Benjamin J Paradis <paradis.b@neu.edu> writes:
Hi All,
I've been trying to put together a rule in the snort.conf file to
address portscans. For instance, if there is x amount of machines hit
in y amount of minutes on port 445, snort will indicate that port 445
is getting hit so many times. This is a snippet of what I have so far:
------------------------snippet-------------------------------
##preporcessor portscan: $HOME_NET 5 7 /var/log/portscan.log
##preprocessor portscan-ignorehosts: x.x.x.x y.y.y.y etc.
preprocessor portscan: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60
------------------------/snippet--------------------------------
Is there anything I'm missing here?
Not really a sig as such, but I'm piping portscan.log into the
following script - rotating portscan.log daily - to get my alerts
about Welchia, Sasser, Blaster, RxBot scans, etc. You might need to
tune the >1000 for your site, but it seems to pick stuff up quite well
here. (I know, I know - it's ugly, but it works.)
#!/usr/bin/perl
$foo=`rm -rf /tmp/*.virus`;
use Socket;
$f=time();
while ($line=<STDIN>) {
$line=~s/ / /g;
($mnth,$dt,$time,$ip,$ar,$dst,$etc) = split (m/ /,$line);
($ip,$port)=split(m/:/,$ip);
($dstip,$dstp)=split(m/:/,$dst);
if ($dstp == 445 || $dstp == 135 || $dstp==139)
{
$att{$ip}++;
if ($att{$ip}>1000) {
$file="/tmp/$ip.virus";
if (! -e $file) {
$foo=`touch $file`;
#page or email yourself here - 'Subject: possible virus on $ip'
}
}
}
$g=time()-$f;
if ($g>(24*3599))
{
exit(0);
}
}
--
James Riden / j.riden@massey.ac.nz / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
