1

I am diving into snort and trying to figure out what everything does but I'm having a little trouble. I have a .pcap file I want to analyse and I know there is malicious c&c traffic on it. (Practice exercise for an online course)

The goal of the exercise is to write a snort rule(s) that is not restricted by IP address or port number (source or destination) to detect the c&c traffic.

What should I be looking for in the .pcap file to base my rules off of? (if possible please provide plenty of details in this area) Are there any specific options I should almost always include in my snort rule and why? I also want to try to mitigate false positives as well because the file is rather large and there are only a handful of malicious connections in it.

  • Can you post the pcap? – MikeSchem Mar 6 at 22:37
2

Step #1 is to identify and isolate the malicious traffic in the pcap. I assume you're using Wireshark to do this?

Step #2 Look at the isolated malicious stream and try to identify unique patterns. This could be unusual header sequences, words or strings, or query response sequences.

Step #3 Create your signature for Snort from the identified patterns. It could be a single contiguous hex pattern, or a more complex set of multiple dispersed patterns that must all exist and/or be within designated distances from each other.

The more complex the signature the less likely there will be false positives, too complex and it might be overly specific to your sample and you get false negatives.

0

Basically for static PCAP file you can develop the pattern and if you replay later this signature will be triggered. But, since its a C2C traffic, in real time this will change often and with the static pattern (Basically NIDS) is not a good solution to identify and prevent the C2C traffic. With DGA (Domain Generation Algorithm) its very difficult to come up with the good pattern.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.