Snort'ing Out Anomalies

Detecting determined attackers focused on getting your data -- and getting away with it is not an easy task. To that end, many security products have been created that attempt everything from separation of privileges and tight access control to full network packet inspection and data loss prevention.But there's a lot to be said for simply knowing your network inside and out so you know exactly what's normal and what isn't.

However, our time as security professionals is getting to be more and more scarce as we have more threats and attacks to deal with...like Adobe zero days and the latest rogue antivirus. One of the things that intrusion detection systems can do for you is not only detect attacks, but also provide information that helps you understand what's going on within your network, and even provide a forensic resource during investigations.

I have a few different examples that are based on real-world examples that I've dealt with, and some after-hours research. The first is Snort rules looking for Web browser User Agent strings to identify what Web browsers are being used on your network. Monitoring for new User Agents (Emerging Threats User Agent Snort rules) on your network can identify rogue applications in use by users or indicate a malware infection.

For a long time, I would use the Snort rule for wget, a command line Web fetching tool primarily used on Linux, to identify compromised systems. Once an attacker compromised a Unix-based system via something like a weak password, he would then download its tools using wget. I'd then download the same tools to analyze and have a jump-start to knowing what was done on the compromised system.

Years later, that same wget Snort rule worked for identifying malware infections that used a wget User Agent. Having User Agent rules in place could help pick up users who have installed or are running unauthorized "portable" Web browsers from a U3 USB drive to get around certain network restrictions.

Another interesting application of IDS for learning about your network and potentially catching bad things is similar to a poor man's data loss prevention (DLP) tool. There are already Snort rules for catching Social Security Numbers and credit cards, but looking for compressed files is something that could lead to detection of an attacker exfiltrating data from your network.

There are a handful of Snort rules available free from the Emerging Threats project that look for Zip files as they are transferred over the network (Emerging Threats Policy Snort rules). There are even a few that look for common Microsoft documents inside of the Zip files. There are not many rules for Rar, CAB, and other compressed file formats, but the Zip files are easy to copy and modify to match the other formats.

Encryption will make these rules practically useless, but that is something else you might detect that could be indicative of anomalous behavior and clue you in to something being amiss.

There are many different ways to monitor network traffic to learn what's normal and not. Network flow data is another. Depending on your environment, your options will vary, but the effort will not be wasted and will likely net you much success in detecting attacks, both internal and external.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.