JWP-Binde-McRee-OConnor

Assessing Outbound Traffic to Uncover Advanced Persistent Threat
●
monitor for precursor attacks
In the RSA breach, the data was obscured by the use of RAR files. The Emerging Threats
(formerly Bleeding Snort) group published two useful signatures for detecting RAR files leaving
the network. [Emerging Threats, 2008]
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY RAR
File Outbound"; flow: established; content:"|52 61 72 21|";
offset: 0; depth: 4; tag: session; classtype: not-suspicious;
sid: 2001950; rev:3;)
Should an enterprise determine that a RAR file should never egress from a given network
segment, fwsnort [Rash, 2010] could be utilized on iptables firewall-based systems to block the
traffic based on the signature; fwsnort translates Snort rules into iptables rules, then generates a
shell script which in turn implements the resulting iptables commands.
The converted example based on the ET POLICY RAR File Outbound signature above
would be derived as follows. Note SID 2001950 to follow the process logic from the signature
above to the fwsnort parsing to the iptables blocking script.
Executing $ fwsnort --snort-sid 2001950 would result in:
[+] Parsing Snort rules files...
[+] Found sid: 2001950 in emerging-all.rules
Successful translation.
[+] Logfile: ./fwsnort.log
[+] iptables script: ./fwsnort.sh
The resulting fwsnort.sh script would include:
$IPTABLES -A FWSNORT_FORWARD_ESTAB -p tcp -m string --hex-string
"|52617221|" --algo bm --from 64 --to 68 -m comment --comment
"sid:2001950; msg:ET POLICY RAR File Outbound; classtype:notsuspicious;
rev:3; FWS:1.1;" -j LOG --log-ip-options --log-tcpoptions
--log-prefix "[1] SID2001950 ESTAB "
$IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp -m string --hex-string
"|52617221|" --algo bm --from 64 --to 68 -m comment --comment
"sid:2001950; msg:ET POLICY RAR File Outbound; classtype:notsuspicious;
rev:3; FWS:1.1;" -j LOG --log-ip-options --log-tcpoptions
--log-prefix "[1] SID2001950 ESTAB "
In particular the fwsnort logic is keying on the hexadecimal content defined in the signature.
Page 25