RVAsec 15

Discover how to use Zeek in order to create custom detections for network threats. We will go over how to create a real detection using Zeek via scripting, protocol analysis, and log analysis.
Zeek is a network monitoring tool that analyzes network traffic with custom analyzers and produces logs. This talk will go over a real threat from beginning to end. This talk will walk through a Redis RCE exploit (eg https://medium.com/@knownsec404team/rce-exploits-of-redis-based-on-master-slave-replication-ef7a664ce1d0) based on master-slave replication and how Zeek can be used to detect it. This will also go over Spicy, a protocol parser generator, and how it helps to detect cases like this.