Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration
Mastering Snort Rule Creation: A Step-by-Step Guide for Network Analysts
Fine-tune Snort rules for effective packet analysis
In the world of network security, Snort is a powerful and widely used intrusion detection system (IDS) that allows you to monitor network traffic in real time. Whether you’re an aspiring network analyst or a seasoned professional, mastering Snort rule creation is key to identifying and responding to malicious activity.
In this article, we’ll walk through several practical Snort exercises from TryHackMe’s Snort Room Activity #9, where we’ll filter packets based on various conditions and fine-tune our rules for effective packet analysis.
1. Filtering IP ID “35369” in a Pcap File
The Task:
Use the given “task9.pcap” file to write a rule that filters for IP ID 35369. Run it against the provided pcap file and identify the request name of the detected packet. You can use the following Snort command for testing:
snort -c local.rules -A full -l . -r task9.pcap
Solution:
After experimenting with different protocols, I created the following rule for UDP traffic:
alert udp any any <> any any (msg: "ID TEST"; id:35369; sid:1000001; rev:1;)
Result:
The detected packet’s request name is “TIMESTAMP REQUEST”.
2. Filtering TCP Packets with SYN Flag
The Task:
Clear the previous alerts and comment out the old rules. Now, create a rule to filter TCP packets that have the SYN flag set. Run the rule against the pcap file and determine the number of detected packets.
Solution:
The TCP flag for SYN is detected by using the flags:S option in the rule. Here’s the rule to filter SYN packets:
alert tcp any any <> any any (msg: "FLAG TEST"; flags:S; sid:1000002; rev:1;)
Result:
The rule detected 1 packet with the SYN flag.
3. Filtering TCP Packets with Push-Ack Flags
The Task:
Clear the previous alert file and comment out the old rules. Now, create a rule to filter TCP packets with both Push and Ack flags. Run the rule against the pcap file and report how many packets were detected.
Solution:
To filter for both Push and Ack flags, use the flags:PA option in your rule. Here’s the rule for filtering Push-Ack packets:
alert tcp any any <> any any (msg: "FLAG TEST"; flags:PA; sid:1000003; rev:1;)
Result:
The rule detected 216 packets with both Push and Ack flags.
4. Filtering UDP Packets with the Same Source and Destination IP
The Task:
Clear the previous alert file and comment out the old rules. Now, create a rule to filter UDP packets where the source and destination IP addresses are the same. Run the rule against the pcap file and determine how many packets meet this condition.
Solution:
To filter for packets where the source and destination IP are the same, use the sameip keyword in the rule. Here’s the Snort rule to achieve this:
alert ip any any <> any any (msg: "SAME-IP TEST"; sameip; sid:1000004; rev:1;)
Result:
The rule detected 7 packets with the same source and destination IP address.
5. Modifying an Existing Rule: What Needs to Change?
The Task:
An analyst successfully modified an existing Snort rule. Which rule option must the analyst change after making the modification?
Solution:
When an analyst modifies an existing rule, they need to update the rev (revision) option to reflect the new version of the rule. The rule revision is indicated by the rev: option followed by the revision number. This is critical for tracking changes and ensuring the correct version of the rule is used.
Answer:
The analyst must change the rev option after modifying a rule.
Conclusion
In this guide, we’ve covered essential Snort rule-writing techniques for filtering packets by various criteria, such as IP ID, TCP flags, and source-destination IP addresses. By applying these fundamental techniques, you can effectively monitor network traffic, detect potential security threats, and improve your intrusion detection capabilities.
If you’re just getting started with Snort or looking to refine your rule-writing skills, practicing these tasks will help you gain a deeper understanding of Snort’s capabilities and how to tailor it for your network’s specific needs.
