Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Finding SRC IP on Snort (CnC)

    Scheduled Pinned Locked Moved
    IDS/IPS
    2
    2
    1.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wifiuk
      last edited by

      I'm getting this alert every few times a day

      [1:2404324:4427] ET CNC Feodo Tracker Reported CnC Server TCP group 13 [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} MY-WAN-IP-HERE:14121 -> 213.230.210.230:443

      I have snort enabled on WAN and LAN

      WAN is block
      LAN is alert

      All rules are enabled on both, with some suppressed to suit my network.

      But i can't find the source ip that is causing the outbound connection, it only show the WAN.

      My SIEM is picking up this from the logs forwarded to it from PfSense

      Nov 13 09:48:51 LOCAL-GATEWAY-IP-HERE snort[5096]: [1:2404324:4427] ET CNC Feodo Tracker Reported CnC Server TCP group 13 [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} MY_WAN_ADDRESS_HERE:35518 -> 213.2 30.210.230:443

      I can't anywhere find the source, can someone advise why the snort on the lan isnt picking this up?

      1 Reply Last reply Reply Quote 0
      • I
        Impatient
        last edited by

        The source on mine was the yoyo adserver list I had enabled in pfblockerNG package.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post