0

I'm quite new to Snort, Could anyone explain these two rules? Specifically, why do they contain more than one "content" field ?

alert tcp $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET TROJAN Reply Sinkhole - irc-sinkhole.cert.pl"; 
flow:established,from_server; 
content:"|3a|irc|2d|sinkhole|2e|cert|2e|pl"; 
nocase; 
fast_pattern:only; 
content:"|3a|End of MOTD command|2e|"; 
classtype:trojan-activity; 
sid:2019354; 
rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
msg:"ET MALWARE Adware.iBryte.B Install"; 
flow:to_server,established; 
content:"/impression.do/?"; 
http_uri; 
fast_pattern:only; 
content:"user_id="; 
http_uri; 
content:"event="; 
http_uri; 
content:"source="; 
http_uri; 
reference:md5,1497c33eede2a81627c097aad762817f; 
classtype:trojan-activity; 
sid:2018194; 
rev:4;)
4
  • Have you read the documentation on how snort rules work?
    – schroeder
    Commented Oct 7, 2015 at 19:59
  • Yes, but I don't understand how snort processes multiple content field, and what's the goals of the rules
    – CDominik
    Commented Oct 7, 2015 at 20:06
  • manual.snort.org/node32.html section 3.5.1
    – schroeder
    Commented Oct 7, 2015 at 20:18
  • The goal is to alert when it finds these patterns - can you narrow down your question?
    – schroeder
    Commented Oct 7, 2015 at 20:21

1 Answer 1

2

Specifically, why do they contain more than one "content" field ?

If you have multiple content fields, snort tries to match the first content field followed by the seconds field, etc in a recursive way. I took a modified example from here:

alert ip any any -> any any (content:"a"; content:"b";)

This rule would look for a, once that matched it then look for b. If successfully matched, it trigger the alert.

fast_pattern:only

As specified in the snort manual, it is a content rule modifier. Which means it applies to the previous content keyword. Once snort find a match for the content that follow with fast_pattern, it then starts to evaluate the rules (e.g. match other content keywords). To put it simply, The idea of fast_pattern is to speed up the processing without looking to match all content fields in the rule.

|3a|irc|2d|sinkhole|2e|cert|2e|pl in your first rule is used for fast pattern matching, once match is successful, snort looks for |3a|End of MOTD command|2e|. If fast pattern match fails, snort skips the rule.

/impression.do/? in your second rule is used for fast pattern matching, once match is successful, snort looks for user_id=, immediately followed by event= and immediately followed by source=. If fast pattern matching fails, snort skips the rule.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .