I am beginning to study Snort rules and the teacher give to us the next exercises:
A server on which Snort is installed is monitoring all traffic on subnet 172.16.0.0 with mask 255.255.0.0. From now on we are going to refer to this subnet as subnet_A. The student must write the Snort rules that allow registering the following events:
Enter a rule that attempts to search for the word "HTTP" between characters 4 and 40 of the data part of any TCP packet originating in subnet_A and going to an address that is not part of sub_A. In the log file, the record must contain the message "HTTP Detected".
Create two rules to detect when someone is trying to access a machine located in subnet_A whose IP address is 172.16.1.3 to port 137 and both UDP and TCP protocols. When the indicated pattern is detected, the rule should send an alert with the message "Attempt to access port 137 and protocol ".
It configures a single Snort rule that allows capturing the passwords used (PASS command) when connecting to file transfer services (FTP) or mail query (POP3) from the machine with IP address 172.16.1.3 located in subnet_A. When the indicated pattern is detected, the rule should launch an alert with the message "Password detected".
These are my answers:
1.- alert tcp 172.16.0.0/16 any -> ![ 172.16.0.0/16] any \ (logto:logto_log.txt; content:"HTTP"; offset: 4; depth: 40; msg: "HTTP Detected";) 2.- alert tcp any any -> 172.16.1.3 137 \ (msg: "Attempt to access port 137 and protocol TCP";) alert udp any any -> 172.16.1.3 137 \ (msg: "Attempt to access port 137 and protocol UDP";) 3.- alert tcp 172.16.1.3 any -> any 110,995,20:21 \ (msg:"Password Detected"; content:"PASS";)
Would you agree with me?