[Snort-sigs] Reducing FPs by linking attacks to service versions
matt at ...2436...
Sat Dec 4 07:02:01 EST 2004
>I have just been playing with flowbits, and am wondering if there would be adverse effects to linking rules to specific service version where applicable.
I think that's a great idea. The snag may be making sure your research
is good on some of the sigs, and being certain that it affects only a
A potential problem would be any versions of servers that the version
string has been altered, as many people do with apache servers, etc.
This would have to be an optional modification. Probably not something
we could put in the mail sets of rules. At Bleeding snort I generally
prefer to have the default set of rules work for as many situations as
possible and local changes can be made to further customize.
I think it'd be worth it to have a secoind set of rules that are
modified in this way, so that if you knew you hadn't altered the version
string on any of your servers then you could run those rules.
I am curious about the performance impacts. Can any of the snort folks
comment on whether this would cause a significant load increase?
Very good idea.
> alert tcp $HTTP_SERVERS $HTTP_PORTS -> any any \
> (msg:"IS IIS4"; sid:2000000; \
> rev:0; classtype:not-suspicious; \
> content: "Server\: Microsoft-IIS\/4.0"; \
> flowbits: set,isiis4; \
> flowbits: noalert;)
> Alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS \
> (msg:"New IIS4 fpcount attempt"; \
> sid:2000002; rev:0; classtype:web-application-attack; \
> flow:to_server,established; \
> uricontent:"/fpcount.exe"; \
> content:"Digits="; nocase; reference:bugtraq,2252; reference:cve,1999-1376; \
> flowbits: isset,isiis4;)
>How much of a resource hit would there be on a system to track connections in this way?
More information about the Snort-sigs