Sustavi za detekciju napada (Suricata)

insider

TIM: Aleksandra Sobodić, Dario Supan, Ivanko Zekić

C:\windows\system32;C:\cygwin\bin;C:\cygwin\lib\pkgconfig;

C:\cygwin\tmp

C:\cygwin\tmp\yaml-0.1.4

cd /tmp
cd yaml-0.1.4
./configure --prefix=/usr && make && make install

cd .. 

git clone git://phalanx.openinfosecfoundation.org/oisf.git

dos2unix.exe libhtp/configure.ac && dos2unix.exe libhtp/htp.pc.in && dos2unix.exe libhtp/Makefile.am

./autogen.sh && ./configure && make

wget http://www.openinfosecfoundation.org/download/suricata-1.4.tar.gz
tar –zxf suricata-1.4.tar.gz
cd suricata-1.4
dos2unix.exe libhtp/configure.ac && dos2unix.exe libhtp/htp.pc.in && dos2unix.exe libhtp/Makefile.am
libtoolize -c && autoreconf -fv --install && ./configure && make

default-log-dir: C:\Suricata\log
………
- file:
enabled: yes
filename: C:\Suricata\suricata.log
……….
default-rule-path: C:\Suricata\rules\
classification-file: C:\Suricata\classification.config
reference-config-file: C:\Suricata\reference.config
HOME_NET: "[192.168.152.129]" (postaviti mrežu za koju se želi da je Suricata pregledava)

suricata.exe -c suricata.yaml -i 192.168.152.129
//-i 192.168.152.129 je IP/sučelje za koje se želi da ga Suricata osluškuje, za primjer je uzeta naša mrežna kartica

- file-store:
    enabled: yes
………
- reassembly:
    memcap: 64mb
    depth: 10mb
………
- rule-files:
    - files.rules  #dodati novo pravilo
………
magic-file: C:\Suricata\magic.mgc

# Same for JPEG's 
#alert http any any -> any any (msg: "FILEMAGIC jpg(1)"; flow:established, to server; filemagic:"JPEG image data"; filestore; sid:10; rev1;)

# Same for JPEG's 
alert http any any -> any any (msg: "FILEMAGIC jpg(1)"; flow:established; filemagic:"JPEG image data"; filestore; sid:10; rev1;)

suricata.exe -c suricata.yaml -i 192.168.152.129

wget http://......jpg //izabrati po želji web stranicu s jpg slikom s web-a

cat fast.log

01/19/2013-12:45:31.384280 [**] [1:2014726:14] ET POLICY Outdated Windows Flash Version IE 
[**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.152.129:1445 -> 173.194.35.6:80

action-order:
- pass
- drop
- reject
- alert

! 1.1.1.1                     (Every IP address but 1.1.1.1)
![1.1.1.1, 1.1.1.2]           (Every IP address but 1.1.1.1 and 1.1.1.2)    
$HOME_NET                     (Your setting of HOME_NET in yaml)
[$EXTERNAL_NET, !$HOME_NET]   (EXTERNAL_NET and not HOME_NET)
[10.0.0.0/24, !10.0.0.5]      (10.0.0.0/24 except for 10.0.0.5) 
[…..,[....]]
[…. ,![.....]]

HOME_NET: any
EXTERNAL_NET: ! $HOME_NET 

!       iznimka/negacija
:       raspon
[]      znakovi kako bi se razjasnilo koji dijelovi pripadaju zajedno
,       odvajanje

[80, 81, 82]    (port 80, 81 i82)
[80: 82]        (raspon od 80 do 82)
[1024: ]        (od 1024 do najvećeg broja porta)
!80             (svaki port osim 80)
[80:100,!99]    (raspon od 80 do 100 bez 99)
[1:80,![2,4]]
[….[.....]]

source -> destination
source <- destionation
source <> destionation (both directions)

alert tcp 1.2.3.4. 1024 - > 5.6.7.8 80

name: settings;

msg: "..........";

msg: "ATTACK-RESPONSES 403 Forbidden";
msg: "ET EXPLOIT SMB-DS DCERPC PnP bind attempt";

To je konvencija u kojoj je msg uvijek prva ključna riječ potpisa.

sid:123;

rev:123; 

To je konvencija u kojoj sid uvijek dolazi prije rev, a oboje su na kraju svih drugih ključnih riječi.

