Snort Exercises

Question

I am beginning to study Snort rules and the teacher give to us the next exercises:

A server on which Snort is installed is monitoring all traffic on subnet 172.16.0.0 with mask 255.255.0.0. From now on we are going to refer to this subnet as subnet_A. The student must write the Snort rules that allow registering the following events:

1. Enter a rule that attempts to search for the word "HTTP" between characters 4 and 40 of the data part of any TCP packet originating in subnet_A and going to an address that is not part of sub_A. In the log file, the record must contain the message "HTTP Detected".

2. Create two rules to detect when someone is trying to access a machine located in subnet_A whose IP address is 172.16.1.3 to port 137 and both UDP and TCP protocols. When the indicated pattern is detected, the rule should send an alert with the message "Attempt to access port 137 and protocol ".

3. It configures a single Snort rule that allows capturing the passwords used (PASS command) when connecting to file transfer services (FTP) or mail query (POP3) from the machine with IP address 172.16.1.3 located in subnet_A. When the indicated pattern is detected, the rule should launch an alert with the message "Password detected".

These are my answers:

1.- alert tcp 172.16.0.0/16 any -> ![ 172.16.0.0/16] any \
(logto:logto_log.txt; content:"HTTP"; offset: 4; depth: 40; msg: "HTTP Detected";)

2.- alert tcp any any -> 172.16.1.3 137 \
(msg: "Attempt to access port 137 and protocol TCP";)

alert udp any any -> 172.16.1.3 137 \
(msg: "Attempt to access port 137 and protocol UDP";)

3.- alert tcp 172.16.1.3 any -> any 110,995,20:21   \
(msg:"Password Detected"; content:"PASS";)

Would you agree with me?

Answer 1

First 3 look good to me. I believe the 3rd needs to have the list of port numbers in square brackets. Check sid 2018383 in the link below to see an example.

https://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-current_events.rules

Also for the 3rd, you might want to set a depth and offset so that any page with the content "PASS" (like this page) doesn't trigger a false positive.

Answer 2

I am also doing the same task and my answers are almost the same. From what I found in my brief research, when detailing the ports, you cannot list them. You either mark one or a range, with ":" to bridge them, so if you need to apply the ports for POP3 and FTP, I used 20:995.