Search
Mastering Snort: Stopping Real-Time Attacks
3 min read

Mastering Snort: Stopping Real-Time Attacks

Raúl Vázquez González's Picture
Raúl Vázquez González in snort network-security intrusion-detection tryhackme

Mastering Snort: Stopping Real-Time Attacks

Learn how to detect and block brute-force and reverse shell attacks using Snort IDS/IPS.

Scenario 1 :  Brute-Force

Scenario

Start Snort in sniffer mode and identify the attack source, service, and port. Then write an IPS rule and run Snort in IPS mode to stop the brute-force attack. When the attack is stopped correctly the flag will appear on the desktop.

Process

I ran Snort in sniffer mode and used -X to view the full packet dump for detailed information:

sudo snort -X

From the packet dumps I observed many connection attempts originating from the same IP and targeting port 22 (SSH). The large number of attempts and the targeted service indicated a brute-force attack.

01.png

I added the following rules to /etc/snort/rules/local.rules:

alert tcp 10.10.245.36 any -> any 22 (msg: "Brute force attack - SSH"; sid:1000001; rev:1;)
drop tcp 10.10.245.36 any -> any 22 (msg: "Brute force attack - SSH"; sid:1000002; rev:1;)

Then I ran Snort in IPS mode (as I normally run it in my environment):

sudo snort -c /etc/snort/rules/local.rules -A full

After that, the attack was stopped and the flag file appeared on the desktop.

Q\&A

  • Stop the attack and get the flag (which will appear on your Desktop)
     THM{81b7fef657f8aaa6e4e200d616738254}
  • What is the name of the service under attack?
     SSH
  • What is the used protocol/port in the attack?
     TCP/22

Scenario 2  :   Reverse-Shell

Scenario

Start Snort in sniffer mode and identify the attack source, service, and port. Then write an IPS rule and run Snort in IPS mode to stop the reverse shell. When stopped correctly the flag will appear on the desktop.

Note: The original scenario text mentioned “stop the brute-force attack” again . In this scenario the traffic observed was a reverse-shell, so the objective is to stop that.

Process

I ran Snort in sniffer mode and used -X to inspect packet payloads:

sudo snort -X

I identified traffic targeting port 4444, which is commonly used as a default for Metasploit reverse shells.

02.png

I added these rules to /etc/snort/rules/local.rules:

alert tcp any any <> any 4444 (msg: "Metasploit Reverse Shell"; sid:1000001; rev:1;)
drop tcp any any <> any 4444 (msg: "Metasploit Reverse Shell"; sid:1000002; rev:1;)

After enabling IPS mode, the connection attempts on port 4444 were blocked and the flag appeared.

Q\&A

  • Stop the attack and get the flag (which will appear on your Desktop)
     THM{0ead8c494861079b1b74ec2380d2cd24}
  • What is the used protocol/port in the attack?
     TCP/4444
  • Which tool is highly associated with this specific port number?
     Metasploit

Notes & Small Recommendations

  • When writing Snort rules, prefer to be as specific as possible (for example, restrict src or dst IPs if known) to reduce false positives.
  • Avoid reusing sid values across unrelated rules ;  each rule should have a unique SID.
  • drop rules require Snort to run in inline/IPS mode with an appropriate DAQ (Data Acquisition) module configured. In many deployments rules are written in local.rules and referenced from the Snort configuration (snort.conf).
  • Use descriptive msg strings so alerts in logs are immediately meaningful.

You may also like

Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
11 min read

Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night

Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration

Raúl Vázquez González's Picture
Raúl Vázquez González in ransomware threat-hunting splunk tryhackme aws
Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
6 min read

Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel

Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques

Raúl Vázquez González's Picture
Raúl Vázquez González in network-security network-forensics incident-response wireshark log-analysis
Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance
10 min read

Investigating a Multi-Stage Attack: TryHackMe First Shift CTF — Task 6: Zero Tolerance

A SOC Threat Intelligence Investigation into Brute Force, File Upload Exploitation, and Web Shell Persistence

Raúl Vázquez González's Picture
Raúl Vázquez González in soc-analyst splunk threat-hunting tryhackme

Latest Posts

Building a Tier 1 SOC Dashboard in Splunk
9 min read

Building a Tier 1 SOC Dashboard in Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
7 min read

Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk

Raúl Vázquez González's Picture
Raúl Vázquez González

Explore Tags

active-directory allowlist aws azure-security blue-team bluetooth books brim btlo certification certifications chmod cloud-security compliance cyber-security-awareness cyberchef cybercrime cybersecurity cybersecurity-lab dashboards data-filtering data-protection ddos detection-engineering dfir dfir tryhackme digital-forensics elastic elastic-search elastic-stack elk ez-tools file-permissions firewall homelab incident-response infosec intrusion-detection kerberos linux-hardening linux-security log-analysis malware-analysis mitm mitre mitre-attck network-analysis network-forensics network-security networking networkminer nmap opencti osint packet-analysis pcap-analysis phishing powershell programming python ransomware regex security-audit siem snort soc soc-analyst soc-lab spl splunk sql sysmon threat-detection threat-hunting threat-intelligence tryhackme ufw virustotal volatility web-security windows-forensics wireshark xdr