Quick Snort Setup Instructions for New Users
-
Good Evening,
I am running into a fatal error when starting Snort on the WAN. Has anyone run into this before &/or have any suggestions on how to fix it? I have spent hours looking through the rules trying to locate the problem rule but have been unsuccessful in locating it.
Feb 22 19:37:07 php-fpm[20485]: /snort/snort_interfaces.php: The command '/usr/pbi/snort-amd64/bin/snort -R 31559 -D -q –suppress-config-log -l /var/log/snort/snort_em131559 --pid-path /var/run --nolock-pidfile -G 31559 -c /usr/pbi/snort-amd64/etc/snort/snort_31559_em1/snort.conf -i em1' returned exit code '1', the output was ''
Feb 22 19:37:07 snort[53353]: FATAL ERROR: /usr/pbi/snort-amd64/etc/snort/snort_31559_em1/rules/snort.rules(11872) : pcre compile of "(obj.data|\object.data).+file\x3A\x2F\x2F127\x2E[0-9]" failed at offset 11 : missing opening brace after \o
Best-
Darren
This is a broken Emerging Threats rule that has had broken syntax for almost a year. Several attempts at getting it fixed at the source have been unsuccessful. Folks here just disable that rule. You can find its GID:SID by opening the file /usr/pbi/snort-amd64/etc/snort/snort_31559_em1/rules/snort.rules in a text editor (such as vi) and going to line 11872. That is the rule that is malformed.
I don't have the rule SID in my head at the moment, but you can search this forum for similar errors and will find multiple posts about this rule.
Bill
Thank you Bill! That was very helpful. For anyone else that runs into this, the rule that needs to be disabled is:
emerging-web_client.rules
SID: 2011695
ET WEB_CLIENT Possible Microsoft Internet Explorer Dynamic Object Tag/URLMON Sniffing Cross Domain Information Disclosure AttemptBest-
Darren
-
Since this sid has been an issue for over a year, wouldn't it be appropriate to disable it from the ruleset so it doesn't come and haunt future users?
-
Good Morning,
Has anyone had success in configuring Snort to allow apple devices to communicate with the Apple Store & iCloud? I have followed the quick setup guide, rule configuration, & everything appears to be working great, with the exception of iPad's & iPhone's not being able to communicate with the Apple Store & not able to restore from iCloud Backup. Any direction on how best to allow this connectivity would be greatly appreciated.
Best-
Darren
-
Since this sid has been an issue for over a year, wouldn't it be appropriate to disable it from the ruleset so it doesn't come and haunt future users?
I am leery of permanently disabling a rule within the GUI code.
Bill
-
Good Morning,
Has anyone had success in configuring Snort to allow apple devices to communicate with the Apple Store & iCloud? I have followed the quick setup guide, rule configuration, & everything appears to be working great, with the exception of iPad's & iPhone's not being able to communicate with the Apple Store & not able to restore from iCloud Backup. Any direction on how best to allow this connectivity would be greatly appreciated.
Best-
Darren
I have no problem with this working in my home network using Snort and pfSense 2.2. Have you checked to see if some particular alert is firing and generating a block? You can check the ALERTS or BLOCKED tabs to see what Snort is doing.
Bill
-
Since this sid has been an issue for over a year, wouldn't it be appropriate to disable it from the ruleset so it doesn't come and haunt future users?
What, you mean ET actually disabling a non functioning rule? Come on it's ET we are talking about here. ;)
I'm on bmeek's side here. Permanently disabling a rule shouldn't be the solution. Not unless we can get a premade list out anyway (hint:new guide).
-
Good Day,
I'm running into an issue with the Ooma IP Telephone Service whereby anytime a telephone call is made or received, it trips the following rule in Snort:
ET TROJAN Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)
I created a Firewall Alias called Ooma with the following data for the Ooma Servers:
70.42.139.0/24 Ooma
208.83.244.0/22 Ooma, Inc.I then added the Alias to the Snort Pass List, checking the Ooma Alias, & leaving all other boxes unchecked. I've clearly missed something, as the alerts are still being triggered & blocked, inspite of having added the correct Ooma Servers. Any thoughts?
Best-
Darren
-
Did you stop/start the snort interface after adding that to the passlist?
-
Good Day,
I'm running into an issue with the Ooma IP Telephone Service whereby anytime a telephone call is made or received, it trips the following rule in Snort:
ET TROJAN Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)
I created a Firewall Alias called Ooma with the following data for the Ooma Servers:
70.42.139.0/24 Ooma
208.83.244.0/22 Ooma, Inc.I then added the Alias to the Snort Pass List, checking the Ooma Alias, & leaving all other boxes unchecked. I've clearly missed something, as the alerts are still being triggered & blocked, inspite of having added the correct Ooma Servers. Any thoughts?
Best-
Darren
Also make sure the new Pass List is actually assigned to your Snort interface by choosing it in the PASS LIST drop-down box on the INTERFACE SETTINGS tab. Save the change and then restart Snort on the interface as @jflsakfja suggested.
Additionally, I don't recommend unchecking the other Pass List checkboxes. You generally don't ever want to do that except in very unusual situations. Yours does not sound like one where I would uncheck those default-checked boxes.
Bill
-
Excellent, thank you both! I went back & changed the settings per your guidance & the telephone service is now working. Can't thank you enough for your help! Alerts are still being generated, but no longer blocked. Is there any reason why I would not want to suppress these alerts?
Best-
Darren
-
Excellent, thank you both! I went back & changed the settings per your guidance & the telephone service is now working. Can't thank you enough for your help! Alerts are still being generated, but no longer blocked. Is there any reason why I would not want to suppress these alerts?
Best-
Darren
You can suppress them if you wish, but depending on how you do it you may expose yourself to a real attack (as opposed to the false positive you are likely seeing now). Here is what I would do:
You know the IP address in question (your phone system), so create a suppress list rule by IP address. The easiest way to accomplish this is on the ALERTS tab. Click the plus (+) icon beside the IP address you don't want to block on one of the alert rows. This will create a suppress list entry of type "track by IP". It will be either source (SRC) or destination (DST) depending on which address column you clicked. The entry will be for that specific IP. If you want to suppress by an IP block instead, then after creating the entry as described previously, go to the SUPPRESS LIST tab, find the newly created list and edit it. Change the IP address to a CIDR block.
Bill
-
Good Afternoon,
I have configured Snort according to the guide & everything works great on the WAN. I have created a LAN Interface & mirrored the rules for both. When I go to start Snort on the LAN, I am getting the following error:
snort[93176]: server /usr/pbi/snort-amd64/etc/snort/appid//odp/lua/service_EIP.lua: error validating …snort-amd64/etc/snort/appid//odp/libs/DetectorCommon.lua:318: table index is nil
I have searched for documentation on this, but have been unable to find out what it is &/or why Snort will not start on the LAN interface. Any guidance or suggestions would be greatly appreciated.
Best-
Darren
-
Good Afternoon,
I have configured Snort according to the guide & everything works great on the WAN. I have created a LAN Interface & mirrored the rules for both. When I go to start Snort on the LAN, I am getting the following error:
snort[93176]: server /usr/pbi/snort-amd64/etc/snort/appid//odp/lua/service_EIP.lua: error validating …snort-amd64/etc/snort/appid//odp/libs/DetectorCommon.lua:318: table index is nil
I have searched for documentation on this, but have been unable to find out what it is &/or why Snort will not start on the LAN interface. Any guidance or suggestions would be greatly appreciated.
Best-
Darren
Confirmed. My system log is filled with this too:
snort[4022]: server /usr/pbi/snort-amd64/etc/snort/appid//odp/lua/service_EIP.lua: error validating ...snort-amd64/etc/snort/appid//odp/libs/DetectorCommon.lua:318: table index is nilSnort starts on all interfaces 'though, yet it is cluttering up the logs with this constantly repeating message.
pfSense 2.1.5 X64, Snort 2.9.7.0 pkg 3.2.3
-
Good Afternoon,
I have configured Snort according to the guide & everything works great on the WAN. I have created a LAN Interface & mirrored the rules for both. When I go to start Snort on the LAN, I am getting the following error:
snort[93176]: server /usr/pbi/snort-amd64/etc/snort/appid//odp/lua/service_EIP.lua: error validating …snort-amd64/etc/snort/appid//odp/libs/DetectorCommon.lua:318: table index is nil
I have searched for documentation on this, but have been unable to find out what it is &/or why Snort will not start on the LAN interface. Any guidance or suggestions would be greatly appreciated.
Best-
Darren
It would be better if you start a new thread in the IDS/IPS sub-forum. This thread was designed to contain just the how-to instructions.
The answer to your problem is also posted in a previous thread here: https://forum.pfsense.org/index.php?topic=89393.msg495651#msg495651, but I will repeat it here. This is a known syntax error in the OpenAppID rules package from the Snort VRT. They committed to fix it in a mailing list post about two weeks ago. It appears they have not yet. You can disable the OpenAppID preprocessor to make the error go away. Unless you have also written your own custom rules to use the OpenAppID signatures, they aren't working anyway.
Bill
-
Very simple guide bmeeks, thank you for taking the time to explain this to us new users. Followed another guide and I kept having snort ban websites I was visiting.
-
Hi!
How about adding a little bit of info specific to nano users running snort? ;-)
Maybe somethink like this:
https://forum.pfsense.org/index.php?topic=106725.msg594731#msg594731
Regards
chemlud
-
Hi bmeeks/jflsakfja,
This post was originally done a few years ago, how valid is the setup in post 1 and the rule configuration in post 3 these days?
-
Hey. Thanks for this useful post.
Btw this list is 3 years old. Is it still (mostly) up to date ?Also I have a few repeating alerts I can't figure out. Can you help ?
1:2018959. ET POLICY PE EXE or DLL Windows file download HTTP
1:28039. INDICATOR-COMPROMISE Suspicious .pw dns query
119:33. (http_inspect) UNESCAPED SPACE IN HTTP URIThanks !
@jflsakfja:
The Missing Part to Quick Snort Setup Instructions for New Users
In tab "Rules", under "Category" select:
(–- means blank table at time of writing)DONE > emerging-activex > all
DONE > emerging-attack_responses > all
DONE > emerging-botcc > all
DONE > emerging-chat > all except:
2010784 ET CHAT Facebook Chat (send message)
2010785 ET CHAT Facebook Chat (buddy list)
2010786 ET CHAT Facebook Chat (settings)
2010819 ET CHAT Facebook Chat using XMPP
2002327 ET CHAT Google Talk (Jabber) Client Login
2002334 ET CHAT Google IM traffic Jabber client sign-on
2001241 ET CHAT MSN file transfer request
2001242 ET CHAT MSN file transfer accept
2001243 ET CHAT MSN file transfer reject
2001682 ET CHAT MSN IM Poll via HTTP
2002192 ET CHAT MSN status change
2008289 ET CHAT Possible MSN Messenger File Transfer
2009375 ET CHAT General MSN Chat Activity
2009376 ET CHAT MSN User-Agent ActivityDONE > emerging-ciarmy > all
DONE > emerging-compromised > all
DONE > emerging-current_events > all
DONE > emerging-deleted > ---
DONE > emerging-dns > all except:
2008446 ET DNS Excessive DNS Responses with 1 or more RR's (100+ in 10
seconds) - possible Cache Poisoning Attempt
2008470 ET DNS Excessive NXDOMAIN responses - Possible DNS Backscatter or Domain Generation Algorithm Lookups
2001117 ET DNS Standard query response, Name ErrorDONE > emerging-dos > all
DONE > emerging-drop > all
DONE > emerging-dshield > all
DONE > emerging-exploit > all except:
2001058 ET EXPLOIT libpng tRNS overflow attempt
2002913 ET EXPLOIT VNC Client response
2002914 ET EXPLOIT VNC Server VNC Auth Offer
2002919 ET EXPLOIT VNC Good Authentication Reply
2002915 ET EXPLOIT VNC Authentication Reply
2002758 ET EXPLOIT WMF Escape Record Exploit - Version 1
2002742 ET EXPLOIT WMF Escape Record Exploit - Version 3DONE > emerging-ftp > all
DONE > emerging-games > all
DONE > emerging-icmp > ---
DONE > emerging-icmp_info > ---
DONE > emerging-imap > ---
DONE > emerging-inappropriate > all except:
2002925 ET INAPPROPRIATE Google Image Search, Safe Mode Off
2001608 ET INAPPROPRIATE Likely PornDONE > emerging-info > all except:
2014472 ET INFO JAVA - Java Archive Download
2014473 ET INFO JAVA - Java Archive Download By Vulnerable Client
2014819 ET INFO Packed Executable Download
2015016 ET INFO FTP STOR to External Network
2015561 ET INFO PDF Using CCITTFax Filter
2015744 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2016360 ET INFO JAVA - ClassID
2016361 ET INFO JAVA - ClassID
2016404 ET INFO MPEG Download Over HTTP (1)DONE > emerging-malware > all except:
2008438 ET MALWARE Possible Windows executable sent when remote host claims to send a Text FileDONE > emerging-misc > all
DONE > emerging-mobile_malware > all except:
2012251 ET MOBILE_MALWARE Google Android Device HTTP Request
2012848 ET MOBILE_MALWARE Possible Mobile Malware POST of IMEI International Mobile Equipment Identity in URIDONE > emerging-netbios > all
DONE > emerging-p2p > all except:
2000369 ET P2P BitTorrent Announce
2007727 ET P2P possible torrent download
2008581 ET P2P BitTorrent DHT ping request
2008583 ET P2P BitTorrent DHT nodes reply
2008585 ET P2P BitTorrent DHT announce_peers request
2010144 ET P2P Vuze BT UDP Connection (5)
2011699 ET P2P Bittorrent P2P Client User-Agent (Transmission/1.x)*emerging-policy > all except:
2000419 ET POLICY PE EXE or DLL Windows file download
2000428 ET POLICY ZIP file download
2001115 ET POLICY MSI (microsoft installer file) download
2003595 ET POLICY exe download via HTTP - Informational
2001898 ET POLICY eBay Bid Placed
2001907 ET POLICY eBay Placing Item for sale
2001908 ET POLICY eBay View Item
2001909 ET POLICY eBay Watch This Item
2003303 ET POLICY FTP Login Attempt (non-anonymous)
2003410 ET POLICY FTP Login Successful
2003121 ET POLICY docs.google.com Activity
2003597 ET POLICY Google Calendar in Use
2002801 ET POLICY Google Desktop User-Agent Detected
2002838 ET POLICY Google Search Appliance browsing the Internet
2000035 ET POLICY Hotmail Inbox Access
2000036 ET POLICY Hotmail Message Access
2000037 ET POLICY Hotmail Compose Message Access
2000038 ET POLICY Hotmail Compose Message Submit
2000039 ET POLICY Hotmail Compose Message Submit Data
2008238 ET POLICY Hotmail Inbox Access
2008239 ET POLICY Hotmail Message Access
2008240 ET POLICY Hotmail Compose Message Access
2008242 ET POLICY Hotmail Access Full Mode
2006408 ET POLICY HTTP Request on Unusual Port Possibly Hostile
2006409 ET POLICY HTTP POST on unusual Port Possibly Hostile
2002330 ET POLICY Google Talk TLS Client Traffic
2002332 ET POLICY Google IM traffic Windows client user sign-on
2002333 ET POLICY Google IM traffic friend invited
2002878 ET POLICY iTunes User Agent
2002722 ET POLICY MP3 File Transfer Outbound
2002723 ET POLICY MP3 File Transfer Inbound
2001114 ET POLICY Mozilla XPI install files download
2001973 ET POLICY SSH Server Banner Detected on Expected Port
2001974 ET POLICY SSH Client Banner Detected on Expected Port
2001975 ET POLICY SSHv2 Server KEX Detected on Expected Port
2001976 ET POLICY SSHv2 Client KEX Detected on Expected Port
2001977 ET POLICY SSHv2 Client New Keys detected on Expected Port
2001978 ET POLICY SSH session in progress on Expected Port
2001979 ET POLICY SSH Server Banner Detected on Unusual Port
2001980 ET POLICY SSH Client Banner Detected on Unusual Port
2001981 ET POLICY SSHv2 Server KEX Detected on Unusual Port
2001982 ET POLICY SSHv2 Client KEX Detected on Unusual Port
2001983 ET POLICY SSHv2 Client New Keys Detected on Unusual Port
2001984 ET POLICY SSH session in progress on Unusual Port
2013031 ET POLICY Python-urllib/ Suspicious User Agent
2013414 ET POLICY Executable served from Amazon S3
2014297 ET POLICY Vulnerable Java Version 1.7.x Detected
2012647 ET POLICY Dropbox.com Offsite File Backup in Use
2012648 ET POLICY Dropbox Client Broadcasting
2014313 ET POLICY Executable Download From DropBoxDONE > emerging-pop3 > ---
DONE > emerging-rbn-malvertisers > all
DONE > emerging-rbn > all
DONE > emerging-rpc > ---
DONE > emerging-scada > all
DONE > emerging-scan > all except
2002992 ET SCAN Rapid POP3 Connections - Possible Brute Force Attack
2002993 ET SCAN Rapid POP3S Connections - Possible Brute Force Attack
2002994 ET SCAN Rapid IMAP Connections - Possible Brute Force Attack
2002995 ET SCAN Rapid IMAPS Connections - Possible Brute Force AttackDONE > emerging-shellcode > all except
2011803 ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
2012252 ET SHELLCODE Common 0a0a0a0a Heap Spray String
2012257 ET SHELLCODE Common %0c%0c%0c%0c Heap Spray String
2012510 ET SHELLCODE UTF-8/16 Encoded Shellcode
2013222 ET SHELLCODE Excessive Use of HeapLib Objects Likely Malicious Heap Spray Attempt
2013267 ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 0a0a0a0aDONE > emerging-smtp > all
DONE > emerging-snmp > all
DONE > emerging-sql > all
DONE > emerging-telnet > all
DONE > emerging-tftp > all
DONE > emerging-tor > all
emerging-trojan > all except
DONE > emerging-user_agents > all except:
2010697 ET USER_AGENTS Suspicious User-Agent Beginning with digits - Likely spyware/trojanDONE > emerging-voip > all
DONE > emerging-web_client > all except
2011347 ET WEB_CLIENT Possible String.FromCharCode Javascript Obfuscation Attempt
2011507 ET WEB_CLIENT PDF With Embedded File
2010518 ET WEB_CLIENT Possible HTTP 404 XSS Attempt (External Source)
2012119 ET WEB_CLIENT Possible Hex Obfuscation Usage On Webpage
2012205 ET WEB_CLIENT Possible Malicious String.fromCharCode with charCodeAt String
2012266 ET WEB_CLIENT Hex Obfuscation of unescape % Encoding
2012272 ET WEB_CLIENT Hex Obfuscation of eval % Encoding
2012398 ET WEB_CLIENT Hex Obfuscation of replace Javascript Function % EncodingDONE > emerging-web_server > all except
2003099 ET WEB_SERVER Poison Null Byteemerging-web_specific_apps > all except:
2010890 ET WEB_SPECIFIC_APPS phpBB3 registration (Step1 GET)
2010891 ET WEB_SPECIFIC_APPS phpBB3 registration (Step2 POST)
2010892 ET WEB_SPECIFIC_APPS phpBB3 registration (Step3 GET)
2010893 ET WEB_SPECIFIC_APPS phpBB3 registration (Step4 POST)DONE > emerging-worm > all
DONE > GPLv2 community rules > all except
254 DNS SPOOF query response with TTL of 1 min. and no authority
384 PROTOCOL-ICMP PING
385 PROTOCOL-ICMP traceroute
399 PROTOCOL-ICMP Destination Unreachable Host Unreachable
402 PROTOCOL-ICMP Destination Unreachable Port Unreachable
408 PROTOCOL-ICMP Echo Reply
540 POLICY-SOCIAL Microsoft MSN message
648 INDICATOR-SHELLCODE x86 NOOP
649 INDICATOR-SHELLCODE x86 setgid 0
1200 INDICATOR-COMPROMISE Invalid URL
1201 INDICATOR-COMPROMISE 403 Forbidden
1292 INDICATOR-COMPROMISE directory listing
1390 INDICATOR-SHELLCODE x86 inc ebx NOOP
1394 INDICATOR-SHELLCODE x86 inc ecx NOOP
1437 FILE-IDENTIFY Microsoft Windows Media download detected
1841 FILE-OTHER Oracle Javascript URL host spoofing attempt
1846 POLICY-MULTIMEDIA vncviewer Java applet download attempt
1852 SERVER-WEBAPP robots.txt access
1986 POLICY-SOCIAL Microsoft MSN outbound file transfer request
1988 POLICY-SOCIAL Microsoft MSN outbound file transfer accept
1989 POLICY-SOCIAL Microsoft MSN outbound file transfer rejected
1990 POLICY-SOCIAL Microsoft MSN user search
1991 POLICY-SOCIAL Microsoft MSN login attempt
2180 PUA-P2P BitTorrent announce request
2181 PUA-P2P BitTorrent transfer
2707 FILE-IMAGE JPEG parser multipacket heap overflow
3463 SERVER-WEBAPP awstats access
25518 OS-OTHER Apple iPod User-Agent detected
25519 OS-OTHER Apple iPad User-Agent detected
25520 OS-OTHER Apple iPhone User-Agent detected
25521 OS-OTHER Android User-Agent detected
25522 OS-OTHER Nokia User-Agent detected
25523 OS-OTHER Samsung User-Agent detected
25524 OS-OTHER Kindle User-Agent detected
25525 OS-OTHER Nintendo User-Agent detected*IPS Policy - Security > all except
4152 BROWSER-PLUGINS Microsoft Windows Media Player 6.4 ActiveX object access
19436 BROWSER-IE Microsoft Internet Explorer CStyleSheetRule array memory corruption attemptSuppression List:
#GLOBALgen_id 1
suppress gen_id 1, sig_id 536
suppress gen_id 1, sig_id 648
suppress gen_id 1, sig_id 653
suppress gen_id 1, sig_id 1390
suppress gen_id 1, sig_id 2452
suppress gen_id 1, sig_id 11192
suppress gen_id 1, sig_id 15306
