[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FCB76T6KPRJ7XGDCHNQRZ":3,"skill-same:01M71FCB76T6KPRJ7XGDCHNQRZ":63},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":14,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":6,"ownerDescription":41,"updatedAt":42,"install":43,"resources":56},"01M71FCB76T6KPRJ7XGDCHNQRZ","net-capture-zeek-zeekanalysis",null,"-| | `conn.log` | TCP\u002FUDP\u002FICMP connection summaries with duration, bytes, state | | `dns.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-capture-zeek-zeekanalysis\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30],"Zeek","capture","net capture zeek zeekanalysis","cybersecurity","state","tcp","dns","log","with","connection","summaries","udp","2026-11-10 10:12:30",false,"---\nname: net-capture-zeek-zeekanalysis\ndescription: \"-| | `conn.log` | TCP\u002FUDP\u002FICMP connection summaries with duration, bytes, state | | `dns.\"\ndomain: cybersecurity\n---\n\n-|\n| `conn.log` | TCP\u002FUDP\u002FICMP connection summaries with duration, bytes, state |\n| `dns.log` | DNS queries and responses with query type, answers, TTL |\n| `http.log` | HTTP requests\u002Fresponses with URIs, user agents, MIME types |\n| `ssl.log` | TLS handshake details including certificate chain, JA3\u002FJA3S |\n| `files.log` | File transfers with MIME types, hashes (MD5, SHA1, SHA256) |\n| `notice.log` | Alerts generated by Zeek detection scripts |\n| `weird.log` | Protocol anomalies and unexpected behaviors |\n| `x509.log` | Certificate details from TLS connections |\n| `smtp.log` | Email metadata including sender, recipient, subject |\n| `ssh.log` | SSH connection details and authentication results |\n| `pe.log` | Portable Executable file metadata |\n| `dpd.log` | Dynamic Protocol Detection failures |\n\n## Workflow\n\n### Step 1: Install and Configure Zeek\n\n```bash\n# Install Zeek on Ubuntu\nsudo apt-get install -y zeek\n\n# Or install from Zeek repository\necho 'deb http:\u002F\u002Fdownload.opensuse.org\u002Frepositories\u002Fsecurity:\u002Fzeek\u002FxUbuntu_22.04\u002F \u002F' | \\\n    sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Fzeek.list\nsudo apt-get update && sudo apt-get install -y zeek-lts\n\n# Verify installation\nzeek --version\n```\n\nConfigure the node layout in `\u002Fopt\u002Fzeek\u002Fetc\u002Fnode.cfg`:\n\n```ini\n[manager]\ntype=manager\nhost=localhost\n\n[proxy-1]\ntype=proxy\nhost=localhost\n\n[worker-1]\ntype=worker\nhost=localhost\ninterface=eth0\nlb_method=pf_ring\nlb_procs=4\n\n[worker-2]\ntype=worker\nhost=localhost\ninterface=eth1\nlb_method=pf_ring\nlb_procs=4\n```\n\nConfigure network definitions in `\u002Fopt\u002Fzeek\u002Fetc\u002Fnetworks.cfg`:\n\n```\n# Internal network ranges\n10.0.0.0\u002F8         Private RFC1918\n172.16.0.0\u002F12      Private RFC1918\n192.168.0.0\u002F16     Private RFC1918\n```\n\n### Step 2: Configure Logging and Output\n\nEdit `\u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Flocal.zeek`:\n\n```zeek\n# Load standard detection scripts\n@load base\u002Fprotocols\u002Fconn\n@load base\u002Fprotocols\u002Fdns\n@load base\u002Fprotocols\u002Fhttp\n@load base\u002Fprotocols\u002Fssl\n@load base\u002Fprotocols\u002Fssh\n@load base\u002Fprotocols\u002Fsmtp\n@load base\u002Fprotocols\u002Fftp\n\n# Load file analysis\n@load base\u002Ffiles\u002Fhash-all-files\n@load base\u002Ffiles\u002Fextract-all-files\n\n# Load detection frameworks\n@load base\u002Fframeworks\u002Fnotice\n@load base\u002Fframeworks\u002Fintel\n@load base\u002Fframeworks\u002Ffiles\n@load