|
Home > Archive > Snort > December 2005 > [Snort-users] Can I automatically include rules?
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
[Snort-users] Can I automatically include rules?
|
|
| oink@signalno9.org 2005-12-06, 5:50 pm |
| Hello,
I would like to include a rule when another is triggered, for example:
If this rule is triggered:
drop tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE
Malware Gator/Clarian Agent"; flow: to_server,established;
uricontent:"/gbsf/gd/ne/new.net.gtrg2ze"; nocase; classtype:
policy-violation; reference:url,
www3.ca.com/securityadvisor/pest/content.aspx?q=67999; sid: 2001306;
rev:5;)
I would like to also trigger this rule for n minutes/seconds:
drop tcp any any -> any 80 (classtype:attempted-user; msg:"Port 80
connection initiated";)
I've looked at the tagging option for rules but I need to drop them, not
just log them.
Any ideas?
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
| |
| Will Metcalf 2005-12-06, 5:50 pm |
| sticky-drop in snort-inline can do this. You could probably
accomplish the same thing with Snortsam In InlineMode(); but I haven't
tried it.
Regards,
Will
On 12/6/05, oink@signalno9.org <oink@signalno9.org> wrote:
> Hello,
>
> I would like to include a rule when another is triggered, for example:
>
> If this rule is triggered:
> drop tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE
> Malware Gator/Clarian Agent"; flow: to_server,established;
> uricontent:"/gbsf/gd/ne/new.net.gtrg2ze"; nocase; classtype:
> policy-violation; reference:url,
> www3.ca.com/securityadvisor/pest/content.aspx?q=3D67999; sid: 2001306;
> rev:5;)
>
> I would like to also trigger this rule for n minutes/seconds:
> drop tcp any any -> any 80 (classtype:attempted-user; msg:"Port 80
> connection initiated";)
>
> I've looked at the tagging option for rules but I need to drop them, not
> just log them.
>
> Any ideas?
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log fi=
les
> for problems? Stop! Download the new AJAX search engine that makes
> searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=3D7637&a...6865&op=3Dclick
> ________________________________________
_______
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists...nfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf....t=3Dsnort-users
>
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
| |
| oink@signalno9.org 2005-12-06, 5:50 pm |
| I see how sticky-drop can drop the traffic from the client but how would I
go about calling the one rule from the other?
Right now I have snort_inline and baitnswitch running (with the STD_BUF
patch ;)). When an alert is triggered baitnswitch redirects the traffic
matching the signature. So what happens is traffic from the client to the
"attacked" host is redirected. So that part works fine, however, I want
to redirect traffic from the client to all hosts when an alert is
triggered.
With my current config when a client machine triggers the "Malware Gator
New Code Download" rule bns will redirect traffic from the client to
whatever the "Gator server" is. The client will still be able to surf the
web as the only traffic redirected is the traffic to the Gator server.
What I want to do is when the signature above is matched is to also
include, for n minutes, a "drop all web" signature like:
drop tcp any any -> any 80 (bait-and-switch:600,src,1.2.3.4;
classtype:attempted-user; msg:"Port 80 connection initiated";)
That way all web traffic from the client will be redirected to a local
webserver that will politely tell the user to clean their machine.
So, in english, when bad web traffic is matched I want to redirect all web
traffic for that client for a while. Can this be done?
Thanks.
--
JT
> sticky-drop in snort-inline can do this. You could probably
> accomplish the same thing with Snortsam In InlineMode(); but I haven't
> tried it.
>
> Regards,
>
> Will
>
> On 12/6/05, oink@signalno9.org <oink@signalno9.org> wrote:
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log
> files
> for problems? Stop! Download the new AJAX search engine that makes
> searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
> ________________________________________
_______
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists...nfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf....ist=snort-users
>
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
| |
|
| http://www.snort.org/docs/snort_htm...233/node18.html
Look at activate and dynamic they might do what you want but otherwise
you might have to handle it post process.
oink@signalno9.org wrote:
> Hello,
>
> I would like to include a rule when another is triggered, for example:
>
> If this rule is triggered:
> drop tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE
> Malware Gator/Clarian Agent"; flow: to_server,established;
> uricontent:"/gbsf/gd/ne/new.net.gtrg2ze"; nocase; classtype:
> policy-violation; reference:url,
> www3.ca.com/securityadvisor/pest/content.aspx?q=67999; sid: 2001306;
> rev:5;)
>
> I would like to also trigger this rule for n minutes/seconds:
> drop tcp any any -> any 80 (classtype:attempted-user; msg:"Port 80
> connection initiated";)
>
> I've looked at the tagging option for rules but I need to drop them, not
> just log them.
>
> Any ideas?
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems? Stop! Download the new AJAX search engine that makes
> searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> ________________________________________
_______
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists...nfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf....ist=snort-users
>
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
| |
|
|
|
|
|