3 Simple Zeek Scripts to Boost Your Network Security

Zeek is a powerful network analysis framework that can provide you with incredible insight into what’s happening on your network. While Zeek provides a lot of powerful features, one of its greatest strengths is its ability to be extended and customized through the use of scripts.

In this article, I’ll show you three small scripts that can help with network monitoring. Note that these are plain Python (the second uses pyshark and the third reads system logs), not Zeek’s own scripting language, and they are simple learning examples rather than production tools. Only run them on systems and networks you own or have permission to monitor:

(1) SSL Cert Expiration Checker

SSL certificates are an essential component of securing online communication, but they have a limited lifespan. If an SSL certificate expires, it can leave your network open to attacks. The SSL Cert Expiration Checker script connects to a domain, reads its certificate and prints a warning when it is about to expire.

import datetime
import ssl
import socket

# Define a function to check the expiration date of an SSL certificate for a given domain
def check_cert_expiry(domain):
    context = ssl.create_default_context()
    conn = context.wrap_socket(socket.socket(), server_hostname=domain)
    conn.connect((domain, 443))
    cert = conn.getpeercert()
    conn.close()
    exp_date = datetime.datetime.strptime(cert['notAfter'], '%b %d %H:%M:%S %Y %Z')
    days_left = (exp_date - datetime.datetime.now()).days
    if days_left < 30:
        print(f"The SSL certificate for {domain} expires in {days_left} days. Renew it as soon as possible.")

# Replace "williambaptist.co.uk" with your own domain or list of domains to check
check_cert_expiry("williambaptist.co.uk")

Like all these scripts this can be easily customized to meet your needs. For example, you can integrate it with email notifications or remote file writing.

(2) Malware Traffic Detector

Detecting malware traffic is essential for securing your network, but it can be difficult to know where to start. The Malware Traffic Detector script uses pyshark to read a packet capture file and flags HTTP requests to a domain on your own list. It is a simple string match, a toy example, and not real malware detection.

import pyshark

# Define a function to detect potential malware traffic in a network capture file
def detect_malware_traffic(pcap_file):
    cap = pyshark.FileCapture(pcap_file)
    for pkt in cap:
        if pkt.highest_layer == "HTTP":
            # Replace "malicioussite.co.uk" with your own list of known malicious domains
            if "malicioussite.co.uk" in str(pkt.http.host):
                print(f"Malware traffic detected: {pkt}")
    cap.close()

# Replace "capture.pcap" with your own pcap file to analyze
detect_malware_traffic("capture.pcap")

The script does not use YARA. A proper detector would need real threat intelligence or a tool such as YARA. You can still customize the domain list to experiment with it.

(3) SSH Login Attempt Monitor

Monitoring SSH login attempts is essential for securing your network against brute-force attacks. The SSH Login Attempt Monitor script reads the system journal and prints a line for each failed SSH login. It does not count attempts per IP address or send alerts, so you would need to add that yourself.

import subprocess

# Define a function to monitor SSH login attempts and alert on suspicious activity
def monitor_ssh_login_attempts():
    cmd = "journalctl -f | grep sshd | awk '/Failed/{print $NF}'"
    proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True)
    while True:
        line = proc.stdout.readline().decode().strip()
        if line:
            print(f"Suspicious SSH login attempt detected: {line}")
        else:
            break

# Run the function to start monitoring SSH login attempts
monitor_ssh_login_attempts()

You could extend it to count failed attempts per IP address before alerting.

These three scripts are starting points for learning, and they are easy to customize. If you’re not already using Zeek, I would recommend it from a learning standpoint more than anything. Just remember that real Zeek scripts are written in Zeek’s own language, which these examples are not.