1 1 00:00:00,360 --> 00:00:02,550 Security appliances. 2 2 00:00:02,550 --> 00:00:03,510 In this lesson, 3 3 00:00:03,510 --> 00:00:06,330 we're going to do some analysis of security appliances. 4 4 00:00:06,330 --> 00:00:08,610 Specifically, we're going to be looking at a SIEM 5 5 00:00:08,610 --> 00:00:10,560 known as Security Onion. 6 6 00:00:10,560 --> 00:00:13,080 Now we also know how to do packet analysis 7 7 00:00:13,080 --> 00:00:15,030 using things like Wireshark, right? 8 8 00:00:15,030 --> 00:00:17,580 But by doing that we spend a lot of time 9 9 00:00:17,580 --> 00:00:19,380 because we have to capture all those packets 10 10 00:00:19,380 --> 00:00:21,900 and then search through them individually, line by line, 11 11 00:00:21,900 --> 00:00:24,510 until we find the malicious packet that we're looking for. 12 12 00:00:24,510 --> 00:00:27,420 Well, we've also talked about IDS's and IPS's, 13 13 00:00:27,420 --> 00:00:29,160 which go ahead and use signatures 14 14 00:00:29,160 --> 00:00:31,620 to detect those things inside the packet 15 15 00:00:31,620 --> 00:00:34,800 and so we can use that to then log inside of a SIEM 16 16 00:00:34,800 --> 00:00:36,000 and that way we can look through it 17 17 00:00:36,000 --> 00:00:38,040 and identify what we want quicker. 18 18 00:00:38,040 --> 00:00:39,300 When we use Security Onion 19 19 00:00:39,300 --> 00:00:41,670 it has a lot of different security tools inside of it 20 20 00:00:41,670 --> 00:00:43,590 because it is a security information 21 21 00:00:43,590 --> 00:00:45,870 and event management system or a SIEM. 22 22 00:00:45,870 --> 00:00:49,080 It includes things like Snort, Suricata, and Zeek, 23 23 00:00:49,080 --> 00:00:52,470 also known as Bro, to be able to be used as an IDS package. 24 24 00:00:52,470 --> 00:00:54,600 Plus, we have the ability to process and analyze 25 25 00:00:54,600 --> 00:00:56,730 all these different alerts that they generate. 26 26 00:00:56,730 --> 00:00:58,800 So in this lab we're really going to focus on 27 27 00:00:58,800 --> 00:01:00,360 learning how to use some of these tools 28 28 00:01:00,360 --> 00:01:02,460 inside of Security Onion. 29 29 00:01:02,460 --> 00:01:05,280 Now the first thing we're going to do is configure sniffing. 30 30 00:01:05,280 --> 00:01:06,660 If you look at my network here, 31 31 00:01:06,660 --> 00:01:08,700 you're going to see that we have a bunch of switches 32 32 00:01:08,700 --> 00:01:10,830 and a couple of routers and we have a SIEM, 33 33 00:01:10,830 --> 00:01:12,900 a DC, and a LAMP server. 34 34 00:01:12,900 --> 00:01:14,100 Now as we look at this network 35 35 00:01:14,100 --> 00:01:16,320 we want to be able to deploy our IDS, 36 36 00:01:16,320 --> 00:01:19,440 and to do that we have to make sure we have sniffing enabled 37 37 00:01:19,440 --> 00:01:21,960 and we're on a port that allows us to do that. 38 38 00:01:21,960 --> 00:01:24,090 So, you can see I have that sensor line going 39 39 00:01:24,090 --> 00:01:26,580 from vLocal into SIEM1. 40 40 00:01:26,580 --> 00:01:29,280 And this is allowing us to tap that network and be able 41 41 00:01:29,280 --> 00:01:31,680 to identify the different traffic going across it. 42 42 00:01:31,680 --> 00:01:34,350 So once I've configured that sensor and I've attached it, 43 43 00:01:34,350 --> 00:01:36,270 I'm now going to be able to start seeing all the traffic 44 44 00:01:36,270 --> 00:01:38,250 going across this part of the network. 45 45 00:01:38,250 --> 00:01:40,680 In this case, what network am I looking at? 46 46 00:01:40,680 --> 00:01:44,250 I'm looking at the 10.1.0.0/24, 47 47 00:01:44,250 --> 00:01:47,400 which in this case has the domain controller of DC1 48 48 00:01:47,400 --> 00:01:49,200 which is a Windows domain controller 49 49 00:01:49,200 --> 00:01:52,890 on the IP address of 10.1.0.1. 50 50 00:01:52,890 --> 00:01:54,540 Now as we go into SIEM1, 51 51 00:01:54,540 --> 00:01:56,640 we're going to start looking at some things 52 52 00:01:56,640 --> 00:01:59,310 and we're going to start out with using Sguil. 53 53 00:01:59,310 --> 00:02:02,880 Now, Sguil is an application inside of Security Onion 54 54 00:02:02,880 --> 00:02:04,170 and it's the way that we're going to be able to deal 55 55 00:02:04,170 --> 00:02:05,490 with realtime alerts. 56 56 00:02:05,490 --> 00:02:06,660 So as things are being generated 57 57 00:02:06,660 --> 00:02:08,040 by different detection systems. 58 58 00:02:08,040 --> 00:02:09,780 Sguil will be able to see those 59 59 00:02:09,780 --> 00:02:11,220 and then we can view those alerts 60 60 00:02:11,220 --> 00:02:12,720 and identify different options 61 61 00:02:12,720 --> 00:02:14,400 to pivot between analysis tools 62 62 00:02:14,400 --> 00:02:16,050 to be able to look at the different indicators. 63 63 00:02:16,050 --> 00:02:18,810 So I can go from packet analysis to log entries 64 64 00:02:18,810 --> 00:02:19,980 and things like that. 65 65 00:02:19,980 --> 00:02:21,240 Now the first thing I have to do 66 66 00:02:21,240 --> 00:02:23,130 when I start up Sguil is log in 67 67 00:02:23,130 --> 00:02:25,260 and so I'm going to log into it using SIEM 68 68 00:02:25,260 --> 00:02:27,677 and my password of password. From here, 69 69 00:02:27,677 --> 00:02:29,220 I'm going to select the network I want to monitor, 70 70 00:02:29,220 --> 00:02:32,640 in my case it's SIEM-eth1 71 71 00:02:32,640 --> 00:02:35,310 and then I'm going to click start Sguil. 72 72 00:02:35,310 --> 00:02:36,330 Now, once I do this 73 73 00:02:36,330 --> 00:02:38,400 it's already going to bring some information up. 74 74 00:02:38,400 --> 00:02:39,900 Now this isn't live information, 75 75 00:02:39,900 --> 00:02:42,600 instead this is just showing me what the tool will look like 76 76 00:02:42,600 --> 00:02:45,720 based on some sample packet captures it already has. 77 77 00:02:45,720 --> 00:02:46,740 Now if you see on the left side 78 78 00:02:46,740 --> 00:02:49,740 there's that color coded priority, this is the ST field. 79 79 00:02:49,740 --> 00:02:52,290 This is going to tell us the priority for each of those alerts. 80 80 00:02:52,290 --> 00:02:54,510 Red is going to be the highest priority, 81 81 00:02:54,510 --> 00:02:56,370 yellow is going to be a little bit less, 82 82 00:02:56,370 --> 00:02:59,100 and then you can keep going down the scale from there. 83 83 00:02:59,100 --> 00:03:00,780 Now as we start looking at all these different alerts, 84 84 00:03:00,780 --> 00:03:03,420 we can see they occurred within a very close time period 85 85 00:03:03,420 --> 00:03:04,620 because of the way these samples 86 86 00:03:04,620 --> 00:03:06,600 were replayed through the sensor. 87 87 00:03:06,600 --> 00:03:11,600 Now, if I select the first alert here, I can go to ID 3.19. 88 88 00:03:11,940 --> 00:03:13,140 Now as I look at that 89 89 00:03:13,140 --> 00:03:15,270 you're going to notice the event message here. 90 90 00:03:15,270 --> 00:03:16,710 The ET is going to identify 91 91 00:03:16,710 --> 00:03:18,510 the rule set that produced this match. 92 92 00:03:18,510 --> 00:03:20,730 Essentially, what was that signature? 93 93 00:03:20,730 --> 00:03:22,350 So on the right hand side, you see 94 94 00:03:22,350 --> 00:03:26,610 this was a scan that had potential SSH vulnerabilities. 95 95 00:03:26,610 --> 00:03:27,690 Now the next thing we're going to look at 96 96 00:03:27,690 --> 00:03:29,280 is in the lower right hand panel, 97 97 00:03:29,280 --> 00:03:31,200 and if you check the show rule box, 98 98 00:03:31,200 --> 00:03:34,140 you're going to be to see the rule that created this alert. 99 99 00:03:34,140 --> 00:03:37,680 So this is basically an IDs or snort rule. 100 100 00:03:37,680 --> 00:03:41,310 Notice it says alert tcp $HOME_NET 101 101 00:03:41,310 --> 00:03:44,910 any to the external network over port 22. 102 102 00:03:44,910 --> 00:03:49,170 And then the message is ET SCAN Potential SSH Scan OUTBOUND. 103 103 00:03:49,170 --> 00:03:51,480 And this tells you what this rule is looking for. 104 104 00:03:51,480 --> 00:03:53,070 This format should be familiar to you 105 105 00:03:53,070 --> 00:03:56,190 because we've gone through what an IDS rule looks like. 106 106 00:03:56,190 --> 00:03:58,410 So what is this rule trying to do for us? 107 107 00:03:58,410 --> 00:04:00,630 Well, it's trying to detect any connection 108 108 00:04:00,630 --> 00:04:02,820 going from the internal network, HOME_NET, 109 109 00:04:02,820 --> 00:04:05,670 to the external network over port 22. 110 110 00:04:05,670 --> 00:04:07,920 Is somebody trying to go outbound with SSH? 111 111 00:04:07,920 --> 00:04:10,980 If so, it's going to go ahead and log this rule. 112 112 00:04:10,980 --> 00:04:12,750 Now if we continue looking at this rule, 113 113 00:04:12,750 --> 00:04:16,140 you'll see the count says five and the seconds is 120. 114 114 00:04:16,140 --> 00:04:17,040 What does that mean? 115 115 00:04:17,040 --> 00:04:18,750 This rule will only fire if it sees 116 116 00:04:18,750 --> 00:04:23,370 five packets going to port 22 within 120 seconds. 117 117 00:04:23,370 --> 00:04:25,260 So if they're trying to connect to port 22 118 118 00:04:25,260 --> 00:04:26,820 five times within two minutes 119 119 00:04:26,820 --> 00:04:29,100 then it's going to go ahead and alert for us. 120 120 00:04:29,100 --> 00:04:31,290 Now note, if we go to 3.20 121 121 00:04:31,290 --> 00:04:33,290 we see there's another match for the same rule. 122 122 00:04:33,290 --> 00:04:37,350 If we go down to 3.27, there's a match for an NMAP scan. 123 123 00:04:37,350 --> 00:04:39,060 Remember, the purpose of Sguil 124 124 00:04:39,060 --> 00:04:41,430 is to be able to manage these events as they come in. 125 125 00:04:41,430 --> 00:04:44,100 So, as you get an event and you see this alert 126 126 00:04:44,100 --> 00:04:45,570 you can right click on those fields 127 127 00:04:45,570 --> 00:04:47,070 to bring up contextual menus 128 128 00:04:47,070 --> 00:04:48,840 with different types of actions. 129 129 00:04:48,840 --> 00:04:51,030 For instance, if I right click on the value of four 130 130 00:04:51,030 --> 00:04:55,650 in the CNT field for the alert of 3.27, that NMAP scan, 131 131 00:04:55,650 --> 00:04:58,320 I can then select view correlated events. 132 132 00:04:58,320 --> 00:05:00,180 This is going to show me the individual packets 133 133 00:05:00,180 --> 00:05:02,670 that were identified as that single event 134 134 00:05:02,670 --> 00:05:03,960 and I can go through and do 135 135 00:05:03,960 --> 00:05:06,360 a real basic packet analysis here. 136 136 00:05:06,360 --> 00:05:08,040 Then I can click close. 137 137 00:05:08,040 --> 00:05:10,230 Let's right click on the value of 3.27 138 138 00:05:10,230 --> 00:05:11,880 in the alert ID field. 139 139 00:05:11,880 --> 00:05:13,620 This way I can view the menu options 140 140 00:05:13,620 --> 00:05:15,570 without selecting anything. 141 141 00:05:15,570 --> 00:05:17,310 Now, this is going to allow me to pivot 142 142 00:05:17,310 --> 00:05:18,990 to viewing other source data 143 143 00:05:18,990 --> 00:05:21,630 in a tool such as as Wireshark, NetworkMiner, 144 144 00:05:21,630 --> 00:05:24,150 or even Bro, which is at IDS. 145 145 00:05:24,150 --> 00:05:25,560 All right, let's go ahead and press escape 146 146 00:05:25,560 --> 00:05:27,480 and that'll cancel the menu. 147 147 00:05:27,480 --> 00:05:29,730 Now if I right click on the value in source IP 148 148 00:05:29,730 --> 00:05:31,770 I can view menu options here as well. 149 149 00:05:31,770 --> 00:05:34,050 This allows me to pivot to information already stored 150 150 00:05:34,050 --> 00:05:36,150 about that value elsewhere in the database. 151 151 00:05:36,150 --> 00:05:37,560 So I might do a Cabana lookup 152 152 00:05:37,560 --> 00:05:40,530 or search for it using an internet threat intelligence 153 153 00:05:40,530 --> 00:05:41,363 and that way I can say, 154 154 00:05:41,363 --> 00:05:43,170 "What do I know about this IP address? 155 155 00:05:43,170 --> 00:05:45,150 Is this something that's been attacking me before? 156 156 00:05:45,150 --> 00:05:46,260 Is this something that's been attacking 157 157 00:05:46,260 --> 00:05:47,250 the rest of the world?" 158 158 00:05:47,250 --> 00:05:49,290 And it gives me those details. 159 159 00:05:49,290 --> 00:05:52,140 Next, I can right click on the value in the ST field 160 160 00:05:52,140 --> 00:05:54,840 and from here I can click update event status, 161 161 00:05:54,840 --> 00:05:58,020 Cat VI: Reconnaissance, Probes, and Scans. 162 162 00:05:58,020 --> 00:06:00,210 Now if I press F6, this will categorize 163 163 00:06:00,210 --> 00:06:02,820 the other scan alerts in the exact same way. 164 164 00:06:02,820 --> 00:06:04,920 This is how I can say, "I've seen this, 165 165 00:06:04,920 --> 00:06:06,780 I've looked at it, and I know what it is." 166 166 00:06:06,780 --> 00:06:08,970 It was reconnaissance, a probe, or a scan. 167 167 00:06:08,970 --> 00:06:11,280 It's a CAT VI vulnerability. 168 168 00:06:11,280 --> 00:06:13,227 So this is the basic way to be able to use Sguil 169 169 00:06:13,227 --> 00:06:15,240 and there's lots of other ways to go through 170 170 00:06:15,240 --> 00:06:16,530 and learn about this. 171 171 00:06:16,530 --> 00:06:18,630 I do recommend that you download Security Onion 172 172 00:06:18,630 --> 00:06:20,910 and play with it on your network. 173 173 00:06:20,910 --> 00:06:21,743 Now, let's go through 174 174 00:06:21,743 --> 00:06:24,180 and analyze and prioritize some events. 175 175 00:06:24,180 --> 00:06:26,160 When we get an alert that's presented as a high priority 176 176 00:06:26,160 --> 00:06:29,160 by a rule set, you want to prioritize it for investigation. 177 177 00:06:29,160 --> 00:06:31,440 Now if I look at alert 3.35, 178 178 00:06:31,440 --> 00:06:33,180 note here that we have a higher packet count 179 179 00:06:33,180 --> 00:06:35,610 as a large amount of data was being downloaded. 180 180 00:06:35,610 --> 00:06:37,920 If I right click on the value of 3.35 181 181 00:06:37,920 --> 00:06:38,910 and select Bro, 182 182 00:06:38,910 --> 00:06:40,530 it's going to open that up inside 183 183 00:06:40,530 --> 00:06:42,210 of that intrusion detection system 184 184 00:06:42,210 --> 00:06:44,130 and so I can analyze that traffic content 185 185 00:06:44,130 --> 00:06:47,100 shown in the new window by going through that Bro alert. 186 186 00:06:47,100 --> 00:06:49,050 Now notice the content type here, 187 187 00:06:49,050 --> 00:06:51,930 It says it's an HTML or text file, 188 188 00:06:51,930 --> 00:06:55,200 but if I look at the magic number at the beginning, 189 189 00:06:55,200 --> 00:06:56,490 those first couple of bytes 190 190 00:06:56,490 --> 00:06:58,650 are going to tell me what type of file it really is. 191 191 00:06:58,650 --> 00:07:01,290 So even though it's labeled as a text or HTML file, 192 192 00:07:01,290 --> 00:07:03,690 that binary code is showing me it's an executable 193 193 00:07:03,690 --> 00:07:05,697 because it says MZ 194 194 00:07:05,697 --> 00:07:08,430 and MZ is the magic number for a binary code 195 195 00:07:08,430 --> 00:07:10,290 in a Windows executable. 196 196 00:07:10,290 --> 00:07:11,580 Now, I can look at this code 197 197 00:07:11,580 --> 00:07:14,280 and I can start doing reverse engineering if I copy it out 198 198 00:07:14,280 --> 00:07:15,966 and I can extract it using something like 199 199 00:07:15,966 --> 00:07:18,690 NetMiner or Wireshark and then run it in a sandbox 200 200 00:07:18,690 --> 00:07:21,390 and do some dynamic or static analysis on it. 201 201 00:07:21,390 --> 00:07:23,760 This is how we use these tools and we use one tool 202 202 00:07:23,760 --> 00:07:26,820 to link to another tool to get to what we want. 203 203 00:07:26,820 --> 00:07:28,710 Next, let's go ahead and close that. 204 204 00:07:28,710 --> 00:07:32,730 Let's take a look at alerts 3.90 and 3.91. 205 205 00:07:32,730 --> 00:07:35,130 Here we can detect a different kind of threat. 206 206 00:07:35,130 --> 00:07:36,150 This one is going to reference 207 207 00:07:36,150 --> 00:07:38,490 a common vulnerability and exposure number. 208 208 00:07:38,490 --> 00:07:40,650 So we have a CVE number associated with it 209 209 00:07:40,650 --> 00:07:41,820 and this signature tells us 210 210 00:07:41,820 --> 00:07:43,530 that a detected an attempt to exploit 211 211 00:07:43,530 --> 00:07:46,530 the shell shock vulnerability to run an arbitrary command 212 212 00:07:46,530 --> 00:07:48,540 through a web server shell. 213 213 00:07:48,540 --> 00:07:50,370 This again, will be something we'd want to fix 214 214 00:07:50,370 --> 00:07:51,810 and so with Squil we can see 215 215 00:07:51,810 --> 00:07:54,210 that that attack was occurring on this server 216 216 00:07:54,210 --> 00:07:57,510 and then we can verify, are we vulnerable to it or not. 217 217 00:07:57,510 --> 00:07:59,220 Now the last set of events we want to look at 218 218 00:07:59,220 --> 00:08:02,370 is things from alert 3.95 and beyond. 219 219 00:08:02,370 --> 00:08:04,020 This is going to show us another Trojan 220 220 00:08:04,020 --> 00:08:05,910 that was being downloaded over port 80, 221 221 00:08:05,910 --> 00:08:08,520 and this was followed up by some suspicious outbound traffic 222 222 00:08:08,520 --> 00:08:10,290 over port 443. 223 223 00:08:10,290 --> 00:08:11,940 So this would be something like 224 224 00:08:11,940 --> 00:08:14,520 a piece of malware being downloaded and executed, 225 225 00:08:14,520 --> 00:08:15,990 that Trojan is now executed, 226 226 00:08:15,990 --> 00:08:17,460 and it's making the connection call out 227 227 00:08:17,460 --> 00:08:20,580 back over port 443 to the malicious attacker 228 228 00:08:20,580 --> 00:08:22,920 to get its command and control instructions. 229 229 00:08:22,920 --> 00:08:25,860 Now, if I right click on the alert value of 3.148, 230 230 00:08:25,860 --> 00:08:29,250 I can select Wireshark, and I can analyze that traffic. 231 231 00:08:29,250 --> 00:08:32,790 Notice here with port 443, which is HTTPSS. 232 232 00:08:32,790 --> 00:08:34,890 We would expect to see a legitimate session, 233 233 00:08:34,890 --> 00:08:37,350 starting with the SSL or TLS handshake, 234 234 00:08:37,350 --> 00:08:40,230 and then proceed to the exchange of encrypted packets. 235 235 00:08:40,230 --> 00:08:42,630 But these packets are using a plain text 236 236 00:08:42,630 --> 00:08:46,380 http post connection and an encrypted message. 237 237 00:08:46,380 --> 00:08:48,720 Now this tells me there is something wrong with this 238 238 00:08:48,720 --> 00:08:50,460 and so we would want to look into this further 239 239 00:08:50,460 --> 00:08:52,920 and be able to go through and do more analysis. 240 240 00:08:52,920 --> 00:08:54,990 Now let's go ahead and right click on the IP address 241 241 00:08:54,990 --> 00:08:57,090 that starts at 24. 242 242 00:08:57,090 --> 00:08:59,460 Now, normally we'd want to correlate this IP address 243 243 00:08:59,460 --> 00:09:02,130 to a list of bad known entries on a blacklist, 244 244 00:09:02,130 --> 00:09:04,500 but this system isn't connected to the internet 245 245 00:09:04,500 --> 00:09:05,850 because it's isolated. 246 246 00:09:05,850 --> 00:09:08,430 Now most of your commercial SIEMs will be able to 247 247 00:09:08,430 --> 00:09:10,380 have the ability to right click on something 248 248 00:09:10,380 --> 00:09:11,970 and immediately find out where it is 249 249 00:09:11,970 --> 00:09:15,240 based on a local database or an internet connected database. 250 250 00:09:15,240 --> 00:09:18,030 But in my case, I'm offline, so I can't do that. 251 251 00:09:18,030 --> 00:09:19,380 Let's go ahead and hit escape 252 252 00:09:19,380 --> 00:09:21,360 and it's going to cancel that menu. 253 253 00:09:21,360 --> 00:09:25,770 Okay, next we want to develop our own custom rule for an IDS. 254 254 00:09:25,770 --> 00:09:27,780 To do this, I'm going to open up a terminal 255 255 00:09:27,780 --> 00:09:32,780 and go to sudo nano /etc/nsm/rules/local.rules 256 256 00:09:36,270 --> 00:09:37,980 and this is going to allow me to go in 257 257 00:09:37,980 --> 00:09:41,100 to that rule set file and start making some changes. 258 258 00:09:41,100 --> 00:09:43,170 Now, let's go in here and we're going to add a line 259 259 00:09:43,170 --> 00:09:48,170 that says # 515support local ICMP detection rules. 260 260 00:09:51,030 --> 00:09:52,830 Now, because it has a hashtag at the front 261 261 00:09:52,830 --> 00:09:54,120 this is a comment line 262 262 00:09:54,120 --> 00:09:55,890 and it's not going to be a process rule, 263 263 00:09:55,890 --> 00:09:56,723 just like the couple 264 264 00:09:56,723 --> 00:09:58,590 that you see here on the screen already. 265 265 00:09:58,590 --> 00:10:00,450 Now, if I want to make an alert that's going to fire, 266 266 00:10:00,450 --> 00:10:02,250 I'm going to leave off that hashtag. 267 267 00:10:02,250 --> 00:10:06,930 All right, so I'm going to type in alert icmp any any, 268 268 00:10:06,930 --> 00:10:10,650 the arrow to the right, $HOME_NET any, 269 269 00:10:10,650 --> 00:10:14,547 and then parenthesis, msg"ICMP detected"; 270 270 00:10:15,480 --> 00:10:17,013 sid:1000001; 271 271 00:10:21,944 --> 00:10:25,290 rev:1; and end the parenthesis. 272 272 00:10:25,290 --> 00:10:27,900 Now this rule has a header and a body. 273 273 00:10:27,900 --> 00:10:29,610 The header is telling me what it's going to do. 274 274 00:10:29,610 --> 00:10:32,100 So alert icmp any any. 275 275 00:10:32,100 --> 00:10:35,940 This says anytime you see ICMP traffic going from 276 276 00:10:35,940 --> 00:10:39,810 any IP on any port to your HOME_NET 277 277 00:10:39,810 --> 00:10:43,230 with any port I want you to send out the body, 278 278 00:10:43,230 --> 00:10:45,210 which in this case is the message. 279 279 00:10:45,210 --> 00:10:47,940 And so the message is ICMP detected 280 280 00:10:47,940 --> 00:10:50,400 and then we have this sid, which is a signature ID, 281 281 00:10:50,400 --> 00:10:53,940 and it has to start with the number 1 million or higher. 282 282 00:10:53,940 --> 00:10:56,010 And this tells me it's a local rule that I've created, 283 283 00:10:56,010 --> 00:10:57,030 and then rev, 284 284 00:10:57,030 --> 00:10:58,980 this tells me what revision of this rule it is, 285 285 00:10:58,980 --> 00:11:00,870 this is my first revision. 286 286 00:11:00,870 --> 00:11:02,400 Each part of your body is going to be separated 287 287 00:11:02,400 --> 00:11:04,080 by semicolons and you can have 288 288 00:11:04,080 --> 00:11:06,840 lots of different pieces of information in here. 289 289 00:11:06,840 --> 00:11:08,160 Now if I want to save that, 290 290 00:11:08,160 --> 00:11:11,070 I'm going to hit Control+O and then hit enter, 291 291 00:11:11,070 --> 00:11:13,470 that saves the file and then Control+X 292 292 00:11:13,470 --> 00:11:15,810 and that will exit the nano program. 293 293 00:11:15,810 --> 00:11:17,790 Now, if I want to update this rule 294 294 00:11:17,790 --> 00:11:19,770 I have to run the update command 295 295 00:11:19,770 --> 00:11:23,640 and I do this by typing in sudo rule-update 296 296 00:11:23,640 --> 00:11:25,230 and this will pull in that update 297 297 00:11:25,230 --> 00:11:27,930 of those new rules into your intrusion detection system. 298 298 00:11:27,930 --> 00:11:30,600 All right, if we want to see if that rule has been loaded 299 299 00:11:30,600 --> 00:11:32,970 we can do this using the tail command. 300 300 00:11:32,970 --> 00:11:33,990 If you remember in Linux, 301 301 00:11:33,990 --> 00:11:37,320 the tail command shows you the last thing inside of a file. 302 302 00:11:37,320 --> 00:11:42,320 So I'm going to type tail /etc/nsm/rules/downloaded.rules 303 303 00:11:45,600 --> 00:11:47,130 and hit enter here. 304 304 00:11:47,130 --> 00:11:49,560 We should see at the end of that file, 305 305 00:11:49,560 --> 00:11:51,870 we see our rule that we just entered. 306 306 00:11:51,870 --> 00:11:53,820 That's awesome, that means it worked. 307 307 00:11:53,820 --> 00:11:56,730 All right, so we've made a rule, we updated it, 308 308 00:11:56,730 --> 00:11:58,980 but this rule is not a very good rule. 309 309 00:11:58,980 --> 00:12:01,260 Why? Because this rule is going to create 310 310 00:12:01,260 --> 00:12:03,420 so much noise in our sensor. 311 311 00:12:03,420 --> 00:12:06,180 Anytime somebody pings into your internal network 312 312 00:12:06,180 --> 00:12:09,000 it's going to create a huge number of false positives, 313 313 00:12:09,000 --> 00:12:12,300 so we want to tune that rule and make it more specific. 314 314 00:12:12,300 --> 00:12:14,370 To do this, we're going to go back into nano 315 315 00:12:14,370 --> 00:12:19,370 by going sudo nano/etc/nsm/rules/local.rules 316 316 00:12:21,360 --> 00:12:23,760 and then we're going to edit that rule that we just made. 317 317 00:12:23,760 --> 00:12:25,410 Let's go ahead and edit it so it says 318 318 00:12:25,410 --> 00:12:30,410 alert icmp $EXTERNAL_NET any to HOME_NET any 319 319 00:12:32,790 --> 00:12:36,150 and the message of external ICMP probe detected. 320 320 00:12:36,150 --> 00:12:37,740 And then we are going to keep the rule number 321 321 00:12:37,740 --> 00:12:40,530 and we're going to make this revision number two. 322 322 00:12:40,530 --> 00:12:42,870 This way, we're only going to log things that go 323 323 00:12:42,870 --> 00:12:46,020 from the external network to the internal network. 324 324 00:12:46,020 --> 00:12:48,420 This will solve a lot of the false positives 325 325 00:12:48,420 --> 00:12:49,860 because I'm really not worried 326 326 00:12:49,860 --> 00:12:51,480 if somebody internal to my network 327 327 00:12:51,480 --> 00:12:53,181 is pinging things on the network 328 328 00:12:53,181 --> 00:12:55,020 'cause we do that all the time for troubleshooting. 329 329 00:12:55,020 --> 00:12:56,520 But I am worried if somebody's doing it 330 330 00:12:56,520 --> 00:12:58,860 from the external network to my internal network 331 331 00:12:58,860 --> 00:13:00,750 because that means they might be doing reconnaissance 332 332 00:13:00,750 --> 00:13:02,100 and scanning me. 333 333 00:13:02,100 --> 00:13:03,810 All right, let's go ahead and hit Control+O 334 334 00:13:03,810 --> 00:13:07,380 and then enter to save the file and then Control+X to exit. 335 335 00:13:07,380 --> 00:13:09,150 Again, we need to update the rule 336 336 00:13:09,150 --> 00:13:12,150 so we'll use sudo rule-update and hit enter. 337 337 00:13:12,150 --> 00:13:13,950 We're going to go back into the terminal 338 338 00:13:13,950 --> 00:13:15,300 and I'm going to change another rule. 339 339 00:13:15,300 --> 00:13:17,820 So we're going to go back into the NSM rule set 340 340 00:13:17,820 --> 00:13:20,040 and this time I want to edit the existing line 341 341 00:13:20,040 --> 00:13:21,240 so it looks like this. 342 342 00:13:21,240 --> 00:13:26,240 I want to say alert icmp $EXTERNAL_NET any to 343 343 00:13:27,090 --> 00:13:32,090 HOME_NET any, and then I want itype:8, semicolon, 344 344 00:13:33,180 --> 00:13:38,180 msg: External ICMP probe detected, semicolon, 345 345 00:13:38,485 --> 00:13:43,053 detection_filter:track by source, 346 346 00:13:43,890 --> 00:13:48,890 count 20, seconds, 30 semicolon priority four, 347 347 00:13:50,610 --> 00:13:55,470 semicolon, class type, ICMP event semicolon, 348 348 00:13:55,470 --> 00:14:00,470 sid 1,000,001, semicolon, rev3, semicolon. 349 349 00:14:01,080 --> 00:14:03,660 Wow, that is a much more complex rule. 350 350 00:14:03,660 --> 00:14:06,210 Let's see if we can look at it and see what it does. 351 351 00:14:06,210 --> 00:14:09,870 Now when I started out, I used itype:8. What is that? 352 352 00:14:09,870 --> 00:14:12,630 Well itype:8 says it only should match 353 353 00:14:12,630 --> 00:14:17,550 ping echo requests, not any ICMP, but just pings 354 354 00:14:17,550 --> 00:14:19,800 and that's what an itype:8 is. 355 355 00:14:19,800 --> 00:14:21,210 Now the detection filter here 356 356 00:14:21,210 --> 00:14:23,700 is also going to set a threshold for this alert. 357 357 00:14:23,700 --> 00:14:25,380 That's what detection filter does 358 358 00:14:25,380 --> 00:14:27,870 and the track method means it's going to keep track 359 359 00:14:27,870 --> 00:14:29,700 and over a certain amount of time. 360 360 00:14:29,700 --> 00:14:31,470 So what we're trying to find 361 361 00:14:31,470 --> 00:14:35,370 is do we find a count of 20 within 30 seconds? 362 362 00:14:35,370 --> 00:14:38,580 So if I do 20 pings within 30 seconds 363 363 00:14:38,580 --> 00:14:41,130 that is going to classify as an alert. 364 364 00:14:41,130 --> 00:14:42,990 If I do 10 pings within 30 seconds 365 365 00:14:42,990 --> 00:14:44,940 it's not going to fire this alert. 366 366 00:14:44,940 --> 00:14:46,740 That's what we're trying to do. 367 367 00:14:46,740 --> 00:14:49,290 So if I perform a basic connection test 368 368 00:14:49,290 --> 00:14:51,390 by pinging a server four times, 369 369 00:14:51,390 --> 00:14:53,490 I'm not going to trigger the alert this time. 370 370 00:14:53,490 --> 00:14:56,430 So let's go ahead and save this, Control+O, enter, 371 371 00:14:56,430 --> 00:14:58,710 and then Control+X to exit. 372 372 00:14:58,710 --> 00:15:00,450 Now we're going to update our rules again 373 373 00:15:00,450 --> 00:15:03,630 by typing sudo rule-update and hit enter. 374 374 00:15:03,630 --> 00:15:05,190 So I hope you've enjoyed this lesson 375 375 00:15:05,190 --> 00:15:06,390 as we went through Security Onion 376 376 00:15:06,390 --> 00:15:08,310 and started playing with some of these tools, 377 377 00:15:08,310 --> 00:15:11,070 I do highly recommend downloading Security Onion 378 378 00:15:11,070 --> 00:15:12,180 and with Security Onion 379 379 00:15:12,180 --> 00:15:15,000 you can actually download existing malware samples 380 380 00:15:15,000 --> 00:15:16,800 and different traffic that's already been captured 381 381 00:15:16,800 --> 00:15:17,880 for you to play with. 382 382 00:15:17,880 --> 00:15:20,460 You can do this by going online and downloading them 383 383 00:15:20,460 --> 00:15:21,960 from Security Onion's website 384 384 00:15:21,960 --> 00:15:24,540 or if you have one of these Security Onion VMs, 385 385 00:15:24,540 --> 00:15:26,220 it's already located in there for you 386 386 00:15:26,220 --> 00:15:29,550 under the /OPT/SamplesDirectory. 387 387 00:15:29,550 --> 00:15:31,500 And you can use TCP replay 388 388 00:15:31,500 --> 00:15:33,570 to actually play back that PCAP file 389 389 00:15:33,570 --> 00:15:35,190 through your ethernet connection 390 390 00:15:35,190 --> 00:15:37,863 and so that way Sguil will see that and alert on it.