1

I am trying to troubleshoot a bunch of flowbits generated by pulledpork from snortrules-snapshot-2990.tar.gz.

WARNING: flowbits key 'file.pdf' is set but not ever checked.

The line in the generated rules files by pulledpork reads:

alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF pdf file sent via email"; flow:to_server,established; content:"JVBERi0x"; flowbits:set,email.pdf; flowbits:noalert; metadata:service smtp; classtype:policy-violation; sid:15361; rev:5;)

I am trying to fix it by reverting the direction flow and setting the isset bit, but I doubt it works. I don't understand what the preceding line means:

alert tcp $SMTP_SERVERS 25 -> $EXTERNAL_NET any (msg:"FILE-PDF pdf file sent via email"; flow:from_server,established; content:"JVBERi0x"; flowbits:isset,email.pdf; flowbits:noalert; metadata:service smtp; classtype:policy-violation; sid:15361; rev:5;)

There are many instances from $EXTERNAL_NET any -> $SMTP_SERVERS 25 in the rules file that tracks various file attachments that generate flowbits warnings

I don't have any $SMTP_SERVERS in my internal network specified in snort.conf for protection. Do I need to turn off these warnings

Please shed some light on what the first rule means and how to turn off the error.

1 Answer 1

2

If you don't set specific ip to $SMTP_SERVERS in the snort.conf, that variable is any. And flowbits works in pairs. For example,

alert tcp any any -> any any (content:"aaa"; flowbits:set, NAMED; flowbits:noalert;) <- session tracking only without alert

alert tcp any any -> any any (content:"bbb"; flowbits:isset, NAMED;) <- check pattern 'bbb' in NAMED session

Refer to http://blog.snort.org/2011/05/resolving-flowbit-dependancies.html

3
  • The rule in question detects an incoming connection from a mail client to port 25 of your smtp server and checks the pdf file attachment. Apr 18, 2017 at 7:37
  • The rule I posted detects an external connection from a mail client to port 25 of an internal smtp server and pdf attachments. There is NO reverse rule for it unless it is a rule detecting an internal browser fetching a malicious pdf from external net. So can I safely ignore it. Apr 18, 2017 at 7:46
  • If you think that rules are unnecessary, ignore through # comment.:)
    – Mr.kang
    Apr 18, 2017 at 12:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .