I activated the bleeding malware malware rules and discovered, to no one's
surprise, that
some of my users were "infested". However, almost alll of the bleeding
malware rules
fall under the classification "trojan activity", which is the highest
severity.
I agree that cool web search and other nasties belong in the severity
classification. However, other "less destructive" malwares, such as weather
bug, also, by default, belong to that classification.
I did some googling to find out how Snort classifies and prioritizes rules
and found (duh!)
that the snort manual was the best resource. I actually read the manual and
found
that Snort allows priority tags of 1-10 but the classification.config file
actually uses priority levels
classifications of 1-4 ( 1= most severe; 4=least severe, not actually used).
Therefore,
the worst stuff ends up priority 1 and "informational" stuff as priority 3.
I emailed Matt off-list, asking him if he would consider adding a "priority"
tag
to the bleeding malware rules, which would lower the priority for some of
the malware alerts
(for example, weatherbug to 2). This would allow admins to target the
really nasty
malwares (and other attacks) first, then move onto the "less
destructive"ones.
We considered other alternatives, such as adding a
"bleeding-classification.config"
file but were concerned with breaking snort front-ends and reporting
programs,
and therefore believe that adding a priority tag would make the most sense.
The following is what we agreed on. Please email us with comments/questions:
-Please use a priority tag when submitting a new bleeding-malware rule.
Please
use a default level of "2" if the malware does not meet the "cool web
search" standard.
If a new rule does not contain an explicit priority tag, Matt will add the
default level of "2".
[Sorry to give you more work, Matt ;) ]
-All existing malware rules will be assigned an explicity priority tag, with
"2" as the default.
I will be going through the bleeding malware rules and will try to correlate
them
with objective rating attempts (Pest Patrol, Symantec) which rate malware
in terms of destructiveness,
difficulty to remove, or "crud" level (number of registry entries). We
agreed that the worst offenders
(such as CWS) should be given a priority tag of 1 and the rest will stay at
2.
-Please email me if you believe a malware rule or group of rules should be
given a priority of "1".
Again, comments are appreciated.
Thanks in advance
David Glosser
david_glosser@yahoo.com
PS In closing, I want to thank Matt for his hard work in hosting and
administering the bleedingsnort sigs.
