1

I am trying to troubleshoot a bunch of flowbits generated by pulledpork from snortrules-snapshot-2990.tar.gz.

WARNING: flowbits key 'file.pdf' is set but not ever checked.

The line in the generated rules files by pulledpork reads:

alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF pdf file sent via email"; flow:to_server,established; content:"JVBERi0x"; flowbits:set,email.pdf; flowbits:noalert; metadata:service smtp; classtype:policy-violation; sid:15361; rev:5;)

I am trying to fix it by reverting the direction flow and setting the isset bit, but I doubt it works. I don't understand what the preceding line means:

alert tcp $SMTP_SERVERS 25 -> $EXTERNAL_NET any (msg:"FILE-PDF pdf file sent via email"; flow:from_server,established; content:"JVBERi0x"; flowbits:isset,email.pdf; flowbits:noalert; metadata:service smtp; classtype:policy-violation; sid:15361; rev:5;)

There are many instances from $EXTERNAL_NET any -> $SMTP_SERVERS 25 in the rules file that tracks various file attachments that generate flowbits warnings

I don't have any $SMTP_SERVERS in my internal network specified in snort.conf for protection. Do I need to turn off these warnings

Please shed some light on what the first rule means and how to turn off the error.

2

If you don't set specific ip to $SMTP_SERVERS in the snort.conf, that variable is any. And flowbits works in pairs. For example,

alert tcp any any -> any any (content:"aaa"; flowbits:set, NAMED; flowbits:noalert;) <- session tracking only without alert

alert tcp any any -> any any (content:"bbb"; flowbits:isset, NAMED;) <- check pattern 'bbb' in NAMED session

Refer to http://blog.snort.org/2011/05/resolving-flowbit-dependancies.html

  • The rule in question detects an incoming connection from a mail client to port 25 of your smtp server and checks the pdf file attachment. – discovering_security Apr 18 '17 at 7:37
  • The rule I posted detects an external connection from a mail client to port 25 of an internal smtp server and pdf attachments. There is NO reverse rule for it unless it is a rule detecting an internal browser fetching a malicious pdf from external net. So can I safely ignore it. – discovering_security Apr 18 '17 at 7:46
  • If you think that rules are unnecessary, ignore through # comment.:) – Mr.kang Apr 18 '17 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.