[Snort-users] Building Alert rule

Al Lewis (allewi) allewi at ...589...
Thu May 7 06:44:09 EDT 2015


                There is an example of this provided in the manual (see below). You should be able to alter it to fit your situation. http://manual.snort.org/node34.html#SECTION004710000000000000000

Example - this rule will fire on every failed login attempt from during one sampling period of 60 seconds, after the first 30 failed login attempts:

    drop tcp any > 22 ( \
        msg:"SSH Brute Force Attempt";
        flow:established,to_server; \
        content:"SSH"; nocase; offset:0; depth:4; \
        detection_filter:track by_src, count 30, seconds 60; \
        sid:1000001; rev:1;)


Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112
Email: allewi at ...589...

From: May Smith [mailto:may24x at ...131...]
Sent: Thursday, May 07, 2015 4:28 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Building Alert rule

Hi all,

I'm running CentOS with Snort

The box is online just for a couple of days and I can already see that I'm under attack
Somebody is hammering against port 22 trying to get access.

However, since I'm connecting from various places, my IP keeps changing every time.
So adding an IP to an ignore test won't help me.

So what I need is to create a rule that sends out an alert if some IP fails to login more than three times
but won't alert if login is successful.

Is that possible ? And if so, how ?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150507/3039e0f8/attachment.html>

More information about the Snort-users mailing list