Re: snort rule assistance/need help have to complete in short notice by next week

https://snort.org/faq/can-i-have-help-with-my-homework



— 
Sent from my  iPad

> On May 29, 2021, at 10:02, Real Gamerholic via Snort-sigs <[email protected]> wrote:
> 
> 
> <image.png>
>   
> 1. I want to catch internal DNS requests (requests smaller than 512 bytes) originating from any internal IP address. What will I put in the blanks to complete the Snort rule? Have to be as specific as possible (use "any" sparingly, if at all).  
> alert <blank 1> 192.168.8.1/<blank 2> <blank 3> -> <blank 4> <blank 5> (msg:"DNS request detected!"; sid:1;)
> 2. John doe remotely compromised the Active Directory server on the network. He/she is attempting to port scan the DNS server with nmap’s -sT option to discover an SSH service. What Snort rule will detect John Doe malicious activity (this instance). Have to be as specific as possible (use "any" sparingly, if at all).
> 
> alert <blank 1> <blank 2> <blank 3> -> <blank 4> <blank 5> (msg:”SSH activity detected!"; sid:2;)
> 
> _______________________________________________
> Snort-sigs mailing list
> [email protected]
> https://lists.snort.org/mailman/listinfo/snort-sigs
> 
> Please visit http://blog.snort.org for the latest news about Snort!
> 
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
> 
> Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!

_______________________________________________
Snort-sigs mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!