Cyber Security Analyst (Part 3 of 3)

Writing Snort Signatures

This series will cover analyzing the common data types found in cyber security incidents; Netflow,  Domain(s) & IP address(es), PCAP. The format of the posts will be as follows Background information, Concepts & Techniques, Tools, and Recommended reading and/or videos.


Background
Intrusion Detection Systems (IDS) perform network packet inspection for predefined criteria. Its capabilities are to alert and/or collect Packet Capture (PCAP) data related to the predefined criteria.

Overview
For the purpose of this blog we are going to be reviewing the Snort IDS. The information in this blog is design to help people create Snort signatures.

 When creating snort rules remember that you might not have complete inbound/outbound traffic sensor coverage of your network. The longer the duration of PCAP collection the larger the file.  Include documentation on why you are collecting/alerting on the information provided in your signature. Have a set review period for when you will re-evaluate the effectiveness of the signature based on the data collected and its false positive to true positive ratio.

Operators[1]

• \ - used to indicate the end of a line.
• Negation "!" - tells Snort to match any IP address except the one indicated by the listed IP address.
• [] - are used in the "Rules Action" section to define a set.
• () - the contents inside the parenthesis are the "Rule Options" section.
• Range ":" - used to define a range of numbers for the rule to take action on. The start of the range goes on the left of the : The end on the right side.
• Directional "->" - indicates the orientation or direction of the traffic that the rule applies to.
• BiDirectional "<>" - tells Snort to consider the address/port pairs in either the source or destination orientation.

Basics

• Most rules are single line.
• To do multiple line rules use the backslash \ to end the line.
• Rule are divided into two logical section, "Rule header" and "Rule Options".
• Rule Header: contains the rule's action, protocol, source and destination IP addresses and netmask, and the source and destination ports information. The text up to the first parenthesis is the rule header.
• Rule Option: contains alert messages and information on which parts of the packet should be inspected to determine if the rule actions should be taken. The contents enclosed in the parenthesis contains the rule options.
• (Best Practices) Separate the "Rule header" and "Rule options" onto separate lines making it easier to view both sections.

Rule Components

Rule Header = (Action + Protocol + SourceIP + Source Port) Directional or BiDirectional notation (destIP + destport)

Rule Options = Message + Flow + Reference + Classtype + sid/rev

Snort  Rule equation = Rule Header + Rule Options



Rule Creation Steps

1. Rule action

• Rule action(s) take effect on one of the supported protocols the user can specify.
• 
  
• There are 5 default "Rule Actions" available to in Snort:
• Alert - generate an alert using the selected alert method, and then log the packet.
• Log - log the packet.
• Pass - ignore the packet.
• Activate-alert and then turn on another dynamic rule.
• Dynamic - remain idle until activated by an activate rule, then act as a log rule.

2. Protocols

• After the "Rule Action" is chosen the next field in the rule is the "Protocol"
• Snort analyzes the following protocols TCP, UDP, ICMP, and IP.

3. IP Address

• The keyword "any" may be used to define any address.
• Write IP addresses in numeric four octate format and include a CIDR block. 
• (i.e. xxx.xxx.xxx.xxx/24)
• CIDR block indicates the netmask (range of IP addresses) that should be applied to the rule's address and any incoming packets that are tested against the rule.

4. Port Numbers

• After the "Protocol" is chosen the next field in the rule is the "Port Number".
• The keyword "any" may be used to define any port number.

5. The Direction Operator

• Directional -> - indicates the orientation or direction of the traffic that the rule applies to.
• BiDirectional <> - tells Snort to consider the address/port pairs in either the source or destination orientation.

Detection Options[1]
Content
Allows the user to set rules that search for specific content in the packet payload and trigger response based on that data. Whenever a content option pattern match is performed, the Boyer-Moore pattern match function is called and the (rather computationally expensive) test is performed against the packet contents. If data exactly matching the argument data string is contained anywhere within the packets payload, the test is successful and the remainder of the rule option tests are performed.
Be aware that this test is case sensitive.
Options:

• nocase
• Used to specify that the Snort should look for the specific pattern, ignoring case.
• rawbytes
• Used to look at the raw packet data, ignoring any decoding that was done by pre-processors.
• depth
• Used to specify how far into a packet Snort should search for the specified pattern based on a chosen byte value.
• only values greater than or equal to the pattern length can be searched. The minimum byte value is 1 and the maximum byte value is 65535.
• Syntax:
• depth: [<number>|<var_name>]
• offset
• Used to specify where to start searching for a pattern within a packet based on a chosen byte value.
• The byte ranges from -65535 to 65535.
• Syntax:
• offset:[<number>|<var_name>]
• distance
• Used to specify how far into a packet Snort should ignore before starting to search for the specified pattern relative to the end of the previous pattern match.
• syntax:
• distance:[<byte_count>|<var_name>]
• within
• Used to make sure that at most N bytes are between pattern matches using the content keyword.
• Syntax:
• within:[<byte_count>|<var_name>]
• http_client_body
• Used to restrict the search to the body of an HTTP client request.
• Syntax:
• http_client_body

References
1. Snort


Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec