Snort Rule Infographic

Official Documentation

-----------------------------------------------------------

SNORTOLOGY 101

THE ANATOMY OF A SNORT RULE

WHAT IS SNORT?

Snort is an open source network intrusion prevention system (IPS) by Cisco. It is capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching and matching, and detect a variety of attacks and probes. Snort can be used as a straight packet sniffer like tcpdump, a packet logger (useful for network traffic debugging), or as a full-blown network intrusion prevention system.

LET’S BREAK IT DOWN

BASIC OUTLINE OF A SNORT RULE
[action][protocol][sourceIP][sourceport] -> [destIP][destport] ( [Rule options] )
|___________________ Rule Header _________________|

RULE HEADER
The rule header contains the rule's action, protocol,
source and destination IP addresses and netmasks,
and the source and destination ports information.

alert Action to take (option) The first item in a rule
is the rule action. The rule action tells Snort what to do
when it finds a packet that matches the rule criteria
(usually alert).

tcp Type of traffic (protocol) The next field in a rule
is the protocol. There are four protocols that Snort
currently analyzes for suspicious behavior
- TCP, UDP, ICMP, and IP.

$EXTERNAL_NET Source address(es) variable or literal

$HTTP_PORTS Source port(s) variable or literal

-> Direction operator The direction operator ->
indicates the orientation of the traffic to which
the rule applies.

$HOME_NET Destination address(es) variable or literal

any Destination port(s) variable or literal

RULE OPTIONS
Rule options form the heart of Snort’s intrusion detection engine combining ease of use with power and flexibility. All Snort rule options are separated from each other using a semicolon (;). Rule option keywords are separated from their arguments with a colon (:).

GENERAL RULE OPTIONS

Message A meaningful message typically includes what the rule is detecting.
The msg rule option tells Snort what to output when the rule matches.
It is a simple text string.

Flow For the rule to fire, specifies which direction the network traffic is going.
The flow keyword is used in conjunction with TCP stream reassembly.
It allows rules to only apply to certain directions of the traffic flow.

Reference The reference keyword allows rules to include references
to external sources of information.

Classtype The classtype keyword is how Snort shares what the effect
of a successful attack would be.

sid/rev The snort id is a unique identifier for each rule. This information
allows output plugins to identify rules easily and should be used with
the rev (revision) keyword.

DETECTION OPTIONS

Content This important feature allows the user to set rules that search for
specific content in the packet payload and trigger response based on that
data. The option data can contain mixed text and binary data.

distance/offset These keywords allow the rule writer to specify where
to start searching relative to the beginning of the payload or the
beginning of a content match.

within/depth These keywords allow the rule write to specify how far
forward to search relative to the end of a previous content match and,
once that content match is found, how far to search for it.

PCRE The pcre keyword allows rules to be written using perl compatible
regular expressions which allows for more complex matches than simple
content matches.

Byte test The byte_test options allows a rule to test a number of bytes
against a specific value in binary.

EXAMPLE

Rule Header      alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any

Message          msg: “BROWSER-IE Microsoft Internet Explorer CacheSize exploit attempt”;

Flow             flow: to_client,established;

Detection        file_data;
content:"recordset"; offset:14; depth:9;
content:".CacheSize"; distance:0; within:100;
pcre:"/CacheSize\s*=\s*/";
byte_test:10,>,0x3ffffffe,0,relative,string; Metadata policy max-detect-ips drop, service http; References reference:cve,2016-8077; Classification classtype: attempted-user; Signature ID sid:65535;rev:1;

例如:alert tcp any any -> any 80 (msg:"http critical file type(sh) Blocked"; content:".sh"; sid:10101; rev:1;)

=================== End

Snort Rule Infographic的更多相关文章

  1. SNORT入侵检测系统

    SNORT入侵检测系统 YxWa · 2015/10/09 10:38 0x00 一条简单的规则 alert tcp 202.110.8.1 any -> 122.111.90.8 80 (ms ...

  2. How to compile and install Snort from source code on Ubuntu

    http://www.tuicool.com/articles/v6j2Ab Snort is by far the most popular open-source network intrusio ...

  3. 如何编写snort的检测规则

    如何编写snort的检测规则 2013年09月08日 ⁄ 综合 ⁄ 共 16976字 前言 snort是一个强大的轻量级的网络入侵检测系统.它具有实时数据流量分析和日志IP网络数据包的能力,能够进行协 ...

  4. Snort Inline IPS Mode

    Snort Inline IPS Mode https://forum.netgate.com/topic/143812/snort-package-4-0-inline-ips-mode-intro ...

  5. snort_inline

    snort_inline Link   http://snort-inline.sourceforge.net/oldhome.html What is snort_inline? snort_inl ...

  6. BlackArch-Tools

    BlackArch-Tools 简介 安装在ArchLinux之上添加存储库从blackarch存储库安装工具替代安装方法BlackArch Linux Complete Tools List 简介 ...

  7. snort installation, configuration and test

    snort installation: https://www.snort.org/#get-started wget https://www.snort.org/rules/snortrules-s ...

  8. Snort - 配置文件

    Snort.conf 版本 2.9.8.3 编译可用选项: --enable-gre --enable-mpls --enable-targetbased --enable-ppm --enable- ...

  9. Snort - manual 笔记(一)

    Chapter 1 Snort Overview This manual is based on Writing Snort Rules by Martin Roesch and further wo ...

随机推荐

  1. flex简单参考实例

    <!DOCTYPE html> <html> <head> <title></title> <style type="tex ...

  2. typescript命名空间

    /* 命名空间: 在代码量较大的情况下,为了避免各种变量命名相冲突,可将相似功能的函数.类.接口等放置到命名空间内 同Java的包..Net的命名空间一样,TypeScript的命名空间可以将代码包裹 ...

  3. typeScript模块<二>

    /*模块 1 模块的的概念 2 模块导出的几种方法 1.export 导出声明 2.export 导出语句 3.export default 4.import导入模块 3 模块化封装上一讲的DB库 * ...

  4. 前端速查手册——Note

    目录 自定义弹框(模块框) HTML5新增标签 HTML5新增属性 自定义弹框(模块框) HTML <div style="display:none" id="mo ...

  5. case when 性能优化

    背景:性能应该是功能的一个重要参考,特别是在大数据的背景之下!写SQL语句时如果仅考虑业务逻辑,而不去考虑语句效率问题,有可能导致严重的效率问题,导致功能不可用或者资源消耗过大.其中的一种情况是,处理 ...

  6. Swift4.0复习类

    1.类的属性: 2.类的方法: 3.类作为引用类型: “Swift新增了一对操作符 === 与 !== 用于判定同一个类的两个对象引用是否指向同一对象实例.” 摘录来自: “大话Swift 4.0”. ...

  7. 【Leetcode_easy】985. Sum of Even Numbers After Queries

    problem 985. Sum of Even Numbers After Queries class Solution { public: vector<int> sumEvenAft ...

  8. jcmd的简单实用

    命令jcmd 显示所有java进程id及相关信息 命令 jcmd java_pid help 显示某个java进程的所有可用命令 ➜ jobs jcmd 61185 help 61185: The f ...

  9. web端调起Windows系统应用程序(exe执行文件),全面兼容所有浏览器

    1. 首先,你要有一个exe可执行文件2. 创建注册表创建注册表有两种方式(以“MyApp.exe”为例): 方式一:可视化编辑Win+R 打开运行,输入 regedit 并回车,进入注册表编辑器新建 ...

  10. Andrew Ng机器学习课程10

    Andrew Ng机器学习课程10 a example 如果hypothesis set中的hypothesis是由d个real number决定的,那么用64位的计算机数据表示的话,那么模型的个数一 ...