Et Policy Pe Exe Or Dll Windows File Download UPDATED

Et Policy Pe Exe Or Dll Windows File Download

Suricata Myth Busting: Alerts and NSM

As I mentioned in the introductory article in this series (come across hither >>), Suricata produces non just IDS alerts but also produces protocol transaction logs, menstruum records, full packet capture and extracted files.

In this article we endeavour to articulate upwardly a couple of misconceptions (myths) and illustrate these lesser-known capabilities through existent-world examples.

Data used in this article

The case that we volition employ in this article to showcase Suricata's capabilities is from https://www.malware-traffic-analysis.net/2021/02/08/index.html

NOTE: The PCAP and the artifacts extracted or present (files/domains etc) in this instance comprise live malware. If y'all chose to explore or visit any of the domains/servers/files/ listed here, you should practise and then at your ain adventure, in a controlled manner and but in a sandbox environment.

Suricata Myth 1 - Alerts Only

Myth: Suricata produces only alerts/alarms and y'all need some other tool to produce the network protocol log bear witness (network protocol transaction or network security logs) for that warning in order to ostend if it is real or a false positive.

Fact: This is simply not truthful.

Suricata produces all relevant network security monitoring/protocol logs, including the ones related to an alert - but too independent of alerts. In the regular JSON logs that Suricata generates (eve.json), y'all volition find something called "flow_id" that correlates the network protocol information and evidence that Suricata has logged - to an alert event and that alert'south metadata. And then for example for a HTTP based alarm, all the relevant HTTP and or file transactions and period logs would be available.

The ability to correlate any existing prove/logs to an alert ("flow_id") was introduced in 2014 by Suricata lead developer, Victor Julien

Classic IDS alert

Here is an example of a legacy/classic IDS alert

Warning log:
02/08/2021-17:00:thirteen.183792 [**] [1:2014819:iii] ET INFO Packed Executable Download [**] [Nomenclature: Misc activity] [Priority: iii] {TCP} eight.208.ten.147:80 -> 10.ii.8.101:49757

You can come across that it does non contain much information beyond source and destination IP address. In short, it is distinctly lacking in context that might be useful for incident investigation or threat hunting.

The Suricata alert difference

Discover the areas highlighted beneath in blue which demonstrate the boosted data and bespeak there are flow and file records associated with the alert.

Alert log:
{"timestamp":"2021-02-08T17:00:13.183792+0100","flow_id":1890654805068045,"pcap_cnt":4153,"event_type":"alert","src_ip":"8.208.10.147","src_port":eighty,"dest_ip":"10.ii.8.101","dest_port":49757,"proto":"TCP","metadata":{"flowbits":["exe.no.referer"]},"alert":{"activity":"immune","gid":1,"signature_id":2014819,"rev":3,"signature":"ET INFO Packed Executable Download","category":"Misc action","severity":3,"metadata":{"created_at":["2012_05_30"],"updated_at":["2012_05_30"]}},"http":{},"app_proto":"http","flow":{"pkts_toserver":ix,"pkts_toclient":11,"bytes_toserver":1042,"bytes_toclient":9759,"start":"2021-02-08T17:00:12.297229+0100"}}
{"timestamp":"2021-02-08T17:00:13.408464+0100","flow_id":1890654805068045,"pcap_cnt":4208,"event_type":"alert","src_ip":"eight.208.10.147","src_port":eighty,"dest_ip":"10.2.8.101","dest_port":49757,"proto":"TCP","metadata":{"flowbits":["exe.no.referer","ET.http.binary"]},"tx_id":2,"alert":{"action":"allowed","gid":1,"signature_id":2018959,"rev":four,"signature":"ET POLICY PE EXE or DLL Windows file download HTTP","category":"Potential Corporate Privacy Violation","severity":1,"metadata":{"created_at":["2014_08_19"],"former_category":["POLICY"],"updated_at":["2017_02_01"]}},"http":{"hostname":"roanokemortgages[.]com","url":"/6lhjgfdghj.exe","http_user_agent":"Mozilla/5.0 (Windows NT 6.one; Win64; x64; Trident/7.0; rv:11.0) like Gecko","http_content_type":"application/octet-stream","http_method":"Go","protocol":"HTTP/i.1","condition":200,"length":41029},"files":[{"filename":"/6lhjgfdghj.exe","sid":[],"gaps":simulated,"state":"UNKNOWN","stored":false,"size":41029,"tx_id":ii}],"app_proto":"http","flow":"pkts_toserver":24,"pkts_toclient":37,"bytes_toserver":1852,"bytes_toclient":46939,"get-go":"2021-02-08T17:00:12.297229+0100"}}

And Suricata's Network Security Monitoring (NSM)

Below are a few of the network security and protocol logs produced by Suricata associated with the alert shown above. Notation they are all tied together past a common flow_id value (highlighted in bluish):

HTTP Log:
{"timestamp":"2021-02-08T17:00:12.648463+0100","flow_id":1890654805068045,"pcap_cnt":3883,"event_type":"http","src_ip":"10.2.viii.101","src_port":49757,"dest_ip":"eight.208.10.147","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"roanokemortgages[.]com","url":"/0801.bin","http_user_agent":"Mozilla/five.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko","http_content_type":"application/octet-stream","accept":"*/*","cache_control":"no-cache","connection":"keep-live","content_length":"876","content_type":"application/octet-stream","date":"Mon, 08 Feb 2021 16:00:13 GMT","last_modified":"Mon, 08 Feb 2021 13:20:38 GMT","server":"nginx","http_method":"GET","protocol":"HTTP/ane.1","condition":200,"length":876,"request_headers":[{"name":"Take","value":"*/*"},{"name":"User-Agent","value":"Mozilla/v.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko"},{"name":"Host","value":"roanokemortgages[.]com"},{"name":"Cache-Command","value":"no-enshroud"}],"response_headers":[{"proper noun":"Server","value":"nginx"},{"proper name":"Engagement","value":"Mon, 08 February 2021 16:00:13 GMT"},{"name":"Content-Type","value":"application/octet-stream"},{"proper name":"Content-Length","value":"876"},{"name":"Connection","value":"keep-alive"},{"proper name":"Last-Modified","value":"Mon, 08 Feb 2021 thirteen:xx:38 GMT"},{"proper name":"ETag","value":"\"60213aa6-36c\""},{"name":"Accept-Ranges","value":"bytes"}]}}

File Transaction log:
{"timestamp":"2021-02-08T17:00:12.648463+0100","flow_id":1890654805068045,"pcap_cnt":3883,"event_type":"fileinfo","src_ip":"8.208.10.147","src_port":lxxx,"dest_ip":"10.2.eight.101","dest_port":49757,"proto":"TCP","http":{"hostname":"roanokemortgages[.]com","url":"/0801.bin","http_user_agent":"Mozilla/v.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:eleven.0) similar Gecko","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":876},"app_proto":"http","fileinfo":{"filename":"/0801.bin","sid":[],"magic":"data","gaps":false,"country":"CLOSED","sha256":"ee33a8fa2ae6f6b9366c97ed4c00c2796d98a371249dca725a01aca03caf747b","stored":false,"size":876,"tx_id":0}}

HTTP log:
{"timestamp":"2021-02-08T17:00:12.878417+0100","flow_id":1890654805068045,"pcap_cnt":3908,"event_type":"http","src_ip":"ten.2.8.101","src_port":49757,"dest_ip":"8.208.ten.147","dest_port":lxxx,"proto":"TCP","tx_id":ane,"http":{"hostname":"roanokemortgages[.]com","url":"/0801s.bin","http_user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/seven.0; rv:11.0) like Gecko","http_content_type":"application/octet-stream","accept":"*/*","cache_control":"no-enshroud","connectedness":"keep-alive","content_length":"913","content_type":"awarding/octet-stream","engagement":"Monday, 08 Feb 2021 sixteen:00:thirteen GMT","last_modified":"Mon, 08 Feb 2021 xiii:20:37 GMT","server":"nginx","http_method":"Get","protocol":"HTTP/1.1","status":200,"length":913,"request_headers":[{"name":"Accept","value":"*/*"},{"name":"User-Agent","value":"Mozilla/five.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:eleven.0) like Gecko"},{"name":"Host","value":"roanokemortgages[.]com"},{"name":"Enshroud-Control","value":"no-cache"}],"response_headers":[{"name":"Server","value":"nginx"},{"proper noun":"Date","value":"Mon, 08 Feb 2021 sixteen:00:thirteen GMT"},{"name":"Content-Blazon","value":"application/octet-stream"},{"name":"Content-Length","value":"913"},{"name":"Connection","value":"go along-alive"},{"name":"Concluding-Modified","value":"Mon, 08 Feb 2021 thirteen:20:37 GMT"},{"proper noun":"ETag","value":"\"60213aa5-391\""},{"name":"Accept-Ranges","value":"bytes"}]}}

File Transaction log:
{"timestamp":"2021-02-08T17:00:12.878417+0100","flow_id":1890654805068045,"pcap_cnt":3908,"event_type":"fileinfo","src_ip":"viii.208.x.147","src_port":80,"dest_ip":"10.two.8.101","dest_port":49757,"proto":"TCP","http":{"hostname":"roanokemortgages[.]com","url":"/0801s.bin","http_user_agent":"Mozilla/5.0 (Windows NT six.1; Win64; x64; Trident/seven.0; rv:11.0) similar Gecko","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/i.1","status":200,"length":913},"app_proto":"http","fileinfo":{"filename":"/0801s.bin","sid":[],"magic":"data","gaps":false,"country":"Airtight","sha256":"7af0dc117d2dcd112f50889c4c8a14ac9ee55c2525a24fa66ff9a89b480b7e99","stored":faux,"size":913,"tx_id":1}}