To je konvencija u kojoj classtype dolazi prije sid i rev, ali poslije ostalih ključnih riječi.

config classification: web-application-attack,Web Application Attack,1
config classification: not-suspicious,Not Suspicious Traffic,3

reference: url, www.info.nl

system             URL Prefix
bugtraq            http://www.securityfocus.com/bid
cve                http://cve.mitre.org/cgi-bin/cvename.cgi?name=
nessus             http://cgi.nessus.org/plugins/dump.php3?id=
arachnids          (No longer available but you might still encounter this in signatures.) 
                   http://www.whitehats.com/info/IDS
mcafee             http://vil.nai.com/vil/dispVirus.asp?virus_k=
url                http://

reference: bugtraq, 123; http://www.securityfocus.com/bid

priority:1;

metadata:......;

content: ”............”;

0x61 je a  
0x41 je A 
0x21 je ! 
0x0D je povrat pokazivača
0x0A je redak

“    22
;    3B
:    3A
|    7C

To je konvencija u kojoj se heksadecimalna notacija zapisuje velikim slovima.

content:“a|0D|bc”;
content:”|61 0D 62 63|";
content:”a|0D|b|63|”;

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Outdated Firefox on
Windows"; content:"User-Agent|3A| Mozilla/5.0 |28|Windows|3B| ";
content:"Firefox/3."; distance:0; content:!"Firefox/3.6.13";
distance:-10; sid:9000000; rev:1;)

nocase;

 content: “abc”; nocase;

depth:12;

content; “def”; offset:3; depth:6;

isdataat:512; //potpis traži korisni teret veličine 512 bajtova
isdataat:50, relative; // potpis traži 50 bajtova od zadnjeg podudaranja

dsize:<number>;

rpc:<application number>, [<version number>|*], [<procedure number>|*]>;

“/<regex>/opts”;

pcre:”/[0-9]{6}/”;

GET /index. html/ HTTP/1.0\r\n

HTTP/1.0 200 OK\r\n
<html>
<title> some page </title>
</HTML>

GET/index.html HTTP/1.0\r\n 

HTTP/1.1.302 Found

HTTP/1.1.302 Found

alert http any any -> any any (file_data; content:"abc"; content:"xyz";)

content:”User-Agent|3A|”;
content:”Badness”; distance:0; fast_pattern;

content: “aaaaaaaaabc”; fast_pattern:8,4;

urilen:3;
urilen:1;
urilen:>1;
urilen:<10;
urilen:10<>20;    //(veće od 10, manje od 20)

flowbits: set, name                Will set the condition/'name', if present, in the flow.
flowbits: isset, name              Can be used in the rule to make sure it generates an alert                          
                                   when the rule matches and the condition is set in the flow.
flowbits: toggle, name             Reverses the present setting. So for example if a condition is set, 
                                   it will be unset and vice-versa.
flowbits: unset, name              Can be used to unset the condition in the flow.
flowbits: isnotset, name           Can be used in the rule to make sure it generates an alert
                                   when it matches and the condition is not set in the flow.

