Download presentation
Presentation is loading. Please wait.
1
Hakuna Suricata (it means no worries, except for APT)
LS Pulsifer Surveillance Analyst 5 May 2014 1
2
Outline IDS Overview First Thoughts Rules of the Jungle HTTP GET
HTTP 200 OK BONUS ROUND! Conclusion 2
3
First Thoughts Easy Setup TURN ON ALL THE THINGS! Output format(s)
1400 (w/ comments) line config ET rules out of the box Rule management? TURN ON ALL THE THINGS! Output format(s) Fancy-lookin' rules
4
Rules of the Jungle # PULSIFER.CA / CATS TEST HTTP RULE
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"THE INTERNET WANTS CATS"; content:"GET"; http_method; content:"/cats.html"; http_uri; content:"pulsifer.ca"; http_header; content:”Windows NT 6.1”; http_user_agent; urilen:<11; classtype:bad-unknown; sid: ; rev:1;) alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"THE INTERNET GOT CATS"; content:"200"; http_stat_code; content:"OK"; http_stat_msg; content:"iframe src"; http_server_body; classtype:bad-unknown; sid: ; rev:1;)
5
First Rule of the Jungle
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"THE INTERNET WANTS CATS"; content:"GET"; http_method; content:"/cats.html"; http_uri; content:"pulsifer.ca"; http_header; content:”Windows NT 6.1”; http_user_agent; urilen:<11; classtype:bad-unknown; sid: ; rev:1;) GET /cats.html HTTP/1.1 Host: pulsifer.ca User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/ Firefox/28.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive
6
Debug cont.. PACKET: C 29 DD B4 57 C CB 92 D )..W.` E. E DF F 0A 0D E7 P...%.C. D B3 A F4 76 B0 3A F1 3C 4A }...P.. v.:.<JP. FE ALERT CNT: ALERT MSG [00]: THE INTERNET WANTS CATS ALERT GID [00]: ALERT SID [00]: ALERT REV [00]: ALERT CLASS [00]: Potentially Bad Traffic ALERT PRIO [00]: 2 ALERT FOUND IN [00]: STATE ALERT IN TX [00]: 0 STREAM DATA LEN: STREAM DATA: ...
7
Second Rule of the Jungle
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"THE INTERNET GOT CATS"; content:"200"; http_stat_code; content:"OK"; http_stat_msg; content:"iframe src"; http_server_body; classtype:bad-unknown; sid: ; rev:1;) HTTP/ OK Date: Tue, 06 May :12:05 GMT ... <!DOCTYPE html> <html> <body> <script> document.write('<iframe src="
8
First Rule Debug TIME: 05/05/2014-22:12:06.264225 PCAP PKT NUM: 8
PKT SRC: wire/pcap SRC IP: DST IP: PROTO: SRC PORT: DST PORT: TCP SEQ: TCP ACK: FLOW: to_server: TRUE, to_client: FALSE FLOW Start TS: /05/ :12: FLOW IPONLY SET: TOSERVER: TRUE, TOCLIENT: TRUE FLOW ACTION: DROP: FALSE FLOW NOINSPECTION: PACKET: FALSE, PAYLOAD: FALSE, APP_LAYER: FALSE FLOW APP_LAYER: DETECTED: TRUE, PROTO 1 FLOWBIT: ET.http.driveby.redkit.uri PACKET LEN:
9
Bonus Round! GUESS THE META! 05/05/ :13: [**] Query TX 214c [**] pulsifer.ca [**] A [**] : > :53 05/05/ :13: [**] Response TX 214c [**] Recursion Desired [**] :53 -> :50922 05/05/ :13: [**] Response TX 214c [**] pulsifer.ca [**] A [**] TTL [**] [**] :53 -> :50922 05/05/ :50: : > :993 TLS: Subject='serialNumber=tsWwnNhDJVx2sppFUBFdevYswWWbQOPg, OU=GT , OU=See (c)14, OU=Domain Control Validated - RapidSSL(R), CN=pulsifer.ca' Issuerdn='C=US, O=GeoTrust, Inc., CN=RapidSSL CA' SHA1='d1:0b:df:ca:39:a9:dc:50:79:cb:73:d0:0b:10:84:e9:92:e8:2d:fd' VERSION='TLSv1' 05/05/ :13: pulsifer.ca [**] /cats.html [**] Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/ (KHTML, like Gecko) Chrome/ Safari/ [**] <no referer> [**] GET [**] HTTP/1.1 [**] 200 [**] 156 bytes [**] : > :80 05/05/ :13: mjner.com [**] /update/ [**] Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/ (KHTML, like Gecko) Chrome/ Safari/ [**] [**] GET [**] HTTP/1.1 [**] 200 [**] 1123 bytes [**] : > :80
![Bonus Round! GUESS THE META! 05/05/ :13: [**] Query TX 214c [**] pulsifer.ca [**] A [**] : > :53.](http://slideplayer.com./slide/8061255/25/images/9/Bonus+Round%21+GUESS+THE+META%21+05%2F05%2F+%3A13%3A+%5B%2A%2A%5D+Query+TX+214c+%5B%2A%2A%5D+pulsifer.ca+%5B%2A%2A%5D+A+%5B%2A%2A%5D+%3A+%3E+%3A53..jpg "05/05/ :13: [**] Response TX 214c [**] Recursion Desired [**] :53 -> : /05/ :13: [**] Response TX 214c [**] pulsifer.ca [**] A [**] TTL [**] [**] :53 -> : /05/ :50: : > :993 TLS: Subject= serialNumber=tsWwnNhDJVx2sppFUBFdevYswWWbQOPg, OU=GT , OU=See (c)14, OU=Domain Control Validated - RapidSSL(R), CN=pulsifer.ca Issuerdn= C=US, O=GeoTrust, Inc., CN=RapidSSL CA SHA1= d1:0b:df:ca:39:a9:dc:50:79:cb:73:d0:0b:10:84:e9:92:e8:2d:fd VERSION= TLSv1 05/05/ :13: pulsifer.ca [**] /cats.html [**] Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/ (KHTML, like Gecko) Chrome/ Safari/ [**] <no referer> [**] GET [**] HTTP/1.1 [**] 200 [**] 156 bytes [**] : > :80. 05/05/ :13: mjner.com [**] /update/ [**] Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/ (KHTML, like Gecko) Chrome/ Safari/ [**] [**] GET [**] HTTP/1.1 [**] 200 [**] 1123 bytes [**] : > :80.")
10
Conclusion
Similar presentations
