3

Is there a way to trigger alarms in an Intrusion Detection System with something similar to the EICAR test virus? Maybe some special packet that is harmless to the environement, but will trigger IDS?

I am asking this in the context of a SE rogue device dropping senario, where the device trys different tunneling protocols to get out of the network. If a tunnel is established it would send this test packet to give the security infrastructre another chance to block the connection.

  • 2
    You could build your own sig and then test for that. Otherwise something like testmyids.com is easy to do. – CtrlDot Mar 18 '14 at 17:39
  • Attempting to block tunnels eventually devolves into whitelisting. – Jeff K Feb 24 '17 at 19:07
3

I'm not aware of any official product similar to EICAR but I'd suggest that something noisy and easily noticeable as invalid, such as a Christmas tree scan should achieve what you're looking for.

An IDS if configured to notice/block port scans should definitely notice something like that which uses a packet type which should never (AFAIK) be valid traffic.

  • Hi, thank you for the response. The Christmas Tree scan should do the trick. – David Mar 18 '14 at 9:28
4

The world is your oyster with this one. If you simply need to create one alert use a packet crafting tool like scapy. Testing a rule like this in snort is easy, however, this can work for all types of rules.

alert tcp any any -> any 80 (content:"GET";)

From here, just fire up scapy and at the console type:

send(IP(src="X.X.X.X",dst="X.X.X.X")/TCP(dport=80)/"GET")

Remember you would need to add the appropriate IP addresses to ensure the packet passes by your sensor. The complexity of the rule you want to test(trigger) is only limited by your skill in scapy which is super easy to learn.

  • 1
    +1 Creating your own rule and your own EICAR is a good suggestion. I would be careful with creating overly broad rules. On a busy network you might end up logging a million alerts into your database. – u2702 Mar 19 '14 at 22:04
  • absolutely on board with very broad rules, something like that could overwhelm your logging servers quickly. This solution is of course a simple example, the real version would be much more specific and tested at the appropriate time or on a a test network. – dc5553 Apr 11 '14 at 11:11
2

Test My IDS has the output of the Unix `id' command, when run as root. It should alarm an IDS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.