"Jamie Riden" wrote:
<snip>
The cat%20 rule was causing me too many false positives (including
this message I expect :). Instead of turning it off, what about
combining as follows:
alert tcp any any -> any any (msg:"WEB-ATTACKS web command attempt";
flow:to_server,established; uricontent:"\.php?";
pcre:"/\b(wget|curl|cc|chgrp|kill|chown\
|echo|rm|lsof|ls|perl|ping|netcat|cat|nc|nmap|gcc|g\+\+|traceroute|ftp|tftp)[
\t]/U"; classtype:web-application-activity; sid:2123156; rev:1;)
uricontent is not a regex so do not escape dots.
Any problems with this? Hopefully it should catch people trying to
exploit the vulnerable PHP script du jour. ( Every time a new remote
include, or command injection problem comes out (e.g. Horde issue last
week), someone sees if they can 'wget' their favourite rootkit.)
Well, the issue is that the rule focuses on a limited number of attack
vectors, not on the vulnerability itself. This means that an attacker
might resort to a different command. As an example, you have perl but
not sed or awk. I am not dismissing the rule but it is important to
understand that it is not a silver bullet. If you instead focus on the
vulnerability then it does not matter what commands the attacker uses.
Of course the counter-argument is that this rule (somewhat) works in
zero-day scenarios while vulnerability rules mostly do not work at all.
I personally use both approaches but with an emphasis on the
vulnerability.
Is it more efficient to create more rules with uricontent:"\.pl" ,
"\.cgi" , or is it better to match both, and .cgi in the pcre as well?
That very much depends on your particular deployment. As an example, if
your only asset is a 100% PHP web site then uricontent:".php?" does not
buy you anything. Take a look at past postings; Sourcefire folks here
and there provide valuable snippets of wisdom on rule performance tuning.
cheers,
Jamie
Cheers,
nnposter
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
