Writing Snort Rules A quick guide

Writing Snort Rules A quick guide Brian Caswell

The life of a packet through Snort’s detection engine

Writing Snort Rules • Figure out what is "bad" • Capture traffic that includes the "bad stuff" • Learn the protocol • Figure out why the "bad stuff" is bad • Write a rule • Test the rule

More process • Rewrite the rule • Test the rule • Rewrite the rule • Test the rule • Rewrite the rule • Test the rule • Rewrite the rule • Test the rule

Even more process • Rewrite the rule • Test the rule • Rewrite the rule • Test the rule • Rewrite the rule • Test the rule • Rewrite the rule • Test the rule

Rule Format - basic rule alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)

Rule Format – Action alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) • Tells snort what the rule does • In our product • alert pass • In snort • alert log pass activate dynamic • In snort-inline • alert log pass activate dynamic drop sdrop

Rule Format – Custom Actions • not supported in product ruletype suspicious { type log output log_tcpdump: suspicious.log } suspicious tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)

Rule Format – Protocol • alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) • Tells snort to look for a specific protocol • Acceptable protocols: • TCP • UDP • ICMP • IP

Rule Format - IP Address • alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) • Examples 10.1.1.1 • duh 10.1.1.0/24 • 10.1.1.0 through 10.1.1.255 !10.1.1.0/24 • anything but 10.1.1.0 through 10.1.1.255 [10.1.0.0/24,10.2.0.0./24] • 10.1.0.0 through 10.1.0.255 or 10.2.0.0 through 10.2.0.255 ![10.1.0.0/24,10.2.0.0./24] • anything but 10.1.0.0 through 10.1.0.255 or 10.2.0.0 through 10.2.0.255

Rule Format - Port • alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) • Examples: any 80 1:1023 • 1 through 1023 (inclusive) :1023 • less than or equal to 1023 10: • greater than or equal to 10 !53 • not 53 !53:100 • not 53 through 100 (inclusive) NOTE: NO PORT LISTS. 80,8080 IS NOT VALID!!!!

Rule Format - Direction • alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) -> • From the first IP/Port to the second IP/Port <> • From either the first IP/Port to the second IP/Port OR • From either the first IP/Port to the second IP/Port

Rule Format - ... Oh yeah, variables var EXTERNAL_NET any var HTTP_PORTS 80 var SMTP_SERVERS 10.1.1.1 alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS $HTTP_PORTS

Rule Format – Body • alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) • meat of the detection capabilities • key value pairs (key:value;) • types of keywords • meta-data • Payload • non-payload • post-detection

Meta-Data keywords • Msg • msg:"my evil attack"; • Reference • reference:url,www.snort.org; • sid • sid:100000; • Rev • rev:100000; • Classtype (see classification.config) • classtype:attempted-recon; • Priority • priority:3;

Payload • Content • content:"foo"; • Nocase • content:"foo"; nocase; • Rawbytes • content:"foo"; rawbytes; • Depth • content:"foo"; depth:10; • Offset • content:"foo"; offset:10; • Uricontent • uricontent:"foo";

Complicated Payload Options • distance • Within • Isdataat • byte_test • byte_jump • pcre

Broken Payload Keywords • Regex • content-list • rpc

Non-Payload options: • ack (TCP Acknowledge Number) • ack:0; • dsize (Packet Size) • dsize:>10; • id (IP ID) • id:10; • fragoffset (fragment offset) • fragoffset:0; • fragbits (IP fragment bits) • fragbits:MD;

More non-payload options • ttl (IP Time To Live) • ttl:1; • tos (IP TOS) • tos:30; • ipopts (IP option) • ipopts:lsrr; • flags (TCP flags) • flags:SF; • flow (TCP State) • flow:to_server,established;

Even more non-payload options: • seq (TCP Sequence Number) • seq:0; • ttl (IP Time To Live) • ttl:10; • window (TCP Window Size) • window:55808; • itype (ICMP Type) • itype:8; • icode (ICMP Code) • icode:0;

Even more non-payload options (again) • icmp_id (ICMP ID) • icmp_id:0; • icmp_seq (ICMP Sequence Number) • icmp_seq:0; • ip_proto (IP Protocol) • ip_proto:6; • sameip (Are the IPs the same) • sameip; • stateless (Not part of a flow) • stateless;

The complicated options • distance • Within • isdataat • byte_test • byte_jump • pcre

Distance content:”SITE”; content:”EXEC”; distance:0; 53 49 54 45 20 20 20 20 20 45 58 45 43 20 65 76 SITE EXEC ev 69 6C 66 6F 6F 0A ilfoo.

Within content:”SITE”; content:!”|0a|”; within:50; 53 49 54 45 20 20 20 20 20 45 58 45 43 20 65 76 SITE EXEC ev 69 6C 66 6F 6F 0A ilfoo.

Isdataat content:”SITE”; content:!”|0a|”; within:50; 53 49 54 45 20 SITE

Isdataat content:”SITE”; isdataat:50,relative; content:!”|0a|”; within:50; 53 49 54 45 20 SITE

Byte Test content:" LSUB |22|"; content:"|22| {"; distance:0; byte_test:5,>,256,0,string,dec,relative; 31 20 4C 53 55 42 20 22 22 20 7B 31 30 36 34 7D 1 LSUB "" {1064}

Byte Jump content:"|00 00 00 00|"; offset:8; depth:4; content:"|00 01 86 F3|"; offset:16; depth:4; content:"|00 00 00 07|"; distance:4; within:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,128,0,relative; 00 00 0F 9C 36 51 D5 2B 00 00 00 00 00 00 00 02 ....6Q.+........ 00 01 86 F3 00 00 00 01 00 00 00 07 00 00 00 01 ................ 00 00 00 20 37 5E D1 6A 00 00 00 09 6C 6F 63 61 ... 7^.j....loca 6C 68 6F 73 74 00 00 00 00 00 00 00 00 00 00 00 lhost........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F FF ................ 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA

PCRE • Perl Compatable Regular Expressions • a few snort specific options • when using, ALWAYS include a regular content • NOT PART OF FAST PATTERN MATCHER! • Read Mastering Regular Expressions

Writing Snort Rules A quick guide

Writing Snort Rules A quick guide

Presentation Transcript

Snort

SNORT

SNORT

A Quick Guide to Writing a Proposal

Writing Rules

Quick Guide

Writing “Rules”

Snort

Snort Rules (How to keep your insanity?)

Writing Rules

Writing Rules

Snort rules

Writing Snort Rules A quick guide

SNORT

Snort

Snort Rules (How to keep your insanity?)

Quick Guide

Procurement Procedure Rules quick guide to help you understand the rules