Re: snort rule assistance/need help have to complete in short notice by next week
Real Gamerholic via Snort-sigs <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.sigs |
|---|---|
| Message-ID | <CABs7Rd+M3GtO+97STySm6c=N2=yfOWbUjV-6Ymr+u-NZ+PL=6A@mail.gmail.com> |
Thanks guys I really appreciate it On Sun, May 30, 2021 at 9:32 PM Eric Mowatt via Snort-sigs < [email protected]> wrote: > That’s perfect thanks for the .top portion. > > Mahalo > Eric > > Made on Kauai > > On May 30, 2021, at 10:50 AM, DFIRob <[email protected]> wrote: > > > > A rule do detect a request to a .top tld would be, on top of whatever you > use to fingerprint a dns query, a content match, but let's say > alert any any -> $DNS_SERVERS 53 ( content:"|03|top|00|"; msg:"DNS query > to a .top domain"; sid:1000001 ); > Other content matches would be needed to make sure all works well, but > that would be functional I guess. > Rob' > > On Sat, May 29, 2021 at 8:21 PM Eric Mowatt via Snort-sigs < > [email protected]> wrote: > >> Aloha Joel >> Do you have an example we can follow to the homework question? Seriously >> would like to see it. Not necessarily to small dns requests but maybe >> something like the .top Donain resolutions. >> >> Thank you >> Mahalos >> Eric >> >> >> Made on Kauai >> >> On May 29, 2021, at 8:18 AM, Joel Esler (jesler) via Snort-sigs < >> [email protected]> wrote: >> >> https://snort.org/faq/can-i-have-help-with-my-homework >> >> >> >> — >> Sent from my iPad >> >> On May 29, 2021, at 10:02, Real Gamerholic via Snort-sigs < >> [email protected]> wrote: >> >> >> <image.png> >> >> 1. I want to catch internal DNS requests (requests smaller than 512 >> bytes) originating from any internal IP address. What will I put in the >> blanks to complete the Snort rule? Have to be as specific as possible (use >> "any" sparingly, if at all). >> >> alert <blank 1> 192.168.8.1/<blank 2> <blank 3> -> <blank 4> <blank 5> (msg:"DNS request detected!"; sid:1;) >> >> 2. John doe remotely compromised the Active Directory server on the >> network. He/she is attempting to port scan the DNS server with nmap’s -sT >> option to discover an SSH service. What Snort rule will detect John Doe >> malicious activity (this instance). Have to be as specific as possible (use >> "any" sparingly, if at all). >> >> alert <blank 1> <blank 2> <blank 3> -> <blank 4> <blank 5> (msg:”SSH >> activity detected!"; sid:2;) >> >> _______________________________________________ >> Snort-sigs mailing list >> [email protected] >> https://lists.snort.org/mailman/listinfo/snort-sigs >> >> Please visit http://blog.snort.org for the latest news about Snort! >> >> Please follow these rules: >> https://snort.org/faq/what-is-the-mailing-list-etiquette >> >> Visit the Snort.org to subscribe to the official Snort ruleset, make sure >> to stay up to date to catch the most <a href=" >> https://snort.org/downloads/#rule-downloads">emerging threats</a>! >> >> _______________________________________________ >> Snort-sigs mailing list >> [email protected] >> https://lists.snort.org/mailman/listinfo/snort-sigs >> >> Please visit http://blog.snort.org for the latest news about Snort! >> >> Please follow these rules: >> https://snort.org/faq/what-is-the-mailing-list-etiquette >> >> Visit the Snort.org to subscribe to the official Snort ruleset, make sure >> to stay up to date to catch the most <a href=" >> https://snort.org/downloads/#rule-downloads">emerging threats</a>! >> >> _______________________________________________ >> Snort-sigs mailing list >> [email protected] >> https://lists.snort.org/mailman/listinfo/snort-sigs >> >> Please visit http://blog.snort.org for the latest news about Snort! >> >> Please follow these rules: >> https://snort.org/faq/what-is-the-mailing-list-etiquette >> >> Visit the Snort.org to subscribe to the official Snort ruleset, make sure >> to stay up to date to catch the most <a href=" >> https://snort.org/downloads/#rule-downloads">emerging threats</a>! >> > _______________________________________________ > Snort-sigs mailing list > [email protected] > https://lists.snort.org/mailman/listinfo/snort-sigs > > Please visit http://blog.snort.org for the latest news about Snort! > > Please follow these rules: > https://snort.org/faq/what-is-the-mailing-list-etiquette > > Visit the Snort.org to subscribe to the official Snort ruleset, make sure > to stay up to date to catch the most <a href=" > https://snort.org/downloads/#rule-downloads">emerging threats</a>! > -- Donovan Reid _______________________________________________ Snort-sigs mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!