[Snort-users] Building Alert rule

Al Lewis (allewi) allewi at ...589...
Thu May 7 06:44:09 EDT 2015


Hello,

                There is an example of this provided in the manual (see below). You should be able to alter it to fit your situation. http://manual.snort.org/node34.html#SECTION004710000000000000000

Example - this rule will fire on every failed login attempt from 10.1.2.100 during one sampling period of 60 seconds, after the first 30 failed login attempts:

    drop tcp 10.1.2.100 any > 10.1.1.100 22 ( \
        msg:"SSH Brute Force Attempt";
        flow:established,to_server; \
        content:"SSH"; nocase; offset:0; depth:4; \
        detection_filter:track by_src, count 30, seconds 60; \
        sid:1000001; rev:1;)


Thanks!

Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112
Email: allewi at ...589...

From: May Smith [mailto:may24x at ...131...]
Sent: Thursday, May 07, 2015 4:28 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Building Alert rule

Hi all,

I'm running CentOS with Snort 2.9.7.2

The box is online just for a couple of days and I can already see that I'm under attack
Somebody is hammering against port 22 trying to get access.

However, since I'm connecting from various places, my IP keeps changing every time.
So adding an IP to an ignore test won't help me.

So what I need is to create a rule that sends out an alert if some IP fails to login more than three times
but won't alert if login is successful.

Is that possible ? And if so, how ?

regards
may
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150507/3039e0f8/attachment.html>


More information about the Snort-users mailing list