base\u002Fframeworks\u002Fsoftware\n\n# Load additional protocol analyzers\n@load policy\u002Fprotocols\u002Fssl\u002Fvalidate-certs\n@load policy\u002Fprotocols\u002Fssl\u002Flog-hostcerts-only\n@load policy\u002Fprotocols\u002Fssh\u002Fdetect-bruteforcing\n@load policy\u002Fprotocols\u002Fdns\u002Fdetect-external-names\n@load policy\u002Fprotocols\u002Fhttp\u002Fdetect-sqli\n\n# Enable JA3 fingerprinting\n@load policy\u002Fprotocols\u002Fssl\u002Fja3\n\n# Enable JSON output for SIEM ingestion\n@load policy\u002Ftuning\u002Fjson-logs\n\nredef LogAscii::use_json = T;\n\n# Configure file extraction directory\nredef FileExtract::prefix = \"\u002Fopt\u002Fzeek\u002Fextracted\u002F\";\n\n# Set notice email\nredef Notice::mail_dest = \"soc@example.com\";\n```\n\n### Step 3: Write Custom Detection Scripts\n\nCreate detection scripts for common threats:\n\n**Detect DNS Tunneling** (`\u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fdetect-dns-tunnel.zeek`):\n\n```zeek\n@load base\u002Fprotocols\u002Fdns\n\nmodule DNSTunnel;\n\nexport {\n    redef enum Notice::Type += {\n        DNS_Tunnel_Suspected\n    };\n\n    # Threshold for suspicious DNS query length\n    const query_len_threshold = 50 &redef;\n\n    # Track query counts per host per domain\n    global dns_query_counts: table[addr, string] of count &default=0 &create_expire=5min;\n\n    # High query volume threshold\n    const query_volume_threshold = 100 &redef;\n}\n\nevent dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count)\n{\n    if ( |query| > query_len_threshold )\n    {\n        local parts = split_string(query, \u002F\\.\u002F);\n        if ( |parts| > 3 )\n        {\n            local base_domain = cat(parts[|parts|-2], \".\", parts[|parts|-1]);\n            dns_query_counts[c$id$orig_h, base_domain] += 1;\n\n            if ( dns_query_counts[c$id$orig_h, base_domain] > query_volume_threshold )\n            {\n                NOTICE([$note=DNS_Tunnel_Suspected,\n                        $msg=fmt(\"Possible DNS tunneling: %s queries to %s with long query names\",\n                                 c$id$orig_h, base_domain),\n                        $conn=c,\n                        $identifier=cat(c$id$orig_h, base_domain),\n                        $suppress_for=30min]);\n            }\n        }\n    }\n}\n```\n\n**Detect Beaconing Behavior** (`\u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fdetect-beaconing.zeek`):\n\n```zeek\n@load base\u002Fprotocols\u002Fconn\n\nmodule Beaconing;\n\nexport {\n    redef enum Notice::Type += {\n        C2_Beacon_Detected\n    };\n\n    # Track connection intervals\n    global conn_intervals: table[addr, addr, port] of vector of time &create_expire=1hr;\n\n    const min_connections = 20 &redef;\n    const jitter_threshold = 0.15 &redef;\n}\n\nevent connection_state_remove(c: connection)\n{\n    if ( c$id$resp_p == 80\u002Ftcp || c$id$resp_p == 443\u002Ftcp )\n    {\n        local key = [c$id$orig_h, c$id$resp_h, c$id$resp_p];\n\n        if ( key !in conn_intervals )\n            conn_intervals[key] = vector();\n\n        conn_intervals[key] += network_time();\n\n        if ( |conn_intervals[key]| >= min_connections )\n        {\n            local intervals: vector of interval = vector();\n            local i = 1;\n            while ( i \u003C |conn_intervals[key]| )\n            {\n                intervals += conn_intervals[key][i] - conn_intervals[key][i-1];\n                i += 1;\n            }\n\n            # Calculate mean and standard deviation\n            local sum_val = 0.0;\n            for ( idx