# :  Bro/Zeek ATT&CK-based Analytics and Reporting (BZAR), by MITRE

**URL:** <https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5650>\
**Category:** Zeek\
**Created:** [March 28, 2019, 1:27pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5650 "2019-03-28T13:27:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fernandez\_Mark\_I](https://avatars.discourse-cdn.com/v4/letter/f/e274bd/32.png) [@Fernandez\_Mark\_I](https://community.zeek.org/u/Fernandez_Mark_I)\
**Post date:** [March 28, 2019, 1:27pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5650/1 "2019-03-28T13:27:07Z")

</div>

Alex,

> > - Is the repository going to be maintain and updated

> > e.g new attacks and categories techniques ?

To be determined. We may do some small updates in the near future. Contributions from the Zeek community are welcome, and I believe we’ll be able to incorporate community contributions.

> > - Second isn’t possible to detect pth attack throught

> > **bzar\_smb.bro ?**

Pass-the-Hash (pth) was not in the initial scope of the BZAR work. I think it would be great to add it, but I haven’t done a market survey to see if anyone else has already developed pth detection for Zeek.

Cheers,

Mark

---

<div class="post-metadata">

**Author:** ![Patrick\_Kelley](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@Patrick\_Kelley](https://community.zeek.org/u/Patrick_Kelley)\
**Post date:** [March 28, 2019, 1:55pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5650/2 "2019-03-28T13:55:39Z")

</div>

We’ll try to crack something out around PTH, if nothing exists already. We’ll post it here when done.

We have the pcaps from the lab and live engagements. Should be able to knock that out.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/bro-zeek-att-ck-based-analytics-and-reporting-bzar-by-mitre/5650/3 "2022-05-06T15:46:24Z")

</div>

Closed on May 6, 2022, 3:46pm UTC