Is there a Snort rule that equates to “something suspicious flagged from a client side application?”

Question

The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?

Answer 1

Snort looks at network activity, so it would have to be something that the client-side app sends over the network. At that point, you would need to look at the messages that the client sends out, which could be grabbed by Snort. Pre-defined? No, there are too many client-side apps to catch them all.

Snort rule template:

alert tcp any any -> any 80 (msg: "Client Unhappy";content:"Client unhappy text";nocase;)

This rule is pretty basic, but it's the place to start. To reduce false positives, you would also want to look at the ports the client and server use to communicate messages and refine your rules to look there.

Here is a SANS guide on how to look for certain text, and refinements.