in intervals )\n                sum_val += interval_to_double(intervals[idx]);\n\n            local mean_val = sum_val \u002F |intervals|;\n\n            local variance = 0.0;\n            for ( idx in intervals )\n            {\n                local diff = interval_to_double(intervals[idx]) - mean_val;\n                variance += diff * diff;\n            }\n            variance = variance \u002F |intervals|;\n            local stddev = sqrt(variance);\n\n            if ( mean_val > 0 && (stddev \u002F mean_val) \u003C jitter_threshold )\n            {\n                NOTICE([$note=C2_Beacon_Detected,\n                        $msg=fmt(\"Possible C2 beaconing: %s -> %s:%s (interval=%.1fs, jitter=%.2f)\",\n                                 c$id$orig_h, c$id$resp_h, c$id$resp_p,\n                                 mean_val, stddev\u002Fmean_val),\n                        $conn=c,\n                        $identifier=cat(c$id$orig_h, c$id$resp_h),\n                        $suppress_for=1hr]);\n            }\n        }\n    }\n}\n```\n\n### Step 4: Configure Intel Framework\n\nLoad threat intelligence feeds into Zeek:\n\n```zeek\n# In local.zeek\n@load frameworks\u002Fintel\u002Fseen\n@load frameworks\u002Fintel\u002Fdo_notice\n\nredef Intel::read_files += {\n    \"\u002Fopt\u002Fzeek\u002Fintel\u002Fmalicious-ips.intel\",\n    \"\u002Fopt\u002Fzeek\u002Fintel\u002Fmalicious-domains.intel\",\n    \"\u002Fopt\u002Fzeek\u002Fintel\u002Fmalicious-hashes.intel\",\n};\n```\n\nIntel file format (`\u002Fopt\u002Fzeek\u002Fintel\u002Fmalicious-ips.intel`):\n\n```\n#fields\tindicator\tindicator_type\tmeta.source\tmeta.desc\tmeta.do_notice\n198.51.100.50\tIntel::ADDR\tabuse.ch\tKnown C2 server\tT\n203.0.113.100\tIntel::ADDR\tthreatfeed\tRansomware infrastructure\tT\n```\n\n### Step 5: Deploy and Operate\n\n```bash\n# Deploy Zeek cluster\nsudo \u002Fopt\u002Fzeek\u002Fbin\u002Fzeekctl deploy\n\n# Check cluster status\nsudo \u002Fopt\u002Fzeek\u002Fbin\u002Fzeekctl status\n\n# Process offline PCAP\nzeek -r capture.pcap local.zeek\n\n# View logs\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto service duration orig_bytes resp_bytes\n\n# Search for specific connections\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdns.log | zeek-cut query answers | grep -i \"suspicious\"\n\n# Rotate logs\nsudo \u002Fopt\u002Fzeek\u002Fbin\u002Fzeekctl cron\n```\n\n### Step 6: SIEM Integration\n\n**Filebeat configuration for ELK Stack:**\n\n```yaml\nfilebeat.inputs:\n  - type: log\n    enabled: true\n    paths:\n      - \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F*.log\n    json.keys_under_root: true\n    json.add_error_key: true\n    fields:\n      source: zeek\n    fields_under_root: true\n\noutput.elasticsearch:\n  hosts: [\"https:\u002F\u002Felasticsearch:9200\"]\n  index: \"zeek-%{+yyyy.MM.dd}\"\n\nsetup.template.name: \"zeek\"\nsetup.template.pattern: \"zeek-*\"\n```\n\n## Analysis Techniques\n\n### Connection Analysis\n\n```bash\n# Find top talkers by bytes\ncat conn.log | zeek-cut id.orig_h orig_bytes | sort -t$'\\t' -k2 -rn | head -20\n\n# Find long-duration connections (potential C2)\ncat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration | awk '$4 > 3600' | sort -t$'\\t' -k4 -rn\n\n# Find connections with unusual ports\ncat conn.log | zeek-cut id.resp_p proto | sort | uniq -c | sort -rn | head -30\n```\n\n### TLS Analysis\n\n```bash\n# Find self-signed certificates\ncat ssl.log | zeek-cut server_name validation_status | grep \"self signed\"\n\n# Extract JA3 fingerprints for known malware\ncat ssl.log | zeek-cut ja3 server_name | sort | uniq -c | sort -rn\n\n# Find expired certificates\ncat ssl.log | zeek-cut server_name not_valid_after | awk -F'\\t' '$2 \u003C systime()'\n```\n\n## Best Practices\n\n- **TAP Over SPAN** - Use network TAPs instead of SPAN ports to avoid packet loss under load\n- **Worker Scaling** - Assign 1 Zeek worker per 1 Gbps of monitored traffic\n- **AF_PACKET Clusters** - Use AF_PACKET with load balancing for multi-core processing\n- **Log Rotation** - Configure automatic log rotation and archival (default: hourly)\n- **Intel Updates** - Automate threat intelligence feed updates at least daily\n- **Packet Loss Monitoring** - Monitor `capture_loss.log` for dropped packets\n- **Custom Scripts** - Develop organization-specific detections based on threat landscape\n\n## References\n\n- [Zeek Documentation](https:\u002F\u002Fdocs.zeek.org\u002Fen\u002Fmaster\u002F)\n- [Zeek Scripting Reference](https:\u002F\u002Fdocs.zeek.org\u002Fen\u002Fmaster\u002Fscript-reference\u002Findex.html)\n- [Zeek Intel Framework](https:\u002F\u002Fdocs.zeek.org\u002Fen\u002Fmaster\u002Fframeworks\u002Fintel.html)\n- [CISA Zeek Resources](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fservices\u002Fkismet)\n- [Zeek GitHub Repository](https:\u002F\u002Fgithub.com\u002Fzeek\u002Fzeek)\n","-|\n| `conn.log` | TCP\u002FUDP\u002FICMP connection summaries with duration, bytes, state |\n| `dns.log` | DNS queries and responses with query type, answers, TTL |\n| `http.log` | HTTP requests\u002Fresponses with URIs, user agents, MIME types |\n| `ssl.log` | TLS handshake details including certificate chain, JA3\u002FJA3S |\n| `files.log` | File transfers with MIME types, hashes (MD5, SHA1, SHA256) |\n| `notice.log` | Alerts generated by Zeek detection scripts |\n| `weird.log` | Protocol anomalies and unexpected behaviors |\n| `x509.log` | Certificate details from TLS connections |\n| `smtp.log` | Email metadata including sender, recipient, subject |\n| `ssh.log` | SSH connection details and authentication results |\n| `pe.log` | Portable Executable file metadata |\n| `dpd.log` | Dynamic Protocol Detection failures |\n\n## Workflow\n\n### Step 1: Install and Configure Zeek\n\n```bash\n# Install Zeek on Ubuntu\nsudo apt-get install -y zeek\n\n# Or install from Zeek repository\necho 'deb http:\u002F\u002Fdownload.opensuse.org\u002Frepositories\u002Fsecurity:\u002Fzeek\u002FxUbuntu_22.04\u002F \u002F' | \\\n    sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Fzeek.list\nsudo apt-get update && sudo apt-get install -y zeek-lts\n\n# Verify installation\nzeek --version\n```\n\nConfigure the node layout in `\u002Fopt\u002Fzeek\u002Fetc\u002Fnode.cfg`:\n\n```ini\n[manager]\ntype=manager\nhost=localhost\n\n[proxy-1]\ntype=proxy\nhost=localhost\n\n[worker-1]\ntype=worker\nhost=localhost\ninterface=eth0\nlb_method=pf_ring\nlb_procs=4\n\n[worker-2]\ntype=worker\nhost=localhost\ninterface=eth1\nlb_method=pf_ring\nlb_procs=4\n```\n\nConfigure network definitions in `\u002Fopt\u002Fzeek\u002Fetc\u002Fnetworks.cfg`:\n\n```\n# Internal network ranges\n10.0.0.0\u002F8         Private RFC1918\n172.16.0.0\u002F12      Private RFC1918\n192.168.0.0\u002F16     Private RFC1918\n```\n\n### Step 2: Configure Logging and Output\n\nEdit `\u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Flocal.zeek`:\n\n```zeek\n# Load standard detection scripts\n@load base\u002Fprotocols\u002Fconn\n@load base\u002Fprotocols\u002Fdns\n@load base\u002Fprotocols\u002Fhttp\n@load base\u002Fprotocols\u002Fssl\n@load base\u002Fprotocols\u002Fssh\n@load base\u002Fprotocols\u002Fsmtp\n@load base\u002Fprotocols\u002Fftp\n\n# Load file analysis\n@load base\u002Ffiles\u002Fhash-all-files\n@load base\u002Ffiles\u002Fextract-all-files\n\n# Load detection frameworks\n@load base\u002Fframeworks\u002Fnotice\n@load base\u002Fframeworks\u002Fintel\n@load base\u002Fframeworks\u002Ffiles\n@load base\u002Fframeworks\u002Fsoftware\n\n# Load additional protocol analyzers\n@load policy\u002Fprotocols\u002Fssl\u002Fvalidate-certs\n@load policy\u002Fprotocols\u002Fssl\u002Flog-hostcerts-only\n@load policy\u002Fprotocols\u002Fssh\u002Fdetect-bruteforcing\n@load policy\u002Fprotocols\u002Fdns\u002Fdetect-external-names\n@load policy\u002Fprotocols\u002Fhttp\u002Fdetect-sqli\n\n# Enable JA3 fingerprinting\n@load policy\u002Fprotocols\u002Fssl\u002Fja3\n\n# Enable JSON output for SIEM ingestion\n@load policy\u002Ftuning\u002Fjson-logs\n\nredef LogAscii::use_json = T;\n\n# Configure file extraction directory\nredef FileExtract::prefix = \"\u002Fopt\u002Fzeek\u002Fextracted\u002F\";\n\n# Set notice email\nredef Notice::mail_dest = \"soc@example.com\";\n```\n\n### Step 3: Write Custom Detection Scripts\n\nCreate detection scripts for common threats:\n\n**Detect DNS Tunneling** (`\u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fdetect-dns-tunnel.zeek`):\n\n```zeek\n@load base\u002Fprotocols\u002Fdns\n\nmodule DNSTunnel;\n\nexport {\n    redef enum Notice::Type += {\n        DNS_Tunnel_Suspected\n    };\n\n    # Threshold for suspicious DNS query length\n    const query_len_threshold = 50 &redef;\n\n    # Track query counts per host per domain\n    global dns_query_counts: table[addr, string] of count &default=0 &create_expire=5min;\n\n    # High query volume threshold\n    const query_volume_threshold = 100 &redef;\n}\n\nevent dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count)\n{\n    if ( |query| > query_len_threshold )\n    {\n        local parts = split_string(query, \u002F\\.\u002F);\n        if ( |parts| > 3 )\n        {\n            local base_domain = cat(parts[|parts|-2], \".\", parts[|parts|-1]);\n            dns_query_counts[c$id$orig_h, base_domain] += 1;\n\n            if ( dns_query_counts[c$id$orig_h, base_domain] > query_volume_threshold )\n            {\n                NOTICE([$note=DNS_Tunnel_Suspected,\n                        $msg=fmt(\"Possible DNS tunneling: %s queries to %s with long query names\",\n                                 c$id$orig_h, base_domain),\n                        $conn=c,\n                        $identifier=cat(c$id$orig_h, base_domain),\n                        $suppress_for=30min]);\n            }\n        }\n    }\n}\n```\n\n**Detect Beaconing Behavior** (`\u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fdetect-beaconing.zeek`):\n\n```zeek\n@load base\u002Fprotocols\u002Fconn\n\nmodule Beaconing;\n\nexport {\n    redef enum Notice::Type += {\n        C2_Beacon_Detected\n    };\n\n    # Track connection intervals\n    global conn_intervals: table[addr, addr, port] of vector of time &create_expire=1hr;\n\n    const min_connections = 20 &redef;\n    const jitter_threshold = 0.15 &redef;\n}\n\nevent connection_state_remove(c: connection)\n{\n    if ( c$id$resp_p == 80\u002Ftcp || c$id$resp_p == 443\u002Ftcp )\n    {\n        local key = [c$id$orig_h, c$id$resp_h, c$id$resp_p];\n\n        if ( key !in conn_intervals )\n            conn_intervals[key] = vector();\n\n        conn_intervals[key] += network_time();\n\n        if ( |conn_intervals[key]| >= min_connections )\n        {\n            local intervals: vector of interval = vector();\n            local i = 1;\n            while ( i \u003C |conn_intervals[key]| )\n            {\n                intervals += conn_intervals[key][i] - conn_intervals[key][i-1];\n                i += 1;\n            }\n\n            # Calculate mean and standard deviation\n            local sum_val = 0.0;\n            for ( idx in intervals )\n                sum_val += interval_to_double(intervals[idx]);\n\n            local mean_val = sum_val \u002F |intervals|;\n\n            local variance = 0.0;\n            for ( idx in intervals )\n            {\n                local diff = interval_to_double(intervals[idx]) - mean_val;\n                variance += diff * diff;\n            }\n            variance = variance \u002F |intervals|;\n            local stddev = sqrt(variance);\n\n            if ( mean_val > 0 && (stddev \u002F mean_val) \u003C jitter_threshold )\n            {\n                NOTICE([$note=C2_Beacon_Detected,\n                        $msg=fmt(\"Possible C2 beaconing: %s -> %s:%s (interval=%.1fs, jitter=%.2f)\",\n                                 c$id$orig_h, c$id$resp_h, c$id$resp_p,\n                                 mean_val, stddev\u002Fmean_val),\n                        $conn=c,\n                        $identifier=cat(c$id$orig_h, c$id$resp_h),\n                        $suppress_for=1hr]);\n            }\n        }\n    }\n}\n```\n\n### Step 4: Configure Intel Framework\n\nLoad threat intelligence feeds into Zeek:\n\n```zeek\n# In local.zeek\n@load frameworks\u002Fintel\u002Fseen\n@load frameworks\u002Fintel\u002Fdo_notice\n\nredef Intel::read_files += {\n    \"\u002Fopt\u002Fzeek\u002Fintel\u002Fmalicious-ips.intel\",\n    \"\u002Fopt\u002Fzeek\u002Fintel\u002Fmalicious-domains.intel\",\n    \"\u002Fopt\u002Fzeek\u002Fintel\u002Fmalicious-hashes.intel\",\n};\n```\n\nIntel file format (`\u002Fopt\u002Fzeek\u002Fintel\u002Fmalicious-ips.intel`):\n\n```\n#fields\tindicator\tindicator_type\tmeta.source\tmeta.desc\tmeta.do_notice\n198.51.100.50\tIntel::ADDR\tabuse.ch\tKnown C2 server\tT\n203.0.113.100\tIntel::ADDR\tthreatfeed\tRansomware infrastructure\tT\n```\n\n### Step 5: Deploy and Operate\n\n```bash\n# Deploy Zeek cluster\nsudo \u002Fopt\u002Fzeek\u002Fbin\u002Fzeekctl deploy\n\n# Check cluster status\nsudo \u002Fopt\u002Fzeek\u002Fbin\u002Fzeekctl status\n\n# Process offline PCAP\nzeek -r capture.pcap local.zeek\n\n# View logs\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto service duration orig_bytes resp_bytes\n\n# Search for specific connections\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdns.log | zeek-cut query answers | grep -i \"suspicious\"\n\n# Rotate logs\nsudo \u002Fopt\u002Fzeek\u002Fbin\u002Fzeekctl cron\n```\n\n### Step 6: SIEM Integration\n\n**Filebeat configuration for ELK Stack:**\n\n```yaml\nfilebeat.inputs:\n  - type: log\n    enabled: true\n    paths:\n      - \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F*.log\n    json.keys_under_root: true\n    json.add_error_key: true\n    fields:\n      source: zeek\n    fields_under_root: true\n\noutput.elasticsearch:\n  hosts: [\"https:\u002F\u002Felasticsearch:9200\"]\n  index: \"zeek-%{+yyyy.MM.dd}\"\n\nsetup.template.name: \"zeek\"\nsetup.template.pattern: \"zeek-*\"\n```\n\n## Analysis Techniques\n\n### Connection Analysis\n\n```bash\n# Find top talkers by bytes\ncat conn.log | zeek-cut id.orig_h orig_bytes | sort -t$'\\t' -k2 -rn | head -20\n\n# Find long-duration connections (potential C2)\ncat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration | awk '$4 > 3600' | sort -t$'\\t' -k4 -rn\n\n# Find connections with unusual ports\ncat conn.log | zeek-cut id.resp_p proto | sort | uniq -c | sort -rn | head -30\n```\n\n### TLS Analysis\n\n```bash\n# Find self-signed certificates\ncat ssl.log | zeek-cut server_name validation_status | grep \"self signed\"\n\n# Extract JA3 fingerprints for known malware\ncat ssl.log | zeek-cut ja3 server_name | sort | uniq -c | sort -rn\n\n# Find expired certificates\ncat ssl.log | zeek-cut server_name not_valid_after | awk -F'\\t' '$2 \u003C systime()'\n```\n\n## Best Practices\n\n- **TAP Over SPAN** - Use network TAPs instead of SPAN ports to avoid packet loss under load\n- **Worker Scaling** - Assign 1 Zeek worker per 1 Gbps of monitored traffic\n- **AF_PACKET Clusters** - Use AF_PACKET with load balancing for multi-core processing\n- **Log Rotation** - Configure automatic log rotation and archival (default: hourly)\n- **Intel Updates** - Automate threat intelligence feed updates at least daily\n- **Packet Loss Monitoring** - Monitor `capture_loss.log` for dropped packets\n- **Custom Scripts** - Develop organization-specific detections based on threat landscape\n\n## References\n\n- [Zeek Documentation](https:\u002F\u002Fdocs.zeek.org\u002Fen\u002Fmaster\u002F)\n- [Zeek Scripting Reference](https:\u002F\u002Fdocs.zeek.org\u002Fen\u002Fmaster\u002Fscript-reference\u002Findex.html)\n- [Zeek Intel Framework](https:\u002F\u002Fdocs.zeek.org\u002Fen\u002Fmaster\u002Fframeworks\u002Fintel.html)\n- [CISA Zeek Resources](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fservices\u002Fkismet)\n- [Zeek GitHub Repository](https:\u002F\u002Fgithub.com\u002Fzeek\u002Fzeek)\n",{"name":5,"domain":22,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnet-capture-zeek-zeekanalysis","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill net-capture-zeek-zeekanalysis",{"tool":49,"command":50},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill net-capture-zeek-zeekanalysis",{"tool":52,"command":53},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill net-capture-zeek-zeekanalysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-capture-zeek-zeekanalysis\u002FSKILL.md",true,[57],{"path":58,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":62},"index.json","REFERENCE","参考文档",575,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-capture-zeek-zeekanalysis\u002Findex.json",[64,89,112,134,156,172],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":31},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,22,88],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":31},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[96,71,97,74,98,99,100,22,101,102,103,104,105,106,76,107,108,109,110,111],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":31},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[119,120,121,122,123,124,22,101,125,102,126,127,76,109,128,129,130,131,132,133],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":31},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[72,141,142,143,144,145,146,77,147,22,88,148,149,150,151,152,153,154,155,76],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":31},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[163,164,72,165,143,145,166,77,167,147,22,88,102,168,169,170,171,155,76,78],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":31},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[179,72,143,180,166,77,181,182,22,88,183,184,185,186,187,27,76,78,188,189],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","mismatched","headers"]