<html><body><div style="font-family: Andale Mono; font-size: 12pt; color: #000000"><div>Hi all,</div><div><br data-mce-bogus="1"></div><div>Very interesting work...</div><div><br data-mce-bogus="1"></div><div>We have this issue here, so, i wrote a script (using shell) that read http.log and match it with a bad urls list. If match, the script send me a email with the fullpath URL in mail body and http.log line attached. Works fine for us. For example:</div><div><br data-mce-bogus="1"></div><div><span style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">Domain: terr</span><span id="DWT8568" class="ZmSearchResult" style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #fffec4;" data-mce-style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #fffec4;"><span id="DWT8570" class="ZmSearchResult" style="background-color: #fffec4;" data-mce-style="background-color: #fffec4;"><span id="DWT8578" class="ZmSearchResult" style="background-color: #fffec4;" data-mce-style="background-color: #fffec4;">a</span></span></span><span style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">.com.br</span><br style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;" data-mce-style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;"><span style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">URL:</span><span style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;"> </span><span class="Object" role="link" id="OBJ_PREFIX_DWT8571_com_zimbra_url" style="color: #005a95; text-decoration: none; cursor: pointer; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;" data-mce-style="color: #005a95; text-decoration: none; cursor: pointer; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;"><span class="Object" role="link" id="OBJ_PREFIX_DWT8572_com_zimbra_url" style="color: #005a95; text-decoration: none; cursor: pointer;" data-mce-style="color: #005a95; text-decoration: none; cursor: pointer;"><span class="Object" role="link" id="OBJ_PREFIX_DWT8579_com_zimbra_url" style="color: #005a95; text-decoration: none; cursor: pointer;" data-mce-style="color: #005a95; text-decoration: none; cursor: pointer;"><a target="_blank" href="http://terra.com.br/" style="color: #005a95; text-decoration: none; cursor: pointer;" data-mce-href="http://terra.com.br/" data-mce-style="color: #005a95; text-decoration: none; cursor: pointer;">http://terra.com.br</a></span></span></span><br style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;" data-mce-style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;"><span style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #333333; font-family: monospace; font-size: 14.16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">LOGs attached</span></div><div><pre style="color: #000000; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; white-space: pre-wrap;" data-mce-style="color: #000000; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; white-space: pre-wrap;">10/05/15-10:11:41.484357;172.22.73.88;HTTP/1.0;GET;disqus.com;/embed/comments/?base=default&version=0e711e2730e4c6cf1685e5e4dfedf9c9&f=terranetworks&t_u=http%3A%2F%2Fnoticias.terra.com.br%2Fbrasil%2Fbolsa-familia%2F&t_d=Bolsa%20fam%C3%ADlia%2010%20anos%3A%20hist%C3%B3ria%2C%20estados%20que%20mais%20receberam%20ajuda%2C%20cases%20e%20mais&t_t=Bolsa%20fam%C3%ADlia%2010%20anos%3A%20hist%C3%B3ria%2C%20estados%20que%20mais%20receberam%20ajuda%2C%20cases%20e%20mais&s_o=default;-;0;200.134.48.2:47682;->;104.156.85.134:80
</pre></div><div>If you want, i can share the script.</div><div><br data-mce-bogus="1"></div><div>att,</div><div><br></div><div data-marker="__SIG_PRE__">-----------------------------------------------<br>Alan Santos<br>Analista de Segurança<br>Centro de Atendimento a Incidentes de Segurança (CAIS)<br>Rede Nacional de Ensino e Pesquisa (RNP)<br>(19) 3787-3314 | alan.santos@rnp.br</div><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Marius" <wishinet@gmail.com><br><b>Para: </b>"oisf-users" <oisf-users@openinfosecfoundation.org><br><b>Enviadas: </b>Quinta-feira