To_client                       established                
to_server                       stateless

flow:to_client, established;

>      veće od 
<      manje od
=      jednako
!=     različito
>=     veće od ili jednako
<=     manje od ili jednako

stream_size:<server|client|both|either>, <modifier>, <number>;

iprep:<side to check>,<cat>,<operator>,<value>
side to check: <any|src|dst|both>
cat: the category short name
operator: <, >, =
value: 1-127

alert ip $HOME_NET any -> any any (msg:"IPREP internal  host talking to CnC server"; flow:to_server; iprep:dst,CnC,>,30; sid:1; rev:1;)

alert ip any any -> any any (msg:"IPREP High Value CnC"; iprep:src,CnC,>,100; sid:1; rev:1;)

ttl:<number>

ttl:10;

ipopts: <name>

ipopts: lsrr;

sameip;

id:<number>;

M - More Fragments 
D - Do not Fragment 
R - Reserved Bit

+         match on the specified bits, plus any others 
*         match if any of the specified bits are set 
!         match if the specified bits are not set

fragbits:[*+!]<[MDR]>;

<       match if the value is smaller than the specified value
>       match if the value is greater than the specified value
!       match if the specified value is not present

fragoffset:[!|<|>]<number>;

seq:0;

ack:1;

window:[!]<number>;

itype:min<>max; 
itype:[<|>]<number>;

icode:min<>max; 
icode:[<|>]<number>;

icmp_id:<number>;

icmp_seq:<number>;

threshold: type <threshold|limit|both>, track <by_src|by_dst>, count <N>, seconds <T>

alert tcp !$HOME_NET any -> $HOME_NET 25 (msg:"ET POLICY Inbound Frequent Emails - Possible Spambot Inbound"; \
    flow:established; content:"mail from|3a|"; nocase;                                                       \
    threshold: type threshold, track by_src, count 10, seconds 60;                                           \
    reference:url,doc.emergingthreats.net/2002087; classtype:misc-activity; sid:2002087; rev:10;)

alert http $HOME_NET any -> any $HTTP_PORTS (msg:"ET USER_AGENTS Internet Explorer 6 in use - Significant Security Risk"; \
    flow:to_server,established; content:"|0d 0a|User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b|";                \
    threshold: type limit, track by_src, seconds 180, count 1;                                                           \
    reference:url,doc.emergingthreats.net/2010706; classtype:policy-violation; sid:2010706; rev:7;)

alert tcp $HOME_NET 5060 -> $EXTERNAL_NET any (msg:"ET VOIP Multiple Unauthorized SIP Responses TCP"; \
    flow:established,from_server; content:"SIP/2.0 401 Unauthorized"; depth:24;                      \
    threshold: type both, track by_src, count 5, seconds 360;                                        \
    reference:url,doc.emergingthreats.net/2003194; classtype:attempted-dos; sid:2003194; rev:6;)

detection_filter: track <by_src|by_dst>, count <N>, seconds <T>

alert http $EXTERNAL_NET any -> $HOME_NET any \
    (msg:"ET WEB_SERVER WebResource.axd access without t (time) parameter - possible ASP padding-oracle exploit"; \
    flow:established,to_server; content:"GET"; http_method; content:"WebResource.axd"; http_uri; nocase;          \
    content:!"&t="; http_uri; nocase; content:!"&amp|3b|t="; http_uri; nocase;                                    \
    detection_filter:track by_src,count 15,seconds 2;                                                             \
    reference:url,netifera.com/research/; reference:url,www.microsoft.com/technet/security/advisory/2416728.mspx; \
    classtype:web-application-attack; sid:2011807; rev:5;)

luajit:[!]<scriptfilename>;

function init (args)
   local needs = {}
   needs["http.request_line"] = tostring(true)
   return needs
end

   packet -- entire packet, including headers
   payload -- packet payload (not stream)
   http.uri
   http.uri.raw
   http.request_line
   http.request_headers
   http.request_headers.raw
   http.request_cookie
   http.request_user_agent
   http.request_body
   http.response_headers
   http.response_headers.raw
   http.response_body
   http.response_cookie

function match(args)
   a = tostring(args["http.request_line"])
   if #a > 0 then
       if a:find("^POST%s+/.*%.php%s+HTTP/1.0$") then
           return 1
       end
   end
   return 0
end

sudo nano local.rules

sudo nano /etc/suricata/suricata.yaml

suricata -c /etc/suricata/suricata.yaml -i wlan0

tail -f /var/log/suricata/fast.log

alert http any any -> any any (msg:"Do not read gossip during work"; 
content:"Scarlett"; nocase; classtype:policy-violation; sid:1; rev:1;)

09/15/2011-16:50:27.725288  [**] [1:1:1] Do not read gossip during  work [**] 
[Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.0.32:55604 -> 68.67.185.210:80

detect-engine:
  - profile: medium
  - custom-values:
     toclient-src-groups: 2
     toclient-dst-groups: 2
     toclient-sp-groups: 2
     toclient-dp-groups: 3
     toserver-src-groups: 2
     toserver-dst-groups: 4
     toserver-sp-groups: 2
     toserver-dp-groups: 25
 - sgh-mpm-context: auto
 - inspection-recursion-limit: 3000
 # When rule-reload is enabled, sending a USR2 signal to the Suricata process
 # will trigger a live rule reload. Experimental feature, use with care.
 - rule-reload: true

root@ubuntu32:~/Downloads/oisf# suricata -c /etc/suricata/suricata.yaml -i eth0
[10571] 28/6/2012 -- 18:39:29 - (suricata.c:1194) <Info> (main) -- 
 This is Suricata version 1.3dev (rev 7109a05)
[10571] 28/6/2012 -- 18:39:34 - (detect.c:678) <Info> (SigLoadSignatures) -- 
 1 rule files processed. 11084 rules succesfully loaded, 0 rules failed
[10571] 28/6/2012 -- 18:39:39 - (detect.c:2627) <Info> (SigAddressPrepareStage1) -- 
 11092 signatures processed. 4 are IP-only rules, 3617 are inspecting packet payload, 8937 inspect application layer, 0 are decoder event only
[10571] 28/6/2012 -- 18:39:39 - (detect.c:2630) <Info> (SigAddressPrepareStage1) -- 
 building signature grouping structure, stage 1: adding signatures to signature source  addresses... complete
[10571] 28/6/2012 -- 18:39:40 - (detect.c:3254) <Info> (SigAddressPrepareStage2) -- 
 building signature grouping structure, stage 2: building source address list... complete
[10571] 28/6/2012 -- 18:39:41 - (detect.c:3914) <Info> (SigAddressPrepareStage3) -- 
 building signature grouping structure, stage 3: building destination address lists...  complete
[10571] 28/6/2012 -- 18:39:43 - (util-profiling.c:668) <Info> (SCProfilingInitRuleCounters) -- 
 Registered 11092 rule profiling counters.
[10571] 28/6/2012 -- 18:39:43 - (tm-threads.c:1961) <Info> (TmThreadWaitOnThreadInit) -- 
 all 2 packet processing threads, 3 management threads initialized, engine started.

root@ubuntu32:~/Downloads# ps -af |grep suricata
root     10571  1786 19 18:39 pts/0    00:00:13 suricata -c /etc/suricata/suricata.yaml -i eth0
root     10583  1902  0 18:40 pts/1    00:00:00 grep --color=auto suricata

