Writing Snort Rules A quick guideThe life of a packet through Snort’s detection engineWriting Snort RulesMore processEven more processRule Format - basic ruleRule Format – ActionRule Format – Custom ActionsRule Format – ProtocolRule Format - IP AddressRule Format - PortRule Format - DirectionRule Format - ... Oh yeah, variablesRule Format – BodyMeta-Data keywordsPayloadComplicated Payload OptionsBroken Payload KeywordsNon-Payload options:More non-payload optionsEven more non-payload options:Even more non-payload options (again)The complicated optionsDistanceSlide 25Slide 26Slide 27WithinSlide 29Slide 30Slide 31IsdataatSlide 33Slide 34Slide 35Byte TestSlide 37Slide 38Slide 39Slide 40Slide 41Byte JumpSlide 43Slide 44Slide 45Slide 46Slide 47Slide 48Slide 49PCREPCRE FormatPCRE basic optionsPCRE options PCRE specificPCRE options Snort specificPCRE Regex metacharactersPCRE patternsmore PCRE patternsEven more PCRE patternsPCRE QuantifiersPCRE ExamplePCRE Example (regex)PCRE Example (character classes)PCRE Example (remove command)PCRE Example (remove : and ;)PCRE Example (remove evasion)PCRE Example (remove false positives)PCRE completed exampleThe required bitsA few notesWriting Snort RulesA quick guideWriting Snort RulesA quick guideBrian CaswellBrian Caswell2The life of a packet through Snort’s detection engineThe life of a packet through Snort’s detection engine3Writing Snort RulesWriting Snort Rules•Figure out what is "bad"•Capture traffic that includes the "bad stuff"•Learn the protocol•Figure out why the "bad stuff" is bad•Write a rule•Test the rule•Figure out what is "bad"•Capture traffic that includes the "bad stuff"•Learn the protocol•Figure out why the "bad stuff" is bad•Write a rule•Test the rule4More processMore process•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule5Even more processEven more process•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule•Rewrite the rule•Test the rule6Rule Format - basic ruleRule Format - basic rulealert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)7Rule Format – ActionRule Format – Actionalert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)•Tells snort what the rule does –In our product•alert pass–In snort •alert log pass activate dynamic–In snort-inline•alert log pass activate dynamic drop sdrop alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)•Tells snort what the rule does –In our product•alert pass–In snort •alert log pass activate dynamic–In snort-inline•alert log pass activate dynamic drop sdrop8Rule Format – Custom ActionsRule Format – Custom Actions•not supported in productruletype suspicious{type log outputlog_tcpdump: suspicious.log}suspicious tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)•not supported in productruletype suspicious{type log outputlog_tcpdump: suspicious.log}suspicious tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)9Rule Format – ProtocolRule Format – Protocol•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)•Tells snort to look for a specific protocol•Acceptable protocols:–TCP–UDP–ICMP–IP•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)•Tells snort to look for a specific protocol•Acceptable protocols:–TCP–UDP–ICMP–IP10Rule Format - IP AddressRule Format - IP Address•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)•Examples10.1.1.1•duh10.1.1.0/24•10.1.1.0 through 10.1.1.255!10.1.1.0/24•anything but 10.1.1.0 through 10.1.1.255[10.1.0.0/24,10.2.0.0./24]•10.1.0.0 through 10.1.0.255 or 10.2.0.0 through 10.2.0.255![10.1.0.0/24,10.2.0.0./24] •anything but 10.1.0.0 through 10.1.0.255 or 10.2.0.0 through 10.2.0.255•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)•Examples10.1.1.1•duh10.1.1.0/24•10.1.1.0 through 10.1.1.255!10.1.1.0/24•anything but 10.1.1.0 through 10.1.1.255[10.1.0.0/24,10.2.0.0./24]•10.1.0.0 through 10.1.0.255 or 10.2.0.0 through 10.2.0.255![10.1.0.0/24,10.2.0.0./24] •anything but 10.1.0.0 through 10.1.0.255 or 10.2.0.0 through 10.2.0.25511Rule Format - PortRule Format - Port•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) •Examples:any801:1023•1 through 1023 (inclusive):1023•less than or equal to 102310:•greater than or equal to 10!53•not 53!53:100•not 53 through 100 (inclusive)NOTE: NO PORT LISTS. 80,8080 IS NOT VALID!!!!•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) •Examples:any801:1023•1 through 1023 (inclusive):1023•less than or equal to 102310:•greater than or equal to 10!53•not 53!53:100•not 53 through 100 (inclusive)NOTE: NO PORT LISTS. 80,8080 IS NOT VALID!!!!12Rule Format - DirectionRule Format - Direction•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)->–From the first IP/Port to the second IP/Port<>•From either the first IP/Port to the second IP/PortOR•From either the first IP/Port to the second IP/Port•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";)->–From the first IP/Port to the second IP/Port<>•From either the first IP/Port to the second IP/PortOR•From either the first IP/Port to the second IP/Port13Rule Format - ... Oh yeah, variablesRule Format - ... Oh yeah, variablesvar EXTERNAL_NET anyvar HTTP_PORTS 80var SMTP_SERVERS 10.1.1.1alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS $HTTP_PORTSvar EXTERNAL_NET anyvar HTTP_PORTS 80var SMTP_SERVERS 10.1.1.1alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS $HTTP_PORTS14Rule Format – BodyRule Format – Body•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) •meat of the detection capabilities•key value pairs (key:value;)•types of keywords•meta-data•Payload•non-payload•post-detection•alert tcp 10.1.1.1 any -> 10.1.1.2 80 (msg:"foo"; content:"bar";) •meat of the detection capabilities•key value pairs (key:value;)•types of