Snort language preview

1. Suspicious HTTP request

an alert action, variables, and rule options

horizon-dark

# detect suspicious HTTP requests
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (
    msg:"Suspicious User-Agent";
    content:"User-Agent|3A|"; http_header;
    content:"evilbot"; distance:0; nocase;
    pcre:"/evil[0-9]+/i";
    classtype:trojan-activity;
    sid:1000001; rev:1;
)

atom-one-dark

# detect suspicious HTTP requests
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (
    msg:"Suspicious User-Agent";
    content:"User-Agent|3A|"; http_header;
    content:"evilbot"; distance:0; nocase;
    pcre:"/evil[0-9]+/i";
    classtype:trojan-activity;
    sid:1000001; rev:1;
)

github-dark

# detect suspicious HTTP requests
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (
    msg:"Suspicious User-Agent";
    content:"User-Agent|3A|"; http_header;
    content:"evilbot"; distance:0; nocase;
    pcre:"/evil[0-9]+/i";
    classtype:trojan-activity;
    sid:1000001; rev:1;
)

dracula

# detect suspicious HTTP requests
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (
    msg:"Suspicious User-Agent";
    content:"User-Agent|3A|"; http_header;
    content:"evilbot"; distance:0; nocase;
    pcre:"/evil[0-9]+/i";
    classtype:trojan-activity;
    sid:1000001; rev:1;
)

nord

# detect suspicious HTTP requests
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (
    msg:"Suspicious User-Agent";
    content:"User-Agent|3A|"; http_header;
    content:"evilbot"; distance:0; nocase;
    pcre:"/evil[0-9]+/i";
    classtype:trojan-activity;
    sid:1000001; rev:1;
)

github

# detect suspicious HTTP requests
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (
    msg:"Suspicious User-Agent";
    content:"User-Agent|3A|"; http_header;
    content:"evilbot"; distance:0; nocase;
    pcre:"/evil[0-9]+/i";
    classtype:trojan-activity;
    sid:1000001; rev:1;
)

2. DNS tunneling detection

protocol matching and content options

horizon-dark

alert udp $HOME_NET any -> any 53 (
    msg:"Possible DNS tunneling";
    content:"|00 01 00 00 00 00 00 00|";
    dsize:>512;
    sid:1000002; rev:1;
)

atom-one-dark

alert udp $HOME_NET any -> any 53 (
    msg:"Possible DNS tunneling";
    content:"|00 01 00 00 00 00 00 00|";
    dsize:>512;
    sid:1000002; rev:1;
)

github-dark

alert udp $HOME_NET any -> any 53 (
    msg:"Possible DNS tunneling";
    content:"|00 01 00 00 00 00 00 00|";
    dsize:>512;
    sid:1000002; rev:1;
)

dracula

alert udp $HOME_NET any -> any 53 (
    msg:"Possible DNS tunneling";
    content:"|00 01 00 00 00 00 00 00|";
    dsize:>512;
    sid:1000002; rev:1;
)

nord

alert udp $HOME_NET any -> any 53 (
    msg:"Possible DNS tunneling";
    content:"|00 01 00 00 00 00 00 00|";
    dsize:>512;
    sid:1000002; rev:1;
)

github

alert udp $HOME_NET any -> any 53 (
    msg:"Possible DNS tunneling";
    content:"|00 01 00 00 00 00 00 00|";
    dsize:>512;
    sid:1000002; rev:1;
)

3. Drop rule

the drop action and a byte_test option

horizon-dark

drop tcp any any -> $HOME_NET any (
    msg:"Blocked payload";
    byte_test:4,>,1000,0;
    sid:1000003; rev:1;
)

atom-one-dark

drop tcp any any -> $HOME_NET any (
    msg:"Blocked payload";
    byte_test:4,>,1000,0;
    sid:1000003; rev:1;
)

github-dark

drop tcp any any -> $HOME_NET any (
    msg:"Blocked payload";
    byte_test:4,>,1000,0;
    sid:1000003; rev:1;
)

dracula

drop tcp any any -> $HOME_NET any (
    msg:"Blocked payload";
    byte_test:4,>,1000,0;
    sid:1000003; rev:1;
)

nord

drop tcp any any -> $HOME_NET any (
    msg:"Blocked payload";
    byte_test:4,>,1000,0;
    sid:1000003; rev:1;
)

github

drop tcp any any -> $HOME_NET any (
    msg:"Blocked payload";
    byte_test:4,>,1000,0;
    sid:1000003; rev:1;
)