In this demo,
we're going to implement post‑detection rule options to resolve a few
security goals and improve some of our existing rules.
Globomantics was happy with our vsftpd solution and would like us
to configure another rule inspecting FTP logins.
They're worried about brute force login attempts and would
like us to drop all traffic from a source IP address if a
brute force attack is attempted,
They would like us to begin dropping login attempts if the same
device makes more than 4 attempts within 60 seconds.
As always, we'll need to test our rule to make sure it works correctly.
Let's head over to the Snort VM and get started.
Go ahead and close out our previous Snort, clear the
screen, and open up our local.rules file.
Our security goal for this demo is to detect brute force login attempts
to the FTP service. Globomantics gave us a specific threshold of 4 login
attempts from the same source within 60 seconds. We'll use a detection
filter to accomplish this task.
Our rule action is reject, followed by the FTP protocol.
Our source again is $EXTERNAL_NET any, but this time we'll use the FTP
server IP address at 10.0.0.100 port 21 as our destination.
The message I'm using is FTP brute force detected.
We'll use a content rule option to specify user as the content.
Remember when we exploited the backdoor using telnet,
we had to add user before specifying our username.
When you log in using FTP,
the user string is automatically included with the username and is the first
packet sent to the server after the connection is established.
So this will serve as a good indication of a new login
attempt from the same IP address.
Next,
we'll use a detection filter to prevent alerts from firing until we
reach Globomantics' threshold for a brute force attack.
We'll track by source with a count of 4 and a time value of 60 seconds.
Our classtype will be unsuccessful‑user, a sid of
1000009, and a revision value of 1.
Now we just need to test this filter and see if it functions as expected.
Let's go ahead and start Snort and head over to Kali Linux to test our new rule.
To test the FTP login rule, we need to attempt to log in 5 times within 1 minute.
These attempts do not need to contain any specific text,
but I am going to simulate multiple attempts to log into the user account.
I'm going to use the username user and send random strings
of text five times within a minute to exceed the threshold
and see if we generate an alert.
And on this fifth attempt, you'll notice that your session pauses,
indicating that Snort probably took the action we want it to.
Let's see if there's an alert, an indication of a drop.
And there it is.
This rule functions as we had hoped.
We see our brute force detected message, it reset the connection,
and we have our proper classification of this event.
Before we go to the module summary,
let's do a quick recap of what we learned in this demo.
We started out by identifying the string we wanted to detect, user,
which is included no matter what username an attacker enters.
Next,
we configured a rule that included this check and a detection filter to detect
more than 4 attempts within 60 seconds from the same IP.
Once that threshold is reached,
Snort rejects additional attempts from that same IP address.
After configuring the rule,
we tested it by attempting to exceed the FTP login threshold and
successfully triggered the reject action as expected.