In this demo, we're going to explore the emerging threats rule set.
These rules were installed in the previous course.
We're going to explore them to evaluate how the rules are structured,
how they're grouped,
and the different types of threats that they can detect and prevent.
Let's head over to our web browser and start exploring.
Looking at the rule set from the site where we can obtain them,
we see multiple files grouped by type.
We'll use these file names in the next module to change rule behavior.
But for now,
they help inform us of the types of rules contained in this rule
set and the types of threats they can detect.
Our Metasploitable 2 machine has an UnrealIRCd chat server installed.
The chat server is vulnerable,
so let's see if there are chat rules available in this
rule set that can help us detect attempts to use our
server from the external network.
There's a group of rules called emerging‑chat that
contains a large set of chat rules.
We can do a simple search for IRC and evaluate the types of
rules contained in this file for IRC servers.
In this area,
we can see a sequence of rules that detect the types of
commands entered to access a server.
These first two here are actually designed to
enforce internal security policies,
preventing file transfers or chat requests over IRC.
The next four rules detect different types of commands usually used
to join a server or to send a private message.
This last one here,
IRC PING, is actually sent from the server out to any other destination.
These are just a small subset of the numerous chat
rules available for other protocols.
Let's continue exploring other rule categories that can help
with our known internal vulnerabilities.
Another vulnerable service on our network is FTP.
Let's look at the available rules and emerging threats that
can help us detect attempts to access our vulnerable FTP
server from the external network.
Similar to the last set of rules,
we can search this rule source for pre‑written rules
that address our security concerns.
Let's check for rules that detect anonymous login
attempts from the external network.
There are two rules that can detect anonymous logins in two
different ways using the content option.
This one looks for the command user, followed by the statement anon.
This next one looks for the command user,
followed by these hexadecimal characters.
On our network,
we have a ProFTPD server running on Metasploitable 2 over port 2121.
In order to check for traffic destined for this particular vulnerable server,
let's see if there are any rules specifically designed for ProFTPD.
Searching for ProFTPD, we find one rule designed specifically for this software.
This is valuable,
but it assumes the default port of 21. In the next module, we'll learn
how to modify this to fit our specific environment.
As you can see, the emerging threats rule set contains multiple rules that
can help detect potential threats to our environment,
making it a good rule source for us to keep on our Suricata server.
We'll use similar techniques to evaluate the contents of other rule
sources in the next module and take a deeper dive into the tool we use
to obtain the emerging threats rule set.