Snort false positive?

Question

I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off:

GPL SHELLCODE x86 inc ebx NOOP

The payload is as follows:

....WANG2..JFIF``..C

(1#%(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc..C//cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..&.!..   
...}!1AQa"q2...#B..R..$3br. 
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................................................................    
...w!1AQaq"2.B....  #3R.br.
$4.%.&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..........................................................................?.5mJ#M...dh.....q.=j...+/G3Y.P.@t.@#=...j..u.g...4....................iw......yq..r......ZTQ@Q@Q@
.D.6.GTD...(I5....I..b..+.ie$.)$.[8.3.@..........$..,[email protected]_k6..>...-...9.;.L.....B..x.9..y.h.5.w.'Q..>...._/v..9Q.`..{t.Z..i..}...P..I,.$....@..'G..q._G..E.*~..s..]..E...$...-.)L.N7m...=........tI..o...v.K...rrp.\mx......s..o&%..c.A.u.zP*....h.....Z..i.q
O.Q.......H....:...K.0#.##...q..9..Mo.?{..n...........{V..<Ek.y.$.Xv.cq.I.q..<t.|Mo.2[.2]_K...@A`I..9..6n.=kI.......G...,.Z..MJ..J.4.n..    RIS8.m...}I....x..M........e..D     c.s.^._.......O.st.3..$...;N....zus.;..B........J..u[b.k.`.aAU....4k..._hze....VtdV
2.......}[..d..|#kb.N#R.H
..o............E
.>?......b3yx'.'9..A..\A.......B...A#...H.D.~.go4...y.|.W(x...o.cD..."*.231..a.......u...[uxT..p....\...:..(u..1L.[...3.u...Y...>..D..NR".........=}.@..._...V.....$..N2.x..0x.5...C....sw...."(u...r..'..S..+{.=z....._&[email protected]
.g......C{....s.D.!eYA#..Bh/K.K..N...S.8.
@......B.....................9....}.l..b..VI.x...M.Oane...l{..8..6...Cq...I......7......?.a...}.....O.|1._..<u7.,/b...t.Z[.C..P..9...#...9.
...a.....6.]A...he..z.9=q...lol<..q,.om3.d...(p..=y.M.O.,.....j..5....G.M6.2/#FT`d....06d.w~5:...>....a.3(_-O..

My Question

How do you determine if this is a file transfer or actual shellcode trying to do a buffer overflow like the rule database says?

Answer 1

NOOPs are the tip-off for the snort rules. A file transfer is likely not to have NOP slides, but in this case, it might be a false positive:

WANG2..JFIF 

What you may have here is a ping from one Windows machine to another. Part of the ping payload is a jpg of the word: Microsoft.

This type of traffic has triggered other people to be suspicious, as well.

But, it would be nice to have the packet trace instead of the ASCII translation of the hex.

Answer 2

Though I don't have a complete answer for you, keep in mind that the rule on this one is just a string of "C" in ASCII or 0x43. so it's fairly inaccurate.

Snort Rule that found this was:

alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 inc ebx NOOP"; content:"CCCCCCCCCCCCCCCCCCCCCCCC"
; classtype:shellcode-detect; sid:1390; rev:5;)

Example alert file from snort:

[**] [1:1390:5] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
01/15-17:32:16.249189 192.168.2.101:3128 -> 192.168.2.103:57310
TCP TTL:64 TOS:0x0 ID:22656 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xC2797B70  Ack: 0x11FE472E  Win: 0x8B  TcpLen: 32
TCP Options (3) => NOP NOP TS: 59640418 25088619