3

Is there a way to trigger alarms in an Intrusion Detection System with something similar to the EICAR test virus? Maybe some special packet that is harmless to the environement, but will trigger IDS?

I am asking this in the context of a SE rogue device dropping senario, where the device trys different tunneling protocols to get out of the network. If a tunnel is established it would send this test packet to give the security infrastructre another chance to block the connection.

Improve this question
2
  • 2
    You could build your own sig and then test for that. Otherwise something like testmyids.com is easy to do.
    – CtrlDot
    Commented Mar 18, 2014 at 17:39
  • Attempting to block tunnels eventually devolves into whitelisting.
    – Jeff K
    Commented Feb 24, 2017 at 19:07

3 Answers 3

Reset to default
3

I'm not aware of any official product similar to EICAR but I'd suggest that something noisy and easily noticeable as invalid, such as a Christmas tree scan should achieve what you're looking for.

An IDS if configured to notice/block port scans should definitely notice something like that which uses a packet type which should never (AFAIK) be valid traffic.

Improve this answer
1
  • Hi, thank you for the response. The Christmas Tree scan should do the trick.
    – David
    Commented Mar 18, 2014 at 9:28
4

The world is your oyster with this one. If you simply need to create one alert use a packet crafting tool like scapy. Testing a rule like this in snort is easy, however, this can work for all types of rules.

alert tcp any any -> any 80 (content:"GET";)

From here, just fire up scapy and at the console type:

send(IP(src="X.X.X.X",dst="X.X.X.X")/TCP(dport=80)/"GET")

Remember you would need to add the appropriate IP addresses to ensure the packet passes by your sensor. The complexity of the rule you want to test(trigger) is only limited by your skill in scapy which is super easy to learn.

Improve this answer
2
  • 1
    +1 Creating your own rule and your own EICAR is a good suggestion. I would be careful with creating overly broad rules. On a busy network you might end up logging a million alerts into your database.
    – u2702
    Commented Mar 19, 2014 at 22:04
  • absolutely on board with very broad rules, something like that could overwhelm your logging servers quickly. This solution is of course a simple example, the real version would be much more specific and tested at the appropriate time or on a a test network.
    – dc5553
    Commented Apr 11, 2014 at 11:11
2

Test My IDS has the output of the Unix `id' command, when run as root. It should alarm an IDS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .