I think this is a personal or site preference whether you want to track
by source or destination. The logic of tracking by source is that if
you have an attacker attempting multiple logins to one or more hosts in
a short period of time, the alert should fire.
If you track by destination, you run the slight risk of having the alert
go off if multiple users have failed logins within a short amount of time.
Frankly, it would be nice if we could track by the same
source/destination and that would settle the whole matter.
Judy
nnposter wrote:
Rule: NETBIOS SMB repeated logon failure
Rule: NETBIOS SMB-DS repeated logon failure
--
Sid: 2923, 2924
--
Rules 2923.1 and 2924.1 are monitoring failed login server responses
so it seems to me that they should be thresholding on destination, not
source:
alert tcp $HOME_NET 139 -> $EXTERNAL_NET any
(msg:"NETBIOS SMB repeated logon failure";
flow:from_server,established;
content:"|ff|SMB"; offset:4; depth:4;
content:"|73|"; distance:0; within:1;
content:"|6d0000c0|"; distance:0; within:4;
threshold:type threshold,track by_dst,count 10,seconds 60;
classtype:unsuccessful-user; sid:2923; rev:2;)
alert tcp $HOME_NET 445 -> $EXTERNAL_NET any
(msg:"NETBIOS SMB-DS repeated logon failure";
flow:from_server,established;
content:"|ff|SMB"; offset:4; depth:4;
content:"|73|"; distance:0; within:1;
content:"|6d0000c0|"; distance:0; within:4;
threshold:type threshold,track by_dst,count 10,seconds 60;
classtype:unsuccessful-user; sid:2924; rev:2;)
Or is the intent of these two rules to track distributed cracking?
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
