Advertisement
James_inthe_box

Zeek and lateral movement

Mar 2nd, 2020
13,764
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.73 KB | None | 0 0
  1. Zeek:
  2. https://www.zeek.org/download/index.html
  3.  
  4. SEC:
  5. http://simple-evcorr.github.io/
  6.  
  7. Sendemail
  8. https://github.com/mogaal/sendemail
  9.  
  10. #####sec#####
  11. startup command:
  12. /usr/local/bin/sec --conf=/etc/sec.conf --input=/<pathtozeek>/logs/current/dce_rpc.log --tail --detach
  13.  
  14. sec.conf:
  15. #whitelist:
  16. type = single
  17. ptype = regexp
  18. pattern = ip1|ip2|ip3
  19. desc = ignores
  20. action = none
  21.  
  22. type = SingleWithThreshold
  23. ptype = regexp
  24. pattern = SamrGetMembersInAlias|NetrSessionEnum|ChangeServiceConfig2A|NetrWkstaUserEnum|BaseRegQueryInfoKey|OpenUsers
  25. desc = Recon
  26. action = pipe '%s' /usr/local/bin/sendEmail -o tls=no -f from@example.com -t to@example.com -m "$0 " -u "Possible Internal Recon Attempt" -s mailhost
  27. window = 60
  28. thresh = 1
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement