Download "Intrusion Detection With Snort"
%3Aformat(webp)%2Fi.ytimg.com%252Fvi%252FGh0sweT-G30%252Fmaxresdefault.jpg&w=1139&q=75)
Table of contents
Similar videos from our catalog
%3Aformat(webp)%2Fi.ytimg.com%252Fvi%252FEIHLXWnK1Dw%252Fmaxresdefault.jpg&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi%252FU6xMp-MIEfA%252Fmaxresdefault.jpg&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FXjVYl1Ts6XI%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FbxFwpm4IobU%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi%252FchVPS_sRjoI%252Fmaxresdefault.jpg&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FfSFeIdMZ_3I%252Fmaxresdefault.webp&w=1139&q=75)
%3Aformat(webp)%2Fi.ytimg.com%252Fvi_webp%252FfUJBmIIsqxk%252Fmaxresdefault.webp&w=1139&q=75)
Video tags
Subtitles
Russian
00:00:04
[Music]00:00:07
all right so00:00:08
where we currently do not have any rules00:00:11
uh you know within the uh local.rules00:00:14
file00:00:15
now00:00:17
let's start off by creating a few a few00:00:20
basic ones right now in order to create00:00:21
one we're going to say sudo vim00:00:24
and you can use any text editor that00:00:26
you're comfortable with as long as it00:00:27
has the permissions to make changes or00:00:29
to write uh changes to these particular00:00:32
files so etsy snort00:00:35
and we are going to go under rules and00:00:38
the name is local.rules as you can see00:00:41
it's empty so this file intentionally00:00:44
intentionally does not come with00:00:45
signatures put your local additions here00:00:48
fantastic so00:00:49
let's start off with a few examples00:00:52
all right so let's say we wanted to00:00:54
detect any00:00:56
uh any icmp pings right and uh i'll00:00:59
actually talk you through how to use00:01:01
snoppy in a second00:01:03
uh but the syntax is very simple so you00:01:05
start off by specifying if we take a00:01:08
look at snoppy the action so it's not we00:01:11
can alert we can essentially you know00:01:13
send an alert to the terminal00:01:16
we can log that particular00:01:18
that particular packet or network00:01:20
activity we can pass the packet this is00:01:22
in the case of the intrusion prevention00:01:24
system uh dropping and rejecting are00:01:27
also part of00:01:28
the intrusion00:01:30
and the intrusion prevention system or00:01:32
functionality of snot in our case we're00:01:34
primarily00:01:35
focused on alerts and logs and in our00:01:39
case in pretty much many or most cases00:01:41
we want to use the alert option so00:01:43
uh i'll say alert00:01:45
so that's00:01:46
what we're essentially saying here is00:01:48
for any of the following traffic00:01:51
that i specify00:01:53
i need you snot to actually you know00:01:55
provide me with an alert whenever a ping00:01:58
is made so in order to do this we're00:02:00
going to say alert icmp because pings00:02:03
essentially send icmp requests00:02:06
from any network and any port00:02:10
and then we say00:02:13
uh00:02:14
that comes into our home network00:02:16
remember the home network variable that00:02:18
we had configured within the snort00:02:20
configuration file so we're essentially00:02:21
saying that subnet or what we're saying00:02:24
is i want you to generate an alert for00:02:26
any icmp traffic that comes from any00:02:28
external uh address00:02:30
uh you know with any external port00:02:33
into our home network subnet and then00:02:36
you specify the port in our case we'll00:02:38
say any because pings are really not00:02:40
targeted towards any specific port00:02:42
and then we specify in the case of an00:02:44
alert we specify a message that we would00:02:46
like to display00:02:48
so in this case we can say message and00:02:50
i'm going to say icmp ping00:02:52
detected00:02:54
and that's what's going to be displayed00:02:56
to the relevant user that's essentially00:02:58
monitoring the actual intrusions or the00:03:01
traffic we then need to specify a00:03:03
signature id this can be whatever you00:03:05
want it to be00:03:07
it's generally it's generally00:03:08
recommended to have this00:03:10
to essentially provide a unique value so00:03:12
that it doesn't00:03:14
conflict with the other signature ids so00:03:17
in this case um we can just say00:03:19
signature id is going to be maybe you00:03:21
know00:03:23
we can say 100100:03:26
and we then want to use a semi semicolon00:03:29
and you can then specify revisions for00:03:31
specific00:03:32
uh for sp you know for specific rules so00:03:35
in this case we can say this is a00:03:36
revision one00:03:38
and we then close the brackets there so00:03:40
that is a snort rule all right so we00:03:43
have created a snot rule fantastic and00:03:46
you can keep on adding other rules on00:03:48
the next line so let's write and quit00:03:51
all right00:03:53
and what we are going to do now is we00:03:55
are going to run snot00:03:56
now in order to run snot you need to00:03:58
understand a few options right so00:04:01
whenever you're running snot00:04:03
the most important option is the alert00:04:05
mode right so the um the alert mode00:04:08
allows you to specify what types of uh00:04:11
you know uh the actual format of alerts00:04:14
so for example the fast alert mode00:04:17
writes alerts to the default alert file00:04:19
in the single line syslog00:04:22
style00:04:23
alert message full writes the alert to00:04:25
the alert file with the full decoded00:04:28
header as well as the alert message00:04:30
and in our case we're not really going00:04:32
to be00:04:33
logging the alerts uh you know by00:04:36
default we're going to be logging the00:04:37
traffic but00:04:39
we can essentially specify this to00:04:42
either be fast mode but in our case00:04:43
we're going to say log all the alerts uh00:04:47
in on on to the console the other option00:04:49
we need to use that we're going to be00:04:51
using is the l option00:04:53
which allows us if i can find it here00:04:56
there we are so this is the log00:04:57
directory so this will set the output00:04:59
logging directory to log directory we'll00:05:02
be using that and we'll be specifying00:05:04
that we want to save all our logs under00:05:06
var logs not this is very important00:05:09
because what's the point of performing00:05:10
network intrusion detection if you're00:05:12
not logging all the relevant alerts for00:05:15
late analysis or for implementation or00:05:18
integration into a tool or a00:05:20
visualization tool like snot00:05:23
the other option that we're going to be00:05:24
using of course is going to be the00:05:26
interface option we will be specifying00:05:28
our interface00:05:29
uh we then need to specify um00:05:32
the queue option which i believe in this00:05:34
case is quite important we want uh snow00:05:37
to run quietly i don't want it to00:05:39
display all the diagnostic information00:05:41
in regards to the rules loaded etc so00:05:44
uh mnopq there we are quiet operation00:05:47
don't display the banner and00:05:48
initialization information if you are00:05:51
running it as an intrusion prevention00:05:54
system00:05:55
uh then uh you you never want to use the00:05:57
capital uh queue option because that00:06:00
will disable or sorry that will enable00:06:02
inline mode so yes when you are running00:06:04
it as an ids ips then uh you need to use00:06:08
the queue option to run it in inline00:06:10
mode in our case we're not doing that00:06:12
all right so to run snort00:06:14
uh there's a few arguments we need to00:06:16
specify so we'll say sudo snot we're00:06:18
gonna run it in the quiet mode00:06:20
the log file is or the log directory is00:06:23
under var log00:06:25
under snort00:06:26
and00:06:28
what we can then specify now is our00:06:30
interface so enp00:06:32
0s3 in your case it's going to be00:06:34
different so do take note of that and00:06:36
then the00:06:37
the actual alert the actual alert mode00:06:40
is going to be console because we're00:06:41
displaying it to ourselves we're not yet00:06:43
logging them and then we need to specify00:06:45
the configuration file that we're going00:06:47
to use if you've created a custom one00:06:49
then this is the the best time to add it00:06:51
here so we're going to say cd00:06:54
sorry etsy snort and snot.conf00:06:58
and we can hit enter now if it doesn't00:07:00
provide you with any output or any00:07:02
errors then that means it's working so00:07:04
let us actually test this let's see if00:07:07
this is indeed working so i'm just going00:07:10
to open up a command prompt here00:07:12
and there we are i'm just going to clear00:07:14
that out sorry cls and i'm just going to00:07:17
perform a ping right00:07:19
now this device is part of the network00:07:22
uh you know is part of the the actual00:07:24
local network so00:07:26
i can ping a particular device that is00:07:29
within the network but before i do that00:07:32
i actually want to00:07:33
fire up the the linux virtual machine uh00:07:36
that is the meta splatable2 virtual00:07:38
machine that is going to run within the00:07:40
network we're then going to ping it with00:07:42
our kali linux vm as well00:07:44
and you'll actually see the traffic here00:07:46
so let me just start the vms and we can00:07:49
resume from that point00:07:51
all right so i've started all the vms00:07:53
including the kali linux vm and what i'm00:07:56
going to do is i'm going to run a ping00:07:58
on the metasploitable 2 server so i'm00:08:01
going to say ping and the ip address in00:08:03
my case of the metasploitable 2 server00:08:06
is on 192.168.2.15700:08:11
all right so i'm going to hit enter and00:08:12
now if we switch back to the00:08:15
ubuntu vm running00:08:17
snort we should see these alerts00:08:20
so back on the ubuntu vm running snot00:08:22
you can actually see the pings being00:08:24
detected based on the rule that we00:08:26
created which is fantastic and i'm just00:08:29
going to terminate00:08:30
that particular ping on the kali linux00:08:32
system so i'll just ctrl c that and let00:08:35
me switch back over to the ubuntu vm00:08:39
and you can now see that the alerts have00:08:41
stopped being produced which proves that00:08:43
it is indeed working so the format is00:08:46
very simple you have date time and then00:08:48
of course you have the signature id then00:08:50
of course the message that we specified00:08:52
so icmp ping detected we can also00:08:54
specify a priority the actual protocol00:08:57
the address it came from00:08:59
and the address it went to so this is00:09:02
the ip of the metasploitable 2 virtual00:09:04
machine this is the ip address of my00:09:06
kali linux virtual machine where i00:09:07
performed the ping from fantastic so00:09:10
that's how to create a very simple rule00:09:12
i really like using this example because00:09:14
it allows me to showcase a few important00:09:17
techniques all right now what i'm going00:09:19
to do now00:09:21
is let's write another rule00:09:23
for ssh connections right because that00:09:25
can be quite important to monitor on the00:09:27
network so i'm going to go back and00:09:29
modify the local.rules file00:09:31
and i'm going to create another one so00:09:33
i'm going to say alert and in this case00:09:35
because00:09:36
ssh runs on tcp i'm going to say tcp00:09:40
from any connection on any port00:09:43
we want to00:09:45
essentially generate an alert whenever00:09:47
it comes into the home00:09:49
network00:09:51
subnet on port 22. remember we need to00:09:54
specify the appropriate port for ssh00:09:57
because otherwise the rule will not work00:09:59
we then create a message00:10:00
and the message can be anything in this00:10:02
case we can say uh ssh uh authentication00:10:08
you know and because we can't at this00:10:10
point we're not really uh you know going00:10:11
deep into determining whether this is a00:10:14
connection a successful authentication00:10:17
attempt or a failed one we're just going00:10:18
to say00:10:19
ssh authentication and we can just say00:10:21
attempt right00:10:24
just to give it a bit of nuance and then00:10:26
for the signature id we're going to make00:10:28
sure it doesn't conflict with our00:10:29
previous one so we'll say you know 100200:10:33
and we'll just say revision is one and00:10:35
we can close that up00:10:37
and now i'm going to write in quit00:10:39
and if i go back on to my kali linux00:10:42
system we're going to try and00:10:43
authenticate with metasploitable 2 via00:10:45
ssh because that metasploitable 2 system00:10:48
has an ssh server running on it so i'll00:10:52
just switch back to kali here in a00:10:54
second there we go so i'll say ssh00:10:58
the username is msf00:11:00
admin00:11:01
and i'm going to say 192.168.2.15700:11:07
and msf admin00:11:10
there we are so we authentic00:11:11
authenticate successfully so what we're00:11:13
trying to do here is try and see00:11:15
from the perspective of the defender00:11:18
what uh00:11:19
what this network activity looks like00:11:21
and if they have written rules for it00:11:23
then they should be able to detect00:11:24
what's being done on the network that's00:11:26
the essence of intrusion detection and00:11:29
network traffic analysis right00:11:31
in the case of network intrusion00:11:33
detection we're essentially fine-tuning00:11:36
uh our network traffic analysis to00:11:38
identify and automate the process of00:11:40
identifying intrusions or threats so let00:11:43
me switch back over into my uh into the00:11:46
actual00:11:47
ubuntu vm and i had actually not started00:11:50
up snot so let me just do that again00:11:52
and i'll just do it again and we can run00:11:55
that authentication attempt once more so00:11:58
i'll just exit and i'll run it again and00:12:01
i'll just provide the password there and00:12:04
i'll switch back over00:12:06
and you can see we get the ssh00:12:08
authentication attempt alerts fantastic00:12:11
so you can now start to see00:12:12
how uh how cool this is and of course00:12:15
this will also work for all the other00:12:17
rules that we specified so for example i00:12:19
can you know i can actually ping so if i00:12:22
say ping00:12:23
168.2 0.1 5700:12:26
you can see that that ping is detected00:12:28
so you know really really00:12:30
robust uh network intrusion detection00:12:33
system and uh you know the power of your00:12:35
network intrusion detection system will00:12:37
be based upon your rules now as i said00:12:40
the reason why i disabled the other ones00:12:42
is because i wanted to showcase how you00:12:44
can write your own so let's explore how00:12:46
to use the snoppy tool right00:12:49
so the snowplay tool is essentially a00:12:51
graphical user interface that allows you00:12:53
to simplify the process of creating a00:12:56
rule so it's really very simple you00:12:58
specify whether it's an alert or uh00:13:00
whether you want to log it etc you then00:13:02
specify the protocol00:13:04
right so you know we can say tcp in this00:13:07
case we can say any00:13:09
uh00:13:10
any uh you know any connection from any00:13:12
address into our home network so we'll00:13:15
specify the variable so home00:13:17
network so you can see it provides you00:13:19
the fields and you can easily specify or00:13:21
create your rule and at the bottom you00:13:23
can actually copy it and paste it within00:13:24
your local dot rules file in this case00:13:27
let's see if we can create a rule for00:13:30
ftp so ftp is on port 21 signature id00:13:34
we'll give that00:13:36
1003 revision number one00:13:39
we can also specify the rule message00:13:41
here so we can say in this case ftp00:13:44
authentication00:13:46
uh00:13:49
attempt00:13:50
right and we can also uh we can also00:13:53
limit the actual or we can also specify00:13:56
what ip we're interested in so instead00:13:58
of looking for all ftp connections00:14:00
coming into the the actual network we00:14:03
can specify only alert us when there's00:14:05
an ftp connection made to a specific ip00:14:08
within our network so in this case we00:14:10
can specify the ip address of the00:14:13
actual metasploitable 2 virtual machine00:14:15
ftp authentication attempt on ms200:14:19
right and we can then specify additional00:14:22
options uh if we require them in this00:14:25
case i'm just going to copy that there00:14:27
and we'll go back here and we'll just00:14:29
terminate snort00:14:31
and we'll go into our rules here00:14:34
and i'll say insert paste that in there00:14:36
let me just make sure that that is00:14:37
displayed correctly00:14:39
and there aren't any issues yep that00:14:41
looks good so snoppy is really useful in00:14:43
this way write in quit and we'll start00:14:46
up snort again00:14:47
and i'm just going to make or you know00:14:50
we can actually authenticate with uh00:14:52
that00:14:53
with kali linux00:14:55
with ms2 with kali linux so i'll say00:14:57
exit ftp00:15:01
192.168.2.15700:15:04
on port 21 hit enter00:15:07
msf admin00:15:09
msf00:15:11
msf admin there there we go etc all00:15:15
right so let me switch back over00:15:17
here we are00:15:19
you can see that in this case when we00:15:21
started it it looks like there was an00:15:23
ssh authentication attempt00:15:26
uh00:15:27
i believe that is the case that was on00:15:29
port 22. i'm not really sure why that00:15:31
was logged but uh hey ho as you can see00:15:34
it actually logged the actual ftp00:15:36
authentication attempt on the00:15:37
metasploitable 2 system so from this00:15:41
example or exercise you can start to get00:15:44
a feel and understand as to how robust00:15:46
snort rules can be00:15:48
and this is obviously made evident by00:15:51
the you know by the really awesome rules00:15:54
that are written by the community and by00:15:55
snot themselves00:15:57
all right so again i would recommend00:15:59
taking a look at snoppy if you want to00:16:01
learn how to write your own rules00:16:02
another great resource to learn how to00:16:04
write your own rules is to like is to00:16:06
take a look at the rules00:16:07
written by the community00:16:09
so00:16:11
let's take a look at a few examples now00:16:14
the first thing we would need to do of00:16:15
course is to disable or enable the rules00:16:18
we had disabled00:16:20
within the configuration file so i'll00:16:22
just uh modify that file now00:16:25
and00:16:26
we are sorry that is still the rules00:16:28
file um we want to modify the snot.conf00:16:32
file00:16:33
and we want to head over to the lines00:16:35
that we had commented right because00:16:38
those rules are very very important so00:16:40
we want to uncomment the ones we had00:16:42
commented earlier on so in order to do00:16:44
this with vim we're just going to00:16:46
uh specify the start line which was 57800:16:50
and00:16:51
69600:16:52
for the end line and we are then going00:16:54
to say of the start of the line that00:16:57
begins with a hash or a pound00:17:00
just get rid of that00:17:02
hit enter that gets rid of the comment00:17:05
for the rules that we had initially00:17:07
commented so it'll still maintain the00:17:08
initial comments uh you know that were00:17:11
specified by default so let's write in00:17:14
quit00:17:15
and let's take a look at the community00:17:17
rules offered by snot so if you head00:17:20
over into your browser on snort.org you00:17:22
can actually download rules00:17:24
right00:17:25
there we are00:17:26
and right over here as you can see00:17:30
for snot version 3 you have the ability00:17:31
to download those rules and for snot00:17:33
version 2. 2.9 you can download those00:17:36
rules there00:17:37
so you can click on that00:17:40
and you can open up your downloads00:17:42
directory and you can extract that00:17:44
ideally it's recommended to extract that00:17:46
within the actual etsy snort rules00:17:48
directory but i'll just show you an00:17:50
example as to how you can learn how to00:17:52
write really complex rules and the00:17:55
options afforded to you00:17:56
right so i'll extract this here00:17:59
this will contain00:18:00
a snort dot configuration file based on00:18:03
the rules00:18:05
on on these particular community rules00:18:07
so if you take a look there00:18:09
you can see that it still00:18:11
utilizes the local.rules file and then00:18:14
of course it has all of these other00:18:15
rules here00:18:17
and if we take a look at them closely00:18:20
i think we would need to include them00:18:22
but what we can do is we can identify00:18:24
the rules that we're looking for as an00:18:26
example in this case00:18:28
they're going to be under00:18:29
community.rules there we are00:18:32
so00:18:33
this is essentially a set of rules00:18:36
that allows you to detect exploits00:18:39
intrusions for specific cves malware00:18:43
malware network activity so you know for00:18:46
example in this case you can see that00:18:48
alert00:18:50
you know for tcp connections coming from00:18:52
an external network into the home00:18:54
network subnet uh on port 7597 then that00:18:58
is logged as malware backdoor qac worm00:19:01
client login success00:19:03
and you can also specify the tcp uh you00:19:06
know the actual tcp flow and the actual00:19:08
state i'll get to that with snope in a00:19:11
second00:19:12
but one really cool example i can00:19:14
showcase here is the eternal blue attack00:19:16
right so eternal blue i can search for00:19:18
that alert here you and what i'll do00:19:21
here is let me just open up my00:19:22
preferences so you can actually see it00:19:24
there we are00:19:26
so this is the eternal blue alert so00:19:28
eternal blue is a windows exploit of00:19:30
vulnerability within when the windows00:19:32
smb00:19:33
version one00:19:35
that allows you to perform remote code00:19:36
execution so i can spin up a windows 700:19:40
virtual machine and we can try and00:19:42
exploit it with00:19:44
uh with metasploit from the kali linux00:19:46
system and we can add this rule to our00:19:49
custom rule or to the local dot rules00:19:52
file and you can actually be able to00:19:54
tell that snot will be able to identify00:19:57
that as that exploitation process as an00:20:00
intrusion or malicious now one of the00:20:03
great things with snort rules is that00:20:05
allow you to also specify this a00:20:07
reference point so you can specify the00:20:09
cve code00:20:10
as well as the the url where you can00:20:12
actually read more about a specific00:20:14
vulnerability so what i'll do is i'll00:20:17
copy this and we'll modify00:20:19
the actual rule local.rules file i'll00:20:21
put it in there as i said you can you00:20:24
can actually copy that community.rules00:20:26
file00:20:27
into the actual etsy uh00:20:30
etsy snort rules directory and load00:20:33
those rules as well but i typically like00:20:35
loading the ones that i'm interested in00:20:37
especially if you're learning this is00:20:38
really a really cool way so we can put00:20:40
it in there the only thing you need to00:20:41
make sure you do is make sure that the00:20:44
signature is unique or the signature id00:20:46
right and uh that looks fine so you can00:20:50
see what's happening here is we're00:20:51
saying00:20:52
what we're telling snot to do is alert00:20:54
us if there's any tcp connection coming00:20:56
from any network into our home network00:20:59
that connects to any device on our home00:21:01
network on port 44500:21:03
whereby the flow is the the actual flow00:21:06
is you can see to the server established00:21:08
so that's the tcp state and the content00:21:11
this is where you would specify the00:21:13
signature so based on the content00:21:15
contained within a packet00:21:17
that is used to perform the eternal blue00:21:20
exploit this is where you specify the00:21:22
signature so in this case you can see00:21:24
it's uh in this it looks like it's uh00:21:26
hexadecimal and then of course you have00:21:29
the byte extract there etc etc we're not00:21:32
going to be exploring how to write00:21:33
complex uh rules uh you know based on00:21:36
specific exploit signatures but00:21:38
most of them have already been written00:21:40
for you so you can actually test them00:21:41
out on your network another good example00:21:43
of this is let's see if we can identify00:21:45
whether the latest vulnerability log4j00:21:48
there we go so you can see an alert has00:21:50
been made for log4j and you can now00:21:53
start to see the power of snot and the00:21:55
actual snort rules because if you use00:21:58
the latest version of this00:21:59
community.rules file then that means00:22:01
that you're up to date with the latest00:22:03
vulnerabilities and you'll be able to00:22:04
detect them as they occur on your00:22:06
network which is absolutely fantastic so00:22:10
let's just use this simple example00:22:12
so i'm going to write in quit00:22:15
right00:22:16
and we can actually start it up so00:22:19
uh we're going to start up snort here00:22:22
and i'll hit enter so i'm going to fire00:22:24
up the windows 7 virtual machine for the00:22:27
purpose of this demonstration00:22:29
and i'll then switch over to kali we can00:22:31
exploit the vulnerability and see00:22:33
whether it's logged right over here on00:22:35
our console so let me just fire up the00:22:37
vm00:22:39
all right so uh we have snot running00:22:41
i've started up the windows vm i know00:22:43
the ip address00:22:45
and i'm currently on the kali linux00:22:47
virtual machine and we're going to be00:22:49
utilizing a popular exploitation00:22:51
framework called metasploit uh that00:22:53
already contains a pre-built00:22:54
exploitation module that allows me to00:22:56
exploit the eternal blue vulnerability00:22:59
on affected versions of windows windows00:23:01
7 being one of them so you know in this00:23:04
scenario just assume that you had a00:23:06
windows 7 system on your network and it00:23:09
was vulnerable to eternal blue00:23:11
and you know an attacker had gained00:23:13
access and you know you would be able to00:23:15
essentially identify that this attack00:23:17
was being performed so i'll just say use00:23:19
that module here so i'll say use paste00:23:22
that in there and for this module the00:23:24
only option i need to set is the target00:23:26
ip so this is the ip of the windows vm00:23:29
so the ip address is 192.168.2.3500:23:35
and i can then hit exploit right and00:23:37
this should provide me with elevated00:23:39
privileges on the windows system if00:23:41
successful00:23:42
so based on the way this exploit works00:23:46
i should be able to detect this attack00:23:48
as a defender by taking a look at the00:23:50
alerts generated by snort based on the00:23:53
rule that we created right and if we had00:23:56
implemented or loaded the entire set of00:23:58
rules within the community or rules file00:24:01
then this would be the case anyway but00:24:02
again i just wanted to showcase how you00:24:05
can also uh you know identify specific00:24:07
cves and vulnerabilities and exploits00:24:10
right so let me just switch over back00:24:12
into the ubuntu vm00:24:14
and there we are you can actually see it00:24:16
live so00:24:18
there we are we have uh based on the00:24:20
other rules that we had enabled we have00:24:22
a few other alerts here so you can see00:24:25
bad traffic potentially bad traffic and00:24:27
then of course we have that rule here00:24:29
the eternal blue00:24:31
alert is generated so os microsoft00:24:33
windows smb remote code execution00:24:35
attempt classification attempted00:24:37
administrator privilege gain priority00:24:39
one where the attack came from and it's00:24:42
the the port it came from and the actual00:24:45
ip address of the windows system on port00:24:47
445 and they're going to be multiple00:24:49
alerts because the exploit sends00:24:51
multiple packets and of course we have00:24:54
these additional ones so you can see in00:24:56
order for this to work because this00:24:57
exploit targets smb uh you can see there00:25:00
we are we have a net bios alert that00:25:02
tells us that uh an smb ipc share was00:25:06
accessed by the following ip00:25:08
so you can actually see how useful this00:25:11
is00:25:12
so i'm just going to terminate the00:25:14
exploit and we can take a look at the00:25:16
final section of what i wanted to cover00:25:19
all right so the final um00:25:22
the final section that i wanted to00:25:24
highlight was logging and where all of00:25:26
this information is being saved00:25:28
so if you uh let me just terminate snot00:25:31
here if you take a look at the command that00:25:33
we used to run snot you can see that all00:25:35
logging was uh all the logs were saved00:25:37
and under var log snot right however the00:25:41
actual um00:25:43
the actual alerts were displayed on the00:25:45
console so the only thing that was00:25:47
logged was the traffic which is very00:25:50
important to understand so let's open up00:25:52
my file browser here and if i go into00:25:55
the var log directory so var log and we00:25:58
go into snort we'll be able to see some00:26:01
interesting files00:26:02
so these are all the log files that were00:26:06
created by snort00:26:08
and these are essentially the this is00:26:10
essentially the raw packet capture on00:26:12
the network so this doesn't have any00:26:13
alerts attached to it uh and these can00:26:16
be accessed with wireshark now in order00:26:19
to access these log files you need to00:26:21
run wireshark as root because these are00:26:24
owned by the root user so we'll say sudo00:26:26
wireshark and i'll show you that you00:26:28
know00:26:29
snot really really is extremely powerful00:26:31
so i'll say file00:26:34
open and i'll go to my computer and i'll00:26:36
say var00:26:38
log00:26:39
and we'll head over into00:26:41
snort00:26:43
and we'll open up the latest one that00:26:44
contained the actual windows smb traffic00:26:48
so i'll say open00:26:49
and there we are so all the packets were00:26:51
captured directly or immediately from00:26:53
the actual smb exploit and you can see00:26:56
uh you know all that traffic was00:26:58
captured so the all the packets have00:27:00
been captured that's not a problem00:27:02
uh i want to cover how to log00:27:06
the actual alerts right and any other00:27:08
type of um00:27:10
either alerts or uh00:27:12
you know if you want to log all alerts00:27:15
because this the actual alerts are00:27:17
pretty much the most important piece of00:27:19
information and if you're not logging00:27:21
them you should be so in order to log00:27:24
them what you need to do is we'll use00:27:26
the same format where we specify00:27:28
acquired mode we're logging into the00:27:30
following directly00:27:31
under the following directory however00:27:34
for the actual um00:27:36
for the actual uh let me just show you00:27:38
this right now so00:27:40
man snot for the actual00:27:43
alert mode we are going to be using00:27:44
either fast fall or none in the case of00:27:47
fast this will write the alert to the00:27:49
default alert file in a single line00:27:51
syslog style and that message that is00:27:53
the preferred format if you're going to00:27:55
be using these logs or importing them00:27:58
into tools like splunk00:28:00
so in order to do that we're going to00:28:02
say instead of console we're going to00:28:04
say fast as an example right00:28:06
so let me just type that in here and00:28:09
i'll hit enter00:28:10
and let me see if i can generate some00:28:13
traffic so let me just generate some00:28:15
traffic00:28:17
all right so i've generated some traffic00:28:19
and you might be thinking to yourself00:28:22
what on earth is happening you've00:28:24
generated traffic or you know you've00:28:25
performed a few pings and you've00:28:27
connected to the ftp server on the00:28:29
metasploitable to virtual machine why00:28:31
isn't anything being displayed here well00:28:33
that's because00:28:35
we specified to snort that hey i want00:28:38
you to log i want you to log all alerts00:28:42
under the following uh using the the00:28:44
actual alert method00:28:47
um and of course this is the alert mode00:28:49
in this case we specified the alert mode00:28:50
as fast which is the preferred format00:28:53
under the var log snot00:28:55
directory so00:28:56
we were already in that directory and we00:28:58
can see it right over here so it's00:29:00
generated a00:29:01
uh it's generated a log file called alet00:29:04
so if we open this up00:29:05
there we are we get the the actual00:29:08
traffic that i had00:29:09
had essentially generated where i00:29:11
performed a few pings based on the rules00:29:13
that i gener that had actually created00:29:15
we have an we had an ftp authentication00:29:18
attempt and some potentially bad traffic00:29:20
right over there00:29:21
so now at this point you know we can00:29:25
utilize this format00:29:27
uh00:29:28
this this logging format to essentially00:29:30
import this into tools like into tools00:29:33
like splunk00:29:34
so00:29:35
again00:29:36
once you've got all of these logs they00:29:38
can be analyzed you know on this system00:29:40
or as i said you can configure a00:29:43
log forwarder to essentially have them00:29:46
dynamically loaded have the latest logs00:29:48
or alerts dynamically loaded onto a tool00:29:51
like splunk for analysis and at that00:29:54
point then you'd essentially be able to00:29:55
know what was happening on your network00:29:58
in regards to attacks and intrusions00:29:59
directly from splunk which is absolutely00:30:02
fantastic00:30:04
so that is going to be it in regards to00:30:06
what i wanted to cover we've covered00:30:08
quite a lot hopefully by this point you00:30:10
should know how to get snot installed00:30:12
how to uh how to customize and configure00:30:15
it how to create your own rules how to00:30:17
load in community rules how to write00:30:20
rules uh and of course how to log00:30:23
you know the actual00:30:24
alerts that you've captured as well as00:30:26
the packets that you are capturing00:30:29
with that being said uh let me just00:30:31
switch back over to the slides00:30:34
all right so uh as a parting note all00:30:37
the links and resources00:30:39
are used in this video will be added to00:30:42
the description section of this video so00:30:44
you can check them out uh you'll also be00:30:47
provided with access to the slides as a00:30:49
reference so that you can actually00:30:50
navigate uh you can actually navigate00:30:53
through this video if you have any00:30:54
questions or suggestions leave them in00:30:56
the comments section00:30:57
or you can reach uh you can reach out to00:30:59
me and the hackersploit community on our00:31:02
discord server the link to that is also00:31:04
in the description00:31:05
in the next video we're going to be00:31:06
taking a look at threat detection with00:31:09
wazoo00:31:10
with that being said i will be seeing00:31:12
you in the next video00:31:15
i just want to take a couple of moments00:31:17
to thank our patreons thank you michael00:31:19
hubbard dustin umpress jerry speds doozy00:31:23
sid saab ryan carr shamir douglas jojo00:31:27
bibi balangos kushkev rs00:31:31
boykov and david bricker you guys are00:31:33
really awesome thank you very much for00:31:35
supporting us and you guys make these00:31:38
types of videos possible so we really00:31:40
appreciate it and we look forward to00:31:42
producing even more high quality content00:31:50
[Music]Description:
This video covers the process of using custom and community Snort rules. An IDS is a system/host planted within a network to capture traffic and identify malicious activity based on predefined rules, after which, this malicious activity is logged, and a notification is sent to the relevant parties informing them of an intrusion. You can register for part 2 of this series for free here: https://event.on24.com/eventRegistration/EventLobbyServlet?target=unavailable.jsp&eventid=3731394&sessionid=1&partnerref=hackersploit&format=fhvideo1&contenttype=&username=&key=5E35929407F163502826CBE7896D85D5&errorcd=eventnotactive&msg=event+not+active //LINKS Snort Website: https://www.snort.org/ Snorpy Rule Generator: http://www.cyb3rs3c.net/ Video Slides: https://docs.google.com/presentation/d/1CNc_WTxe2B_OdKzZV0ndAZtdIwGoZvDE/edit?usp=sharing&ouid=116946387936310747035&rtpof=true&sd=true Register For Part 2 Of This Series: https://event.on24.com/eventRegistration/EventLobbyServlet?target=unavailable.jsp&eventid=3731394&sessionid=1&partnerref=hackersploit&format=fhvideo1&contenttype=&username=&key=5E35929407F163502826CBE7896D85D5&errorcd=eventnotactive&msg=event+not+active Get 100$ In Free Linode Credit: https://login.linode.com/signup?promo=HACKER22LL //PLATFORMS BLOG ►► https://hackersploit.org/ FORUM ►► https://forum.hackersploit.org/ ACADEMY ►► https://hackersploit.academy/ //SOCIAL NETWORKS TWITTER ►► https://bit.ly/3sNKXfq DISCORD ►► https://discord.com/invite/rumzvY2Jqc INSTAGRAM ►► https://www.facebook.com/unsupportedbrowser LINKEDIN ►► https://www.linkedin.com/company/18713892 PATREON ►► https://www.patreon.com/hackersploit MERCHANDISE ►► https://hackersploitofficial.creator-spring.com/ //BOOKS Privilege Escalation Techniques ►► https://www.amazon.com/Privilege-Escalation-Techniques-exploiting-Windows/dp/1801078874 Docker Security Essentials (FREE) ►► https://www.linode.com/content/hackersploit-docker-security-essentials-ebook/ //SUPPORT THE CHANNEL NordVPN Affiliate Link (73% Off) ►► https://nordvpn.com/creator/?coupon=hacker Get $100 In Free Linode Credit ►► https://login.linode.com/signup?promo=HACKER22LL Get started with Intigriti: https://login.intigriti.com/account/register?ReferralCode=hackersploit //CYBERTALK PODCAST Spotify ►► https://open.spotify.com/show/6j0RhRiofxkt39AskIpwP7 Apple Podcasts ►► https://podcasts.apple.com/us/podcast/cybertalk-the-cybersecurity-podcast/id1490558117 //WE VALUE YOUR FEEDBACK We hope you enjoyed the video and found value in the content. We value your feedback, If you have any questions or suggestions feel free to post them in the comments section or contact us directly via our social platforms. //THANK YOU! Thanks for watching! Благодарю за просмотр! Kiitos katsomisesta Danke fürs Zuschauen! 感谢您观看 Merci d'avoir regardé Obrigado por assistir دیکھنے کے لیے شکریہ देखने के लिए धन्यवाद Grazie per la visione Gracias por ver شكرا للمشاهدة ----------------------------------------------------------------------------------- #Cybersecurity#BlueTeam
Preparing download options
* — If the video is playing in a new tab, go to it, then right-click on the video and select "Save video as..."
** — Link intended for online playback in specialized players
Questions about downloading video
How can I download "Intrusion Detection With Snort" video?
http://unidownloader.com/ website is the best way to download a video or a separate audio track if you want to do without installing programs and extensions.
The UDL Helper extension is a convenient button that is seamlessly integrated into YouTube, Instagram and OK.ru sites for fast content download.
UDL Client program (for Windows) is the most powerful solution that supports more than 900 websites, social networks and video hosting sites, as well as any video quality that is available in the source.
UDL Lite is a really convenient way to access a website from your mobile device. With its help, you can easily download videos directly to your smartphone.
Which format of "Intrusion Detection With Snort" video should I choose?
The best quality formats are FullHD (1080p), 2K (1440p), 4K (2160p) and 8K (4320p). The higher the resolution of your screen, the higher the video quality should be. However, there are other factors to consider: download speed, amount of free space, and device performance during playback.
Why does my computer freeze when loading a "Intrusion Detection With Snort" video?
The browser/computer should not freeze completely! If this happens, please report it with a link to the video. Sometimes videos cannot be downloaded directly in a suitable format, so we have added the ability to convert the file to the desired format. In some cases, this process may actively use computer resources.
How can I download "Intrusion Detection With Snort" video to my phone?
You can download a video to your smartphone using the website or the PWA application UDL Lite. It is also possible to send a download link via QR code using the UDL Helper extension.
How can I download an audio track (music) to MP3 "Intrusion Detection With Snort"?
The most convenient way is to use the UDL Client program, which supports converting video to MP3 format. In some cases, MP3 can also be downloaded through the UDL Helper extension.
How can I save a frame from a video "Intrusion Detection With Snort"?
This feature is available in the UDL Helper extension. Make sure that "Show the video snapshot button" is checked in the settings. A camera icon should appear in the lower right corner of the player to the left of the "Settings" icon. When you click on it, the current frame from the video will be saved to your computer in JPEG format.
What's the price of all this stuff?
It costs nothing. Our services are absolutely free for all users. There are no PRO subscriptions, no restrictions on the number or maximum length of downloaded videos.