In this clip, we're going to discuss payload detection rule options,
specifically focusing on the content option and a
few of its associated features.
Content allows us to investigate the payload and detect specific strings,
bits, and patterns that indicate a potential attack.
Let's look at an example situation where this would be
valuable. As we discussed in the last module,
there will be situations where you could write a simple rule,
and it would successfully detect an attacker's traffic.
However, if you simply blocked a destination by a port number,
you could also generate alerts or block legitimate
traffic destined for your internal network.
Content can help reduce these false positives and permit
legitimate traffic by first inspecting the payload.
If it detects the specific content,
it will generate an alert or block the traffic.
The main difference here is that to produce a match,
the packet needs specific content,
not just to be delivered over that particular port.
So when legitimate traffic is sent to our Snort server,
it also inspects the content of the payload and, in this case, determines
that traffic can pass without an alert or other action.
Content has a few different types and numerous modifiers that make
it highly customizable to specific situations.
The main three methods of detection using content at a high
level are content itself, which bases detection on matching the
payload to a specific string of text.
If you want to hide this content match criteria,
you can instead provide a hash value and use the protected_content option,
which will hash portions of the packet and attempt to
match against your provided hash value.
The last option,
rawbytes, accomplishes the same task as content, but instead
matches on a string of hex characters.
Let's look at a couple of examples.
We'll be using the basic content option in our demo.
So here I'll show you an example of protected_content and rawbytes.
The first example is a protected_content using a SHA‑256
value of the content we want to detect.
The hashing algorithm used is also specified using the hash option.
Another example of the same rule, but instead using rawbytes, looks like this.
Here we have the specific bytes and hex between two pipes.
If the string 3A 29 is detected in the packet,
this rule will generate an alert. In the upcoming demo,
we're going to use a similar rule to detect specific traffic
meant to exploit a vulnerability,
and we're going to block that traffic to prevent its execution.