Using Zeek Signatures To Detect CVEs
Channel: Keith Jones
Date: 2023-03-23

In this video I teach a methodology of using Zeek signatures to detect CVEs using a public Corelight Zeek package as an example.  This is useful when Zeek does not fully parse the protocol you are detecting the CVE within, and the attack is within the first 1,024 bytes of the connection.

Slides and links can be found here: https://drkeithjones.com/index.php/2023/03/23/using-zeek-signatures-to-detect-cves/

Please like and subscribe, thanks!

Subscribe: https://www.youtube.com/channel/UC-GWNw5rvGgjjV0OaOqcdfQ?sub_confirmation=1

0:00 Intro
0:27 Why This Video?
2:53 CVE-2022-24991
5:17 Wireshark Analysis
7:18 Code Walkthrough
7:30 The Zeek Signatures
14:03 The Zeek Code
20:49 That's All!

Correction: 14:43 Line 9, not line 19.

#opensource #cybersecurity #cve #zeek