HTTP log:
{"timestamp":"2021-02-08T17:00:13.699055+0100","flow_id":1890654805068045,"pcap_cnt":4506,"event_type":"http","src_ip":"10.ii.8.101","src_port":49757,"dest_ip":"8.208.ten.147","dest_port":80,"proto":"TCP","metadata":{"flowbits":["exe.no.referer","ET.http.binary"]},"tx_id":2,"http":{"hostname":"roanokemortgages[.]com","url":"/6lhjgfdghj.exe","http_user_agent":"Mozilla/5.0 (Windows NT 6.ane; Win64; x64; Trident/7.0; rv:eleven.0) similar Gecko","http_content_type":"application/octet-stream","accept":"*/*","cache_control":"no-enshroud","connection":"keep-live","content_length":"273422","content_type":"application/octet-stream","date":"Mon, 08 Feb 2021 sixteen:00:14 GMT","last_modified":"Wed, 20 Jan 2021 09:59:xix GMT","server":"nginx","http_method":"Get","protocol":"HTTP/one.1","status":200,"length":273422,"request_headers":[{"name":"Accept","value":"*/*"},{"proper name":"User-Agent","value":"Mozilla/five.0 (Windows NT 6.1; Win64; x64; Trident/vii.0; rv:eleven.0) similar Gecko"},{"proper name":"Host","value":"roanokemortgages[.]com"},{"name":"Enshroud-Control","value":"no-enshroud"}],"response_headers":[{"name":"Server","value":"nginx"},{"name":"Date","value":"Mon, 08 Feb 2021 xvi:00:14 GMT"},{"proper noun":"Content-Blazon","value":"application/octet-stream"},{"name":"Content-Length","value":"273422"},{"name":"Connectedness","value":"keep-alive"},{"name":"Concluding-Modified","value":"Midweek, 20 Jan 2021 09:59:19 GMT"},{"name":"ETag","value":"\"6007fef7-42c0e\""},{"name":"Accept-Ranges","value":"bytes"}]}}

File Transaction log:
{"timestamp":"2021-02-08T17:00:13.699055+0100","flow_id":1890654805068045,"pcap_cnt":4506,"event_type":"fileinfo","src_ip":"8.208.10.147","src_port":lxxx,"dest_ip":"10.2.8.101","dest_port":49757,"proto":"TCP","metadata":{"flowbits":["exe.no.referer","ET.http.binary"]},"http":{"hostname":"roanokemortgages[.]com","url":"/6lhjgfdghj.exe","http_user_agent":"Mozilla/5.0 (Windows NT six.1; Win64; x64; Trident/seven.0; rv:eleven.0) like Gecko","http_content_type":"application/octet-stream","http_method":"Get","protocol":"HTTP/1.1","condition":200,"length":273422},"app_proto":"http","fileinfo":{"filename":"/6lhjgfdghj.exe","sid":[],"magic":"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows","gaps":false,"state":"Airtight","sha256":"94e60de577c84625da69f785ffe7e24c889bfa6923dc7b017c21e8a313e4e8e1","stored":false,"size":273422,"tx_id":2}}

Flow tape:
{"timestamp":"2021-02-08T16:58:fifteen.247118+0100","flow_id":1890654805068045,"event_type":"flow","src_ip":"x.ii.viii.101","src_port":49757,"dest_ip":"8.208.ten.147","dest_port":80,"proto":"TCP","app_proto":"http","catamenia":{"pkts_toserver":105,"pkts_toclient":207,"bytes_toserver":6226,"bytes_toclient":287136,"start":"2021-02-08T17:00:12.297229+0100","end":"2021-02-08T17:01:56.764859+0100","historic period":104,"state":"closed","reason":"shutdown","alerted":true},"metadata":{"flowbits":["exe.no.referer","ET.http.binary"]},"tcp":{"tcp_flags":"1b","tcp_flags_ts":"1b","tcp_flags_tc":"1b","syn":true,"fin":true,"psh":truthful,"ack":truthful,"state":"airtight"}}

Suricata Myth 2 - NSM requires signatures/rules

Myth: Suricata can just role with signatures/rules.

Fact: This is also not true. And it could be one of the near misunderstood capabilities of Suricata.

Suricata actually produces network security monitoring logs - protocol transactions and network menses data without signatures. In fact, if you were to switch off the rules/signatures in the case above, Suricata will still produce the exact same logs as above without the alert itself. That is, everything else volition still be logged.

Here'due south an example on Pastebin here:
https://pastebin.com/PxKDx2NF

In the side by side article, we volition provide a more detailed review of the NSM capabilities of Suricata.

Further Reading on Suricata

Stamus Networks has produced a number of manufactures and papers on Suricata. Please see the list below for more information:

DOWNLOAD HERE

Posted by: kershawbefornes.blogspot.com

Share this post