zeek/scripts/base/frameworks/signatures

The signature framework provides for doing low-level pattern matching.  While
signatures are not Zeek's preferred detection tool, they sometimes come in
handy and are closer to what many people are familiar with from using
other NIDS.