Questions tagged [suricata]
The suricata tag has no usage guidance.
10
questions
0
votes
0answers
47 views
Network Worm Sending HTTPS Passwords in POST Requests
So there are a lot of details to this but let's just say that I'm convinced I'm being actively monitored by advanced hackers. It started when I was posting about time travelers on internet security ...
0
votes
1answer
77 views
Suricata Ripple20 rule for IP-in-IP resulting in 100M alerts
I found too many events in Suricata after recent update regarding this rule:
alert ip any any -> any any (msg:"ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"; ip_proto:4; ...
1
vote
1answer
68 views
Suricata and rules based on MAC address
I'm working on a project to implement SDN in a network. One of my flows is redirecting to the Suricata IDS and the flow works in layer 2 with MAC address.
Since I've read that Snort only works in ...
0
votes
1answer
135 views
Suricata bypass keyword
I have not found any examples on using the 'bypass' keyword.
Does it work in any rule? Are there performance implications using 'bypass'.
For example, would this bypass all tcp traffic?
alert tcp any ...
0
votes
1answer
60 views
Suricata not matching a packet
What happens to a packet that has no matching rule in Suricata. I assume it is ignored, but haven't found any definitive info on this.
So, if my assumption is correct and the packet is ignored, would ...
1
vote
1answer
352 views
Custom Suricata's HTTP alert isn't triggered when using “..” as part of the scanned uri. Why? [closed]
I have a doubt with a Suricata custom rule.
If I do: alert http any any -> any 80 (msg:"blabla"; content:"abc"; http_uri; sid:1000000;) I can get requests to http://x.x.x.x/abc uri in fast.log ...
0
votes
1answer
496 views
Loopback with Suricata
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
510 views
Analyzing Apache log with Snort
I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
0
votes
1answer
574 views
Virustotal detecting threats in Suricata rule set
Virustotal scans are detecting threats from the Suricata default rule pack located https://rules.emergingthreats.net/open/suricata-4.0/
Is this a false positive?
https://www.virustotal.com/#/file/...
4
votes
0answers
552 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
