Instructor: Security appliances. 2 2
In this lesson, 3 3
we're going to do some analysis of security appliances. 4 4
Specifically, we're going to be looking at a SIEM 5 5
known as Security Onion. 6 6
Now we also know how to do packet analysis 7 7
using things like Wireshark, right? 8 8
But by doing that we spend a lot of time 9 9
because we have to capture all those packets 10 10
and then search through them individually, line by line, 11 11
until we find the malicious packet that we're looking for. 12 12
Well, we've also talked about IDS's and IPS's, 13 13
which go ahead and use signatures 14 14
to detect those things inside the packet 15 15
and so we can use that to then log inside of a SIEM 16 16
and that way we can look through it 17 17
and identify what we want quicker. 18 18
When we use Security Onion 19 19
it has a lot of different security tools inside of it 20 20
because it is a security information 21 21
and event management system or a SIEM. 22 22
It includes things like Snort, Suricata, and Zeek, 23 23
also known as Bro, to be able to be used as an IDS package. 24 24
Plus, we have the ability to process and analyze 25 25
all these different alerts that they generate. 26 26
So in this lab we're really going to focus on 27 27
learning how to use some of these tools 28 28
inside of Security Onion. 29 29
Now the first thing we're going to do is configure sniffing. 30 30
If you look at my network here, 31 31
you're going to see that we have a bunch of switches 32 32
and a couple of routers and we have a SIEM, 33 33
a DC, and a LAMP server. 34 34
Now as we look at this network 35 35
we want to be able to deploy our IDS, 36 36
and to do that we have to make sure we have sniffing enabled 37 37
and we're on a port that allows us to do that. 38 38
So, you can see I have that sensor line going 39 39
from vLocal into SIEM1. 40 40
And this is allowing us to tap that network and be able 41 41
to identify the different traffic going across it. 42 42
So once I've configured that sensor and I've attached it, 43 43
I'm now going to be able to start seeing all the traffic 44 44
going across this part of the network. 45 45
In this case, what network am I looking at? 46 46
I'm looking at the 10.1.0.0/24, 47 47
which in this case has the domain controller of DC1 48 48
which is a Windows domain controller 49 49
on the IP address of 10.1.0.1. 50 50
Now as we go into SIEM1, 51 51
we're going to start looking at some things 52 52
and we're going to start out with using Sguil. 53 53
Now, Sguil is an application inside of Security Onion 54 54
and it's the way that we're going to be able to deal 55 55
with realtime alerts. 56 56
So as things are being generated 57 57
by different detection systems. 58 58
Sguil will be able to see those 59 59
and then we can view those alerts 60 60
and identify different options 61 61
to pivot between analysis tools 62 62
to be able to look at the different indicators. 63 63
So I can go from packet analysis to log entries 64 64
and things like that. 65 65
Now the first thing I have to do 66 66
when I start up Sguil is log in 67 67
and so I'm going to log into it using SIEM 68 68
and my password of password. From here, 69 69
I'm going to select the network I want to monitor, 70 70
in my case it's SIEM-eth1 71 71
and then I'm going to click start Sguil. 72 72
Now, once I do this 73 73
it's already going to bring some information up. 74 74
Now this isn't live information, 75 75
instead this is just showing me what the tool will look like 76 76
based on some sample packet captures it already has. 77 77
Now if you see on the left side 78 78
there's that color coded priority, this is the ST field. 79 79
This is going to tell us the priority for each of those alerts. 80 80
Red is going to be the highest priority, 81 81
yellow is going to be a little bit less, 82 82
and then you can keep going down the scale from there. 83 83
Now as we start looking at all these different alerts, 84 84
we can see they occurred within a very close time period 85 85
because of the way these samples 86 86
were replayed through the sensor. 87 87
Now, if I select the first alert here, I can go to ID 3.19. 88 88
Now as I look at that 89 89
you're going to notice the event message here. 90 90
The ET is going to identify 91 91
the rule set that produced this match. 92 92
Essentially, what was that signature? 93 93
So on the right hand side, you see 94 94
this was a scan that had potential SSH vulnerabilities. 95 95
Now the next thing we're going to look at 96 96
is in the lower right hand panel, 97 97
and if you check the show rule box, 98 98
you're going to be to see the rule that created this alert. 99 99
So this is basically an IDs or snort rule. 100 100
Notice it says alert tcp $HOME_NET 101 101
any to the external network over port 22. 102 102
And then the message is ET SCAN Potential SSH Scan OUTBOUND. 103 103
And this tells you what this rule is looking for. 104 104
This format should be familiar to you 105 105
because we've gone through what an IDS rule looks like. 106 106
So what is this rule trying to do for us? 107 107
Well, it's trying to detect any connection 108 108
going from the internal network, HOME_NET, 109 109
to the external network over port 22. 110 110
Is somebody trying to go outbound with SSH? 111 111
If so, it's going to go ahead and log this rule. 112 112
Now if we continue looking at this rule, 113 113
you'll see the count says five and the seconds is 120. 114 114
What does that mean? 115 115
This rule will only fire if it sees 116 116
five packets going to port 22 within 120 seconds. 117 117
So if they're trying to connect to port 22 118 118
five times within two minutes 119 119
then it's going to go ahead and alert for us. 120 120
Now note, if we go to 3.20 121 121
we see there's another match for the same rule. 122 122
If we go down to 3.27, there's a match for an NMAP scan. 123 123
Remember, the purpose of Sguil 124 124
is to be able to manage these events as they come in. 125 125
So, as you get an event and you see this alert 126 126
you can right click on those fields 127 127
to bring up contextual menus 128 128
with different types of actions. 129 129
For instance, if I right click on the value of four 130 130
in the CNT field for the alert of 3.27, that NMAP scan, 131 131
I can then select view correlated events. 132 132
This is going to show me the individual packets 133 133
that were identified as that single event 134 134
and I can go through and do 135 135
a real basic packet analysis here. 136 136
Then I can click close. 137 137
Let's right click on the value of 3.27 138 138
in the alert ID field. 139 139
This way I can view the menu options 140 140
without selecting anything. 141 141
Now, this is going to allow me to pivot 142 142
to viewing other source data 143 143
in a tool such as as Wireshark, NetworkMiner, 144 144
or even Bro, which is at IDS. 145 145
All right, let's go ahead and press escape 146 146
and that'll cancel the menu. 147 147
Now if I right click on the value in source IP 148 148
I can view menu options here as well. 149 149
This allows me to pivot to information already stored 150 150
about that value elsewhere in the database. 151 151
So I might do a Cabana lookup 152 152
or search for it using an internet threat intelligence 153 153
and that way I can say, 154 154
"What do I know about this IP address? 155 155
Is this something that's been attacking me before? 156 156
Is this something that's been attacking 157 157
the rest of the world?" 158 158
And it gives me those details. 159 159
Next, I can right click on the value in the ST field 160 160
and from here I can click update event status, 161 161
Cat VI: Reconnaissance, Probes, and Scans. 162 162
Now if I press F6, this will categorize 163 163
the other scan alerts in the exact same way. 164 164
This is how I can say, "I've seen this, 165 165
I've looked at it, and I know what it is." 166 166
It was reconnaissance, a probe, or a scan. 167 167
It's a CAT VI vulnerability. 168 168
So this is the basic way to be able to use Sguil 169 169
and there's lots of other ways to go through 170 170
and learn about this. 171 171
I do recommend that you download Security Onion 172 172
and play with it on your network. 173 173
Now, let's go through 174 174
and analyze and prioritize some events. 175 175
When we get an alert that's presented as a high priority 176 176
by a rule set, you want to prioritize it for investigation. 177 177
Now if I look at alert 3.35, 178 178
note here that we have a higher packet count 179 179
as a large amount of data was being downloaded. 180 180
If I right click on the value of 3.35 181 181
and select Bro, 182 182
it's going to open that up inside 183 183
of that intrusion detection system 184 184
and so I can analyze that traffic content 185 185
shown in the new window by going through that Bro alert. 186 186
Now notice the content type here, 187 187
It says it's an HTML or text file, 188 188
but if I look at the magic number at the beginning, 189 189
those first couple of bytes 190 190
are going to tell me what type of file it really is. 191 191
So even though it's labeled as a text or HTML file, 192 192
that binary code is showing me it's an executable 193 193
because it says MZ 194 194
and MZ is the magic number for a binary code 195 195
in a Windows executable. 196 196
Now, I can look at this code 197 197
and I can start doing reverse engineering if I copy it out 198 198
and I can extract it using something like 199 199
NetMiner or Wireshark and then run it in a sandbox 200 200
and do some dynamic or static analysis on it. 201 201
This is how we use these tools and we use one tool 202 202
to link to another tool to get to what we want. 203 203
Next, let's go ahead and close that. 204 204
Let's take a look at alerts 3.90 and 3.91. 205 205
Here we can detect a different kind of threat. 206 206
This one is going to reference 207 207
a common vulnerability and exposure number. 208 208
So we have a CVE number associated with it 209 209
and this signature tells us 210 210
that a detected an attempt to exploit 211 211
the shell shock vulnerability to run an arbitrary command 212 212
through a web server shell. 213 213
This again, will be something we'd want to fix 214 214
and so with Squil we can see 215 215
that that attack was occurring on this server 216 216
and then we can verify, are we vulnerable to it or not. 217 217
Now the last set of events we want to look at 218 218
is things from alert 3.95 and beyond. 219 219
This is going to show us another Trojan 220 220
that was being downloaded over port 80, 221 221
and this was followed up by some suspicious outbound traffic 222 222
over port 443. 223 223
So this would be something like 224 224
a piece of malware being downloaded and executed, 225 225
that Trojan is now executed, 226 226
and it's making the connection call out 227 227
back over port 443 to the malicious attacker 228 228
to get its command and control instructions. 229 229
Now, if I right click on the alert value of 3.148, 230 230
I can select Wireshark, and I can analyze that traffic. 231 231
Notice here with port 443, which is HTTPSS. 232 232
We would expect to see a legitimate session, 233 233
starting with the SSL or TLS handshake, 234 234
and then proceed to the exchange of encrypted packets. 235 235
But these packets are using a plain text 236 236
http post connection and an encrypted message. 237 237
Now this tells me there is something wrong with this 238 238
and so we would want to look into this further 239 239
and be able to go through and do more analysis. 240 240
Now let's go ahead and right click on the IP address 241 241
that starts at 24. 242 242
Now, normally we'd want to correlate this IP address 243 243
to a list of bad known entries on a blacklist, 244 244
but this system isn't connected to the internet 245 245
because it's isolated. 246 246
Now most of your commercial SIEMs will be able to 247 247
have the ability to right click on something 248 248
and immediately find out where it is 249 249
based on a local database or an internet connected database. 250 250
But in my case, I'm offline, so I can't do that. 251 251
Let's go ahead and hit escape 252 252
and it's going to cancel that menu. 253 253
Okay, next we want to develop our own custom rule for an IDS. 254 254
To do this, I'm going to open up a terminal 255 255
and go to sudo nano /etc/nsm/rules/local.rules 256 256
and this is going to allow me to go in 257 257
to that rule set file and start making some changes. 258 258
Now, let's go in here and we're going to add a line 259 259
that says # 515support local ICMP detection rules. 260 260
Now, because it has a hashtag at the front 261 261
this is a comment line 262 262
and it's not going to be a process rule, 263 263
just like the couple 264 264
that you see here on the screen already. 265 265
Now, if I want to make an alert that's going to fire, 266 266
I'm going to leave off that hashtag. 267 267
All right, so I'm going to type in alert icmp any any, 268 268
the arrow to the right, $HOME_NET any, 269 269
and then parenthesis, msg"ICMP detected"; 270 270
sid:1000001; 271 271
rev:1; and end the parenthesis. 272 272
Now this rule has a header and a body. 273 273
The header is telling me what it's going to do. 274 274
So alert icmp any any. 275 275
This says anytime you see ICMP traffic going from 276 276
any IP on any port to your HOME_NET 277 277
with any port I want you to send out the body, 278 278
which in this case is the message. 279 279
And so the message is ICMP detected 280 280
and then we have this sid, which is a signature ID, 281 281
and it has to start with the number 1 million or higher. 282 282
And this tells me it's a local rule that I've created, 283 283
and then rev, 284 284
this tells me what revision of this rule it is, 285 285
this is my first revision. 286 286
Each part of your body is going to be separated 287 287
by semicolons and you can have 288 288
lots of different pieces of information in here. 289 289
Now if I want to save that, 290 290
I'm going to hit Control+O and then hit enter, 291 291
that saves the file and then Control+X 292 292
and that will exit the nano program. 293 293
Now, if I want to update this rule 294 294
I have to run the update command 295 295
and I do this by typing in sudo rule-update 296 296
and this will pull in that update 297 297
of those new rules into your intrusion detection system. 298 298
All right, if we want to see if that rule has been loaded 299 299
we can do this using the tail command. 300 300
If you remember in Linux, 301 301
the tail command shows you the last thing inside of a file. 302 302
So I'm going to type tail /etc/nsm/rules/downloaded.rules 303 303
and hit enter here. 304 304
We should see at the end of that file, 305 305
we see our rule that we just entered. 306 306
That's awesome, that means it worked. 307 307
All right, so we've made a rule, we updated it, 308 308
but this rule is not a very good rule. 309 309
Why? Because this rule is going to create 310 310
so much noise in our sensor. 311 311
Anytime somebody pings into your internal network 312 312
it's going to create a huge number of false positives, 313 313
so we want to tune that rule and make it more specific. 314 314
To do this, we're going to go back into nano 315 315
by going sudo nano/etc/nsm/rules/local.rules 316 316
and then we're going to edit that rule that we just made. 317 317
Let's go ahead and edit it so it says 318 318
alert icmp $EXTERNAL_NET any to HOME_NET any 319 319
and the message of external ICMP probe detected. 320 320
And then we are going to keep the rule number 321 321
and we're going to make this revision number two. 322 322
This way, we're only going to log things that go 323 323
from the external network to the internal network. 324 324
This will solve a lot of the false positives 325 325
because I'm really not worried 326 326
if somebody internal to my network 327 327
is pinging things on the network 328 328
'cause we do that all the time for troubleshooting. 329 329
But I am worried if somebody's doing it 330 330
from the external network to my internal network 331 331
because that means they might be doing reconnaissance 332 332
and scanning me. 333 333
All right, let's go ahead and hit Control+O 334 334
and then enter to save the file and then Control+X to exit. 335 335
Again, we need to update the rule 336 336
so we'll use sudo rule-update and hit enter. 337 337
We're going to go back into the terminal 338 338
and I'm going to change another rule. 339 339
So we're going to go back into the NSM rule set 340 340
and this time I want to edit the existing line 341 341
so it looks like this. 342 342
I want to say alert icmp $EXTERNAL_NET any to 343 343
HOME_NET any, and then I want itype:8, semicolon, 344 344
msg: External ICMP probe detected, semicolon, 345 345
detection_filter:track by source, 346 346
count 20, seconds, 30 semicolon priority four, 347 347
semicolon, class type, ICMP event semicolon, 348 348
sid 1,000,001, semicolon, rev3, semicolon. 349 349
Wow, that is a much more complex rule. 350 350
Let's see if we can look at it and see what it does. 351 351
Now when I started out, I used itype:8. What is that? 352 352
Well itype:8 says it only should match 353 353
ping echo requests, not any ICMP, but just pings 354 354
and that's what an itype:8 is. 355 355
Now the detection filter here 356 356
is also going to set a threshold for this alert. 357 357
That's what detection filter does 358 358
and the track method means it's going to keep track 359 359
and over a certain amount of time. 360 360
So what we're trying to find 361 361
is do we find a count of 20 within 30 seconds? 362 362
So if I do 20 pings within 30 seconds 363 363
that is going to classify as an alert. 364 364
If I do 10 pings within 30 seconds 365 365
it's not going to fire this alert. 366 366
That's what we're trying to do. 367 367
So if I perform a basic connection test 368 368
by pinging a server four times, 369 369
I'm not going to trigger the alert this time. 370 370
So let's go ahead and save this, Control+O, enter, 371 371
and then Control+X to exit. 372 372
Now we're going to update our rules again 373 373
by typing sudo rule-update and hit enter. 374 374
So I hope you've enjoyed this lesson 375 375
as we went through Security Onion 376 376
and started playing with some of these tools, 377 377
I do highly recommend downloading Security Onion 378 378
and with Security Onion 379 379
you can actually download existing malware samples 380 380
and different traffic that's already been captured 381 381
for you to play with. 382 382
You can do this by going online and downloading them 383 383
from Security Onion's website 384 384
or if you have one of these Security Onion VMs, 385 385
it's already located in there for you 386 386
under the /OPT/SamplesDirectory. 387 387
And you can use TCP replay 388 388
to actually play back that PCAP file 389 389
through your ethernet connection 390 390
and so that way Sguil will see that and alert on it.