Suricata/Regeln/Syntax: Unterschied zwischen den Versionen
| Zeile 302: | Zeile 302: | ||
Note that there are some exceptions, e.g. the <tt>http_raw_uri</tt> keyword. See [https://suricata.readthedocs.io/en/suricata-6.0.0/rules/http-keywords.html#rules-http-uri-normalization http.uri and http.uri.raw] for more information. | Note that there are some exceptions, e.g. the <tt>http_raw_uri</tt> keyword. See [https://suricata.readthedocs.io/en/suricata-6.0.0/rules/http-keywords.html#rules-http-uri-normalization http.uri and http.uri.raw] for more information. | ||
[[Kategorie:Suricata]] | [[Kategorie:Suricata]] | ||
Version vom 18. März 2023, 22:05 Uhr
Suricata Signaturen - lesen, anpassen, erstellen
Beschreibung
Aufbau
Bestandteile einer Regel/Signatur
| Option | Beschreibung |
|---|---|
| Aktion | was passieren soll, wenn Signatur passt |
| Header | Protokoll, IP-Adressen, Ports, Richtung |
| Regeloptionen | Besonderheiten der Regel |
- Beispiel
Signatur 2008124 aus der Datenbank von Emerging Threats
- drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "ET TROJAN Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; flowbits:isset,is_proto_irc; content: "NICK "; pcre:"/NICK . *USA.*[0-9]{3,}/i"; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)
Aktion
- drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "ET TROJAN Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; flowbits:isset,is_proto_irc; content: "NICK "; pcre:"/NICK . *USA.*[0-9]{3,}/i"; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)
- Aktionen
| Aktion | Beschreibung |
|---|---|
| alert | Warnung |
| pass | Stoppt die weitere Untersuchung |
| drop | Verwerfen und Warnung erzeugen |
| reject | Sendet RST/ICMP unreach error an den Absender des passenden Pakets |
| rejectsrc | wie reject |
| rejectdst | Sendet ein RST/ICMP-Fehler-Paket an den Empfänger des passenden Pakets |
| rejectboth | Sendet RST/ICMP-Fehlerpakete an beide Seiten der Konversation |
- Hinweis
- Im IPS-Modus aktiviert die Verwendung einer der reject-Aktionen auch drop.
- Weitere Informationen
Protokoll
- Zu untersuchendes welches Protokoll
- drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "ET TROJAN Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; flowbits:isset,is_proto_irc; content: "NICK "; pcre:"/NICK . *USA.*[0-9]{3,}/i"; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)
- Grundprotokolle
| Protokoll | Verfügbarkeit |
|---|---|
| tcp | tcp-Verkehr |
| udp | |
| icmp | |
| ip | ip steht für 'all' oder 'any' |
- Anwendungsprotokolle
Die Verfügbarkeit dieser Protokolle hängt davon ab, ob das Protokoll in der Konfigurationsdatei suricata.yaml aktiviert ist
| Protokoll | Verfügbarkeit |
|---|---|
| http | |
| ftp | |
| tls/ssl | |
| smb | |
| dns | |
| dcerpc | |
| ssh | |
| smtp | |
| imap | |
| modbus | deaktiviert |
| dnp3 | deaktiviert |
| enip | deaktiviert |
| nfs | |
| ikev2 | |
| krb5 | |
| ntp | |
| dhcp | |
| rfb | |
| rdp | |
| snmp | |
| tftp | |
| sip | |
| http2 |
Quelle und Ziel
- drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "ET TROJAN Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; flowbits:isset,is_proto_irc; content: "NICK "; pcre:"/NICK . *USA.*[0-9]{3,}/i"; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)
- Der erste hervorgehobene Teil ist die Quelle
- der zweite das Ziel
- beachten Sie die Richtung des Richtungspfeils
Mit Quelle und Ziel geben Sie die Quelle des Datenverkehrs bzw. das Ziel des Datenverkehrs an.
Sie können IP-Adressen (sowohl IPv4 als auch IPv6 werden unterstützt) und IP-Bereiche zuweisen.
Diese können mit Operatoren kombiniert werden:
| Operator | Beschreibung |
|---|---|
| ../.. | IP ranges (CIDR notation) |
| ! | exception/negation |
| [.., ..] | grouping |
Normalerweise würden Sie auch Variablen verwenden, wie z.B.
$HOME_NET and $EXTERNAL_NET
Die Konfigurationsdatei gibt die IP-Adressen an, die diese betreffen, und diese Einstellungen werden anstelle der Variablen in Ihren Regeln verwendet. Siehe Rule-vars für weitere Informationen.
- Beispiel
| Example | Meaning |
|---|---|
| ! 1.1.1.1 | Every IP address but 1.1.1.1 |
| ![1.1.1.1, 1.1.1.2] | Every IP address but 1.1.1.1 and 1.1.1.2 |
| $HOME_NET | Your setting of HOME_NET in yaml |
| [$EXTERNAL_NET, !$HOME_NET] | EXTERNAL_NET and not HOME_NET |
| [10.0.0.0/24, !10.0.0.5] | 10.0.0.0/24 except for 10.0.0.5 |
| […, [….]] | |
| […, ![…..]]
Normally, you would also make use of variables, such as . The configuration file specifies the IP addresses these concern, and these settings will be used in place of the variables in you rules. See Rule-vars for more information.
|
- Warning
- If you set your configuration to something like this:
HOME_NET: any EXTERNAL_NET: ! $HOME_NET
You can not write a signature using $EXTERNAL_NET because it stands for ‘not any’. This is an invalid setting.
Ports (source and destination)
- drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "ET TROJAN Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; flowbits:isset,is_proto_irc; content: "NICK "; pcre:"/NICK . *USA.*[0-9]{3,}/i"; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)
The first emphasized part is the source, the second is the destination (note the direction of the directional arrow).
Traffic comes in and goes out through ports. Different ports have different port numbers. For example, the default port for HTTP is 80 while 443 is typically the port for HTTPS. Note, however, that the port does not dictate which protocol is used in the communication. Rather, it determines which application is receiving the data.
The ports mentioned above are typically the destination ports. Source ports, i.e. the application that sent the packet, typically get assigned a random port by the operating system. When writing a rule for your own HTTP service, you would typically write any -> 80, since that would mean any packet from any source port to your HTTP application (running on port 80) is matched.
In setting ports you can make use of special operators as well, like described above.
Signs like:
| Operator | Description |
|---|---|
| : | port ranges |
| ! | exception/negation |
| [.., ..] | grouping |
- Example
| Example | Meaning |
|---|---|
| [80, 81, 82] | port 80, 81 and 82 |
| [80: 82] | Range from 80 till 82 |
| [1024: ] | From 1024 till the highest port-number |
| !80 | Every port but 80 |
| [80:100,!99] | Range from 80 till 100 but 99 excluded |
| [1:80,![2,4]] | Range from 1-80, except ports 2 and 4 |
| [.., [..,..]] |
Direction
- drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "ET TROJAN Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; flowbits:isset,is_proto_irc; content: "NICK "; pcre:"/NICK . *USA.*[0-9]{3,}/i"; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)
The direction tells in which way the signature has to match. Nearly every signature has an arrow to the right (->). This means that only packets with the same direction can match. However, it is also possible to have a rule match both ways (<>):
source -> destination source <> destination (both directions)
- Warning
- There is no ‘reverse’ style direction, i.e. there is no <-.
The following example illustrates this. Say, there is a client with IP address 1.2.3.4 and port 1024, and a server with IP address 5.6.7.8, listening on port 80 (typically HTTP). The client sends a message to the server, and the server replies with its answer.
Now, let’s say we have a rule with the following header:
alert tcp 1.2.3.4 1024 -> 5.6.7.8 80
Only the first packet will be matched by this rule, as the direction specifies that we do not match on the response packet.
Rule options
The rest of the rule consists of options. These are enclosed by parenthesis and separated by semicolons. Some options have settings (such as msg), which are specified by the keyword of the option, followed by a colon, followed by the settings. Others have no settings, and are simply the keyword (such as nocase):
<keyword>: <settings>; <keyword>;
Rule options have a specific ordering and changing their order would change the meaning of the rule.
- Note
- The characters ; and " have special meaning in the Suricata rule language and must be escaped when used in a rule option value.
- Example
msg:"Message with semicolon\;";
As a consequence, you must also escape the backslash, as it functions as an escape character.
The rest of this chapter in the documentation documents the use of the various keywords.
Some generic details about keywords follow.
Modifier Keywords
Some keywords function act as modifiers. There are two types of modifiers.
- The older style ‘content modifiers’ look back in the rule, e.g.:
alert http any any -> any any (content:"index.php"; http_uri; sid:1;)
In the above example the pattern ‘index.php’ is modified to inspect the HTTP uri buffer. - The more recent type is called the ‘sticky buffer’. It places the buffer name first and all keywords following it apply to that buffer, for instance:
alert http any any -> any any (http_response_line; content:"403 Forbidden"; sid:1;)
In the above example the pattern ‘403 Forbidden’ is inspected against the HTTP response line because it follows the http_response_line keyword.
Normalized Buffers
A packet consists of raw data. HTTP and reassembly make a copy of those kinds of packets data. They erase anomalous content, combine packets etcetera. What remains is a called the ‘normalized buffer’:
"../_images/normalization1.png"
Because the data is being normalized, it is not what it used to be; it is an interpretation. Normalized buffers are: all HTTP-keywords, reassembled streams, TLS-, SSL-, SSH-, FTP- and dcerpc-buffers.
Note that there are some exceptions, e.g. the http_raw_uri keyword. See http.uri and http.uri.raw for more information.