root@ubuntu32:~/Downloads# kill -USR2 10571

[10584] 28/6/2012 -- 18:40:48 - (detect-engine.c:80) <Info> (DetectEngineLiveRuleSwap) -- 
 ===== Starting live rule swap triggered by user signal USR2 =====
[10584] 28/6/2012 -- 18:40:52 - (detect.c:678) <Info> (SigLoadSignatures) -- 
 37 rule files processed. 10942 rules succesfully loaded, 0 rules failed
[10584] 28/6/2012 -- 18:40:57 - (detect.c:2627) <Info> (SigAddressPrepareStage1) -- 
 10950 signatures processed. 4 are IP-only rules, 3500 are inspecting packet payload, 8910 inspect application layer, 0 are decoder event only
[10584] 28/6/2012 -- 18:40:57 - (detect.c:2630) <Info> (SigAddressPrepareStage1) -- 
 building signature grouping structure, stage 1: adding signatures to signature source addresses... complete
[10584] 28/6/2012 -- 18:40:57 - (detect.c:3254) <Info> (SigAddressPrepareStage2) -- 
 building signature grouping structure, stage 2: building source address list... complete
[10584] 28/6/2012 -- 18:40:59 - (detect.c:3914) <Info> (SigAddressPrepareStage3) -- 
 building signature grouping structure, stage 3: building destination address lists... complete
[10584] 28/6/2012 -- 18:41:00 - (util-threshold-config.c:927) <Info> (SCThresholdConfParseFile) -- 
 Threshold config parsed: 0 rule(s) found
[10584] 28/6/2012 -- 18:41:00 - (detect-engine.c:230) <Info> (DetectEngineLiveRuleSwap) -- 
 Live rule swap has swapped 1 old det_ctx's with new ones, along with the new de_ctx
[10584] 28/6/2012 -- 18:41:01 - (detect.c:3941) <Info> (SigAddressCleanupStage1) -- 
 cleaning up signature grouping structure... complete
[10584] 28/6/2012 -- 18:41:01 - (detect-engine.c:290) <Info> (DetectEngineLiveRuleSwap) --
 ===== Live rule swap DONE =====

primjer vrijednosti: „1.0“, „1.1“, „1.2“

primjer:
tls.subject: „.CN=“ googleusercontent.com“

primjer:
tls.issuerdn: !“CN= Google.internet-Authority“

primjer:
tls.fingerprint:!“f3:40:21:48:70:2c:31:bc:b5:aa:22:ad:63:d6:bc:2e:46:e2:5a“

sudo nano oinkmaster.conf
modifysid 2010495 “alert” | “drop”

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Adobe 0day Shovelware"; \
 flow:established,to_server; content:"GET "; nocase; depth:4; content:!"|0d 0a|Referer\:"; nocase; \
 uricontent:"/ppp/listdir.php?dir="; pcre:"/\/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir=/U"; \
 classtype:trojan-activity; reference:url,isc.sans.org/diary.html?storyid=7747; reference:url,doc.emergingthreats.net/2010496; \
 reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_Adobe; sid:2010496; rev:2;)

isc.sans.org/diary.html?storyid=7747
doc.emergingthreats.net/2010496
www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_Adobe

ENGINE_PROFILE_LOW:
     toclient-src-groups: 2
     toclient-dst-groups: 2
     toclient-sp-groups: 2
     toclient-dp-groups: 3
     toserver-src-groups: 2
     toserver-dst-groups: 4
     toserver-sp-groups: 2
     toserver-dp-groups: 25

default and MEDIUM profiles:
     toclient-src-groups: 4
     toclient-dst-groups: 4
     toclient-sp-groups: 4
     toclient-dp-groups: 6
     toserver-src-groups: 4
     toserver-dst-groups: 8
     toserver-sp-groups: 4
     toserver-dp-groups: 30

ENGINE_PROFILE_HIGH:
     toclient-src-groups: 15
     toclient-dst-groups: 15
     toclient-sp-groups: 15
     toclient-dp-groups: 20
     toserver-src-groups: 15
     toserver-dst-groups: 15
     toserver-sp-groups: 15
     toserver-dp-groups: 40

detect-engine:
 - profile: medium
 - custom-values:
     toclient-src-groups: 200
     toclient-dst-groups: 200
     toclient-sp-groups: 200
     toclient-dp-groups: 300
     toserver-src-groups: 200
     toserver-dst-groups: 400
     toserver-sp-groups: 200
     toserver-dp-groups: 200
 - sgh-mpm-context: auto
 - inspection-recursion-limit: 3000

 - custom-values:
     toclient-src-groups: 2
     toclient-dst-groups: 2
     toclient-sp-groups: 2
     toclient-dp-groups: 3
     toserver-src-groups: 2
     toserver-dst-groups: 4
     toserver-sp-groups: 2
     toserver-dp-groups: 25

