All right,
we're finally ready to get started by running Snort in IDS mode and
generating some alerts with internal and external traffic.
In this exercise,
we're going to start trying to protect Globomantics' network by
detecting some potential threats and internal staff violating
Globomantics' social media policy,
which doesn't allow access during working hours.
We want to get Snort running and have it detect internal Facebook
usage that would violate the social media policy.
We also want to detect all attempts to ping an
internal device from outside the network,
which could be a sign of attempts to conduct network reconnaissance.
Finally,
we want to detect any attempts to access our internal
web server from the external network.
The internal web server is on the Metasploitable machine.
Now that we have our goals outlined in this demo,
let's head over to our Snort server and get started.
To get started,
let's take a quick look at the local.rules file
created in the installation process.
If you didn't follow the installation guide,
this will be a good opportunity to create your own version.
There are two rules you wrote as part of the install guide.
The first rule will satisfy our first goal to detect Facebook traffic,
so we'll leave that rule written as it is.
The second one is that to detect any ICMP traffic,
which will work for our purposes; however,
our specific goal is to detect all pings from our
external network to the internal network.
We don't want to detect internal pings,
as they are typically part of the troubleshooting
process and not really a sign of a threat.
To eliminate these false positives,
we're going to change the destination network for this rule
from any any to our internal network, which,
in my case is 10.0.0.0/24.
The rest of the rule is fine.
For this exercise,
I'm going to add one more to this list to detect any inbound
HTTP traffic destined for the internal network.
To create that simple rule, I'll start with the word alert.
We'll be looking for TCP traffic from any destination over any
port and destined for our internal network,
again minus 10.0.0.0/24.
And we want to detect incoming HTTP traffic, so we just need to add port 80.
I will add a short message here for the HTTP traffic inbound so I know
what is detected when I see the alerts on the screen.
I also need a signature ID,
so I'll go with one more than my previous custom rule.
And then we'll just save this up and exit.
All right,
now we're ready to get Snort running. Before we type that command,
let's make sure we have a few pieces of information.
The first piece of information we need is the interface
or interfaces we want to monitor.
We can find that with a simple ifconfig.
Since I'm going to run in inline mode, I'll be using these two interfaces.
The next two things we need are the file paths for
snort.lua and our local.rules file.
To find that, I'm just going to use the locate command to get those paths.
Now we have everything we need. To start running Snort,
we start with a simple command, snort,
followed by ‑c to select our configuration file,
which is the snort.lua file.
For this exercise,
we want to monitor a live interface designated with
‑i followed by the interface name.
When in inline mode these are separated by a colon. To run in inline mode,
you also need a ‑Q.
If you're not running in inline mode, you do not need this.
Now we need to select a rules file with ‑r, and we'll use local.rules.
Finally,
we need to select our alert type with ‑A, and we'll
go with fast as the alert mode.
Once you run this command,
you should see the output for Snort starting up, and then at the end,
a message stating that is Commencing packet processing,
with the interfaces you selected.
We can also see messages indicating that we have three rules
loaded, and that it loaded our local.rules file.
Now that Snort is running, we can start testing these rules.
Our first check is the social media policy. To test that, I'm going to use
one of these Windows 10 workstations and try to access Facebook. Now that I
navigated to it, let's jump over to the server and see if it generated any
alerts. And we can see numerous alerts for Facebook usage, along with the
source and destination IP address.
Next,
we'll try some of the options to detect a ping attempt and HTTP
request from the external to internal devices.
For that, I'll use the Kali Linux VM.
Now let's see if that generated any alerts, and we can see here the
ping attempts to our internal device followed by the HTTP traffic
inbound. For a quick recap, in this demo we started three security
goals for Globomantics, and we configured the appropriate rules to
check for that specific traffic.
We used the right command to start up Snort in inline mode
and tested our rules by attempting to perform the actions
we were trying to detect.
We successfully detected an inbound ping, inbound HTTP traffic, and the usage
of Facebook by one of our internal devices, satisfying our security goals for
this exercise. We could continue to build on this,
adding single rules and testing them.
But we need to protect Globomantics quickly, and this can be a
lengthy process to write and test single rules.
Coming up,
we're going to learn where we can access prewritten rules to
get our IDS fully operational quickly.