured
When the fuzzers come knocking on port 389: Hunting injection canaries in LDAP
Core protocols like LDAP are often left unmonitored. See how Zeek's ldap_search and DNS logs expose injection canaries and confirm whether attacks...