suppress gen_id 1, sig_id 16313
suppress gen_id 1, sig_id 17458
suppress gen_id 1, sig_id 20583
suppress gen_id 1, sig_id 23098
suppress gen_id 1, sig_id 2000334
suppress gen_id 1, sig_id 2008120
suppress gen_id 1, sig_id 2010516
suppress gen_id 1, sig_id 20122758
suppress gen_id 1, sig_id 2014518
suppress gen_id 1, sig_id 2014520
suppress gen_id 1, sig_id 2100366
suppress gen_id 1, sig_id 2100368
suppress gen_id 1, sig_id 2100651
suppress gen_id 1, sig_id 2101390
suppress gen_id 1, sig_id 2101424
suppress gen_id 1, sig_id 2102314
suppress gen_id 1, sig_id 2103134
suppress gen_id 1, sig_id 2500056
suppress gen_id 1, sig_id 100000230
suppress gen_id 3, sig_id 14772
#(http_inspect) DOUBLE DECODING ATTACK
suppress gen_id 119, sig_id 2
#(http_inspect) BARE BYTE UNICODE ENCODING
suppress gen_id 119, sig_id 4
#(http_inspect) IIS UNICODE CODEPOINT ENCODING
suppress gen_id 119, sig_id 7
#(http_inspect) NON-RFC DEFINED CHAR [**]
suppress gen_id 119, sig_id 14
#(http_inspect) UNKNOWN METHOD
suppress gen_id 119, sig_id 31
#(http_inspect) SIMPLE REQUEST
suppress gen_id 119, sig_id 32
#(http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE
suppress gen_id 120, sig_id 2
#(http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE
suppress gen_id 120, sig_id 3
#(http_inspect) HTTP RESPONSE HAS UTF CHARSET WHICH FAILED TO NORMALIZE
suppress gen_id 120, sig_id 4
#(http_inspect) HTTP RESPONSE GZIP DECOMPRESSION FAILED
suppress gen_id 120, sig_id 6
#(http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
suppress gen_id 120, sig_id 8
#(http_inspect) JAVASCRIPT OBFUSCATION LEVELS EXCEEDS 1
suppress gen_id 120, sig_id 9Unknown
suppress gen_id 120, sig_id 10
#(smtp) Attempted response buffer overflow: 1448 chars
suppress gen_id 124, sig_id 3
#(ftp_telnet) Invalid FTP Command
suppress gen_id 125, sig_id 2
#(ssp_ssl) Invalid Client HELLO after Server HELLO Detected
suppress gen_id 137, sig_id 1
#(IMAP) Unknown IMAP4 command
suppress gen_id 141, sig_id 1 -
@THS:
Hey. Thanks for this useful post.
Btw this list is 3 years old. Is it still (mostly) up to date ?Also I have a few repeating alerts I can't figure out. Can you help ?
1:2018959. ET POLICY PE EXE or DLL Windows file download HTTP
1:28039. INDICATOR-COMPROMISE Suspicious .pw dns query
119:33. (http_inspect) UNESCAPED SPACE IN HTTP URIThanks !
A few options may have had slight name changes, and I think one has been removed since it was written, but for the most part it's still good.
On your repeating alerts…
The first one looks like an alert that a .exe or .dll file is being downloaded from the internet. I can see why that would be a common one. Probably safe to suppress or disable this rule, depending on your preference, unless your users shouldn't be downloading executable binary files to their computers.
The second one looks like an alert that a potentially suspicious .pw domain is being looked up using DNS. You might want to check the host(s) that the alert is showing up for to make sure there isn't any malicious software on it/them. Of course, if your hosts regularly access systems that are legitimate in the .pw TLD, then you might want to suppress or disable this one.
The third is a rather common one regarding a space character in an HTTP URL that isn't being formatted with an escape sequence (i.e. %20), which should be done to adhere to proper specs, but sometimes isn't. This one should be safe to suppress or disable.
Edit to add: Your second alert could also be caused by a torrent client, connecting to a user in the country that uses the .pw TLD for data.
-
Hey you were right. It was because of bittorrent. It was blocking all traffic to .PW
I turned that rule off.