-------------------------------------------------------------------
Counter                   | TM Name                   | Value
-------------------------------------------------------------------
flow_mgr.closed_pruned    | FlowManagerThread         | 154033
flow_mgr.new_pruned       | FlowManagerThread         | 67800
flow_mgr.est_pruned       | FlowManagerThread         | 100921
flow.memuse               | FlowManagerThread         | 6557568
flow.spare                | FlowManagerThread         | 10002
flow.emerg_mode_entered   | FlowManagerThread         | 0
flow.emerg_mode_over      | FlowManagerThread         | 0
decoder.pkts              | RxPcapem21                | 450001754
decoder.bytes             | RxPcapem21                | 409520714250
decoder.ipv4              | RxPcapem21                | 449584047
decoder.ipv6              | RxPcapem21                | 9212
decoder.ethernet          | RxPcapem21                | 450001754
decoder.raw               | RxPcapem21                | 0
decoder.sll               | RxPcapem21                | 0
decoder.tcp               | RxPcapem21                | 448124337
decoder.udp               | RxPcapem21                | 542040
decoder.sctp              | RxPcapem21                | 0
decoder.icmpv4            | RxPcapem21                | 82292
decoder.icmpv6            | RxPcapem21                | 9164
decoder.ppp               | RxPcapem21                | 0
decoder.pppoe             | RxPcapem21                | 0
decoder.gre               | RxPcapem21                | 0
decoder.vlan              | RxPcapem21                | 0
decoder.avg_pkt_size      | RxPcapem21                | 910
decoder.max_pkt_size      | RxPcapem21                | 1514
defrag.ipv4.fragments     | RxPcapem21                | 4
defrag.ipv4.reassembled   | RxPcapem21                | 1
defrag.ipv4.timeouts      | RxPcapem21                | 0
defrag.ipv6.fragments     | RxPcapem21                | 0
defrag.ipv6.reassembled   | RxPcapem21                | 0
defrag.ipv6.timeouts      | RxPcapem21                | 0
tcp.sessions              | Detect                    | 41184
tcp.ssn_memcap_drop       | Detect                    | 0
tcp.pseudo                | Detect                    | 2087
tcp.invalid_checksum      | Detect                    | 8358
tcp.no_flow               | Detect                    | 0
tcp.reused_ssn            | Detect                    | 11
tcp.memuse                | Detect                    | 36175872
tcp.syn                   | Detect                    | 85902
tcp.synack                | Detect                    | 83385
tcp.rst                   | Detect                    | 84326
tcp.segment_memcap_drop   | Detect                    | 0
tcp.stream_depth_reached  | Detect                    | 109
tcp.reassembly_memuse     | Detect                    | 67755264
tcp.reassembly_gap        | Detect                    | 789
detect.alert              | Detect                    | 14721

[18088] 30/5/2012 -- 07:39:18 - (RxPcapem21) Packets 451595939, bytes 410869083410
[18088] 30/5/2012 -- 07:39:18 - (RxPcapem21) Pcap Total:451674222 Recv:451596129 Drop:78093 (0.0%).

 apt-get install libtcmalloc-minimal0

LD_PRELOAD=”/usr/lib/libtcmalloc_minimal.so.0″ suricata -c suricata.yaml -i eth0

for x in `ls *.rules | grep -v 'local.rules'`
do
  sed -i -e 's/^#\s*alert/alert/i' $x
done

#emerging-ftp.rules (from EmergingThreats rules):
alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"GPL FTP FTP Bad login";
flow:from_server,established; content:"530 "; depth:4; pcre:"/^530\s+(Login|
User)/smi"; classtype:bad-unknown; sid:491; rev:9;)

#emerging-ftp.rules (from EmergingThreats rules):
alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"GPL FTP FTP Bad login";
flow:from_server,established; content:"530 "; depth:4; pcre:"/^530\s+(Login|
User)/smi"; classtype:bad-unknown; sid:491; rev:9;)

alert tcp any any -> any any (msg:"Counting Failed Logins"; content:"incorrect"; \
 flowint: username, notset; flowint:username, =, 1; noalert; sid:1;)
alert tcp any any -> any any (msg:"More than two Failed Logins!"; \
 content:"incorrect"; flowint: username, isset; flowint:username, +, 1; \
 flowint:username, >, 2; sid:2;)

keyword	sintaksa	primjer
filename	filename:<string>;	filename:"secret";
fileext	fileext:<string>;	fileext:"jpg";
filemagic	filemagic:<string>;	filemagic:"executable for MS Windows";
filestore	filestore:<direction>,<scope>;	direction: <request/to_server, response/to_client, both> scope: <file, tx, ssn/flow>
filemd5	filemd5:[!]filename;	filemd5:md5-blacklist; filemd5:!md5-whitelist;
filesize	filesize:<value>;	filesize:100; # točno 100 bajtova filesize:100<>200; # veća od 100 i manja od 200 filesize:>100; # veća od 100 filesize:<100; # manja od 100

Stavka	Suricata	Snort
IPS opcija	opcionalna tokom kompajliranja (--enable-nfqueue)	Snort_inline ili snort korišten s -Q naredbom
Pravila	VRT::Snort rules EmergingThreats rules	VRT::Snort rules SO rules EmergingThreats rules
Dretve	Višedretvenost	Jedna dretva
Lakoća instalacije	Nije moguća iz paketa. Ručna instalacija.	Relativno pravocrtna. Instalacija dostupna i iz paketa.
Dokumentacija	Nekoliko resursa na netu	Dobro dokumentiran na službenoj stranici i na netu
Event logiranje	Flat file, database, unified2 logs for barnyard
IPv6 podrška	Puna podrška	Podržava kad se kompajlira s --enable-ipv6 opcijom
Capture accelerators	PF_RING, packet capture accelerator	Nema, koristi se libpcap
Configuration file	suricata.yaml, classification.config, reference.config, threshold.config	snort.conf, threshold.conf
Ofline analiza (pcap file)	da
Frontends	Sguil, Aanval, BASE, FPCGUI (Full Packet Capture GUI), Snortsnarf

Rule set	Suricata	Snort
VRT::Snort rules (free version)	x	x
SO rules (Shared Object)		x
EmergingThreats rules (free version)	x

Testna grupa	Prioritet	# testova	Suricata	Snort
Test pravila	3	8	6	8
Fragmentirani paketi	2	2	1	3
Krivi login podaci	3	1	1	0
Tehnike izbjegavanja	2	15	21	29
Virusi i ostali maliciozni kodovi	3	14	9	7
Shellcodes	3	11	12	7
DoS napadi	3	3	3	3
Napadi od strane klijenta	3	257	127	157
Performanse	3	0	2	1
Mogućnosti blokiranja	2	0	1	1
SVEUKUPNO (neponderirana suma)		311	183	216
SVEUKUPNO (ponderirana suma)		311	526	615

Test	Suricata	Snort
Simple LFI	1	1
LFI using NULL byte	1	1
Full SYN scan	0	1
Full Connect() port scan	0	1
SQL Injection (UNION SELECT)	1	0
Netcat reverse shell	1	1
Nikto scan	2	1
TOTAL	6	6

Test	Suricata	Snort
Nmap decoy test (6th position)	2	2
Nmap decoy test (7th position)	2	2
Hex encoding	2	2
Nmap scan with fragmentation	2	2
Nikto Random URI encoding	1	2
Nikto Directory self reference	1	2
Nikto Premature URL ending	2	2
Nikto Prepend long random string	1	2
Nikto Fake paramater	1	2
Nikto TAB as request spacer	2	2
Nikto Change the case of the URL	1	2
Nikto Windows directory separator	1	2
Nikto Carriage return as request spacer	2	2
Nikto Binary value as request spacer	1	2
JavaScript obfuscation	0	1
TOTAL	21	29

Test	Suricata	Snort
Packed.Generic.187	1	1
W32.Spybot.Worm	-	-
W32.Sality.AE (1)	1	1
W32.Sality.AE (2)	0	0
W32.Sality.AE (3)	-	-
[[#W32.Sality.AE_.284.29\|W32.Sality.AE (4)	-	-
Trojan Horse	0	1
Trojan-Spy.Win32.Zbot	1	0
Trojan.Win32.Spyeye	1	1
Generic Trojan Downloader	1	1
Generic IRC Bot	1	1
Win32/SpamTool	1	1
Dropper with BlackEnergy	1	0
Zango Spyware	1	0
TOTAL	9	7

Test	Suricata	Snort
SHELLCODE sparc setuid 0	1	1
SHELLCODE x86 setgid	1	1
SHELLCODE IRIX SGI + NOOP	0	0
SHELLCODE x86 setgid 0 && SHELLCODE x86 setuid 0	1	1
Metasploit: win32_bind_dllinject -EXITFUNC=seh DLL=c:\ LPORT=4444 Size=312 Encoder=PexFnstenvSub	2	1
Metasploit: win32_bind_dllinject -EXITFUNC=seh DLL=c:\ LPORT=4444 Size=312 Encoder=Pex	2	1
Metasploit: win32_bind -EXITFUNC=seh LPORT=4444 Size=709 Encoder=PexAlphaNum	2	1
cmd.exe /c net user USERNAME PASSWORD /ADD && net localgroup Administrators /ADD USERNAMEN	1	0
Cisco: Create a new VTY, allocate a password then set the privilege level to 15	0	0
Rothenburg Shellcode	1	1
Mainz/Bielefeld Shellcode	1	0
TOTAL	12	7

	Suricata	Snort
Broj poslanih datoteka	257	257
Broj otkrivenih datoteka	127	157
Broj aktiviranih upozorenja	210	374
Razina detekcije	49.41%	61.09%

Sustavi za detekciju napada (Suricata)

Sadržaj

Uvod

Sustavi za detekciju napada (IDS)

Podjela IDS sustava prema različitim kriterijima

Sustavi za sprječavanje napada (IPS)

Podjela IPS sustava

Općenito o Suricati

IDS/IPS

Višedretvenost

Razvoj i značajke

Korisnost Suricate

Glavne značajke

Višedretvenost

Statistika performansi

Protokol automatske detekcije

Gzip dekompresija

Neovisna HTP biblioteka

Standardne ulazne metode

Unified2 izlaz

Tokovne varijable

Brzo IP podudaranje

HTTP Log modul

Flowint

Podržane platforme

Suricata - Praktični dio

Suricata pravila

Akcija

Protokol

Izvor i odredište

Portovi (izvorišni i odredišni port)

Smjer

Opcije pravila

Meta-postavke (eng. Meta-settings)

Ključne riječi korisnog tereta (eng. Payload keywords)

HTTP-ključne riječi (eng. HTTP-keywords)

Tokovne ključne riječi (eng. Flow-keywords)

IP reputacijska pravila (eng. IP Reputation Rule)

Ključne riječi zaglavlja (eng. Header keywords)

IP-ključne riječi (eng. IP-keywords)

TCP-ključne riječi (eng. TCP-keywords)

ICMP-ključne riječi (eng. ICMP-keywords)

Datotečne ključne riječi (eng. File-keywords)

Rule-thresholding

Lua skriptiranje

Dodavanje vlastitih pravila

Live Rule Swap

TLS ključne riječi

Upravljanje pravilima pomoću Oinkmaster

Performanse

Konfiguracija visokih performansi

Fino podešavanje performansi

Statistike

Profiliranje paketa

Modovi za izvođenje

Tcmalloc

Usporedba Suricate i Snorta

Opis testiranja

Opći pregled

Okruženje

Metodologija

Rezultati testova

Zaključak testiranja Suricata vs Snort

Zaključak

Literatura

Osobni alati

Imenski prostori

Inačice

Pogledi

Radnje

Traži

Orijentacija

Traka s alatima