Create a snort rule that will alert on traffic on ports 443 & 447

Question

Using the learning platform, the subject is Snort rules.

Question is:

Create a snort rule that will alert on traffic with destination ports 443 and 447.

My attempts:

alert tcp any any -> any 443 447 ( msg:"Sample alert";  sid:1; rev:1; )
alert tcp udp any any -> any 443 447 ( msg:"Sample alert"; sid:1; rev:1; )

My answer is wrong and I can't see why. Any pointers would be very much appreciated.

Answer 1

I had to solve this exact case for Immersive Labs! This is the rule you are looking for:

alert tcp any any -> any [443,447] ( msg:"Sample alert"; sid:1000001; rev:1; )

Also, I noticed your sid:1. All sid up to 1,000,000 are reserved. So your sid must be at least 1000001.

Note: there must not be any spaces in between each port in the list.

Answer 2

I'm not familiar with snort. However, the snort documentation gives this example:

alert tcp any any -> 192.168.1.1 80 ( msg:"A ha!"; content:"attack"; sid:1; )

The structure is:

action proto source dir dest ( body )

It also states, that:

source - specifies the sending IP address and port, either of which can be the keyword any, which is a wildcard.

dir - must be either unidirectional as above or bidirectional indicated by <>.

dest - similar to source but indicates the receiving end.

There is no indication made, that you can match multiple ports at once. I'd therefore try the following rules:

alert tcp any any -> any 443 ( msg:"Sample alert 443"; sid:1; rev:1; )

alert tcp any any -> any 447 ( msg:"Sample alert 447"; sid:2; rev:1; )

Edit: If your question was how to achieve this in one rule, you might want to try:

alert tcp any any -> any [443,447] ( msg:"Sample alert"; sid:1; rev:1; )

You will also probably find this site useful.

Answer 3

The syntax for a Snort rule is:

action proto source_ip source_port direction destination_ip destination_port (options)

So you cannot specify tcp and udp in the same rule; you would have to make two separate rules. You also won't be able to use ip because it ignores the ports when you do.

For IP or port ranges, you can use brackets and/or colons, such as [443,447] or [443:447].

So rules would be:

alert tcp any any -> any [443,447] (msg:"Sample rule"; sid:1; rev:1)
alert udp any any -> any [443,447] (msg:"Sample rule"; sid:2; rev:1)

A note about SIDs

The Cisco Talos rules are all under 100,000. If you run those rules in conjunction with custom rules, it is recommended that you begin numbering your custom rules at 1,000,000 and up.

However, if not, you can number them whatever you would like, as long as they do not collide with one another. A common mistake is having multiple rules with the same SID (due to copy/pasting) and forgetting to change the SID and then wondering why only one rule fires: because if you specify a rule with the same SID as another, it's overwritten.