Building Custom Detections with Zeek and Spicy

The talk introduces Zeek, an open-source passive network monitor that watches a copy of network traffic from a span port or tap and turns it into compact logs covering many protocols. The speaker explains why those logs are useful both for live investigations and for looking back at older traffic without keeping full packet captures, and describes Zeek's event-driven scripting language.

The core example is a Redis remote code execution. An unauthenticated Redis server can be told to become a replica of an attacker's server, then receive a shared library disguised as a database sync and load it as a module, which gives the attacker command execution. The speaker walks through the Redis wire protocol and shows how Spicy, a parser generator for network protocols, turns raw bytes into structured units and raises events that Zeek can react to.

With those events available, the detection is a short Zeek script that checks each Redis command against an allow list and raises a notice when a disallowed command such as the module-loading one appears. The speaker also shows how the Redis log can be searched for unexpected commands and for an ELF file header appearing right after a full resync. The takeaway is that Zeek can flag this kind of exploit and supports custom logic beyond signature matching, although it is passive and does not block traffic itself.