BZAR
BZAR (Bro/Zeek ATT&CK-based Analytics and Reporting) is a set of Bro/Zeek scripts that utilize the SMB and DCE-RPC protocol analyzers and the File Extraction Framework to detect ATT&CK-like activity, raise notices, and write to the Notice Log. It uses the Bro/Zeek Network Security Monitor to detect ATT&CK-based adversarial activity and is a component of the Cyber Analytics Repository. BZAR must be tuned for your specific operational environment to avoid unnecessary entries in the Notice Log.
FEATURES
SIMILAR TOOLS
AWS Network Firewall provides fine-grained control over network traffic and enables easy deployment of firewall security.
A library for integrating communication channels with the Cobalt Strike External C2 server.
A low interaction Python honeypot designed to mimic various services and ports to attract attackers and log access attempts.
A featured networking utility for reading and writing data across network connections with advanced capabilities.
Tcpreplay is a suite of Open Source utilities for editing and replaying captured network traffic.
NBD is a user-space network protocol for sharing block devices over a network, allowing clients to access block devices on a server as if they were local.
Tcpdump is a command-line packet analyzer for capturing and analyzing network traffic.
A powerful and extensible framework for reconnaissance and attacking various networks and devices.
A tool for extracting common indicators of compromise from a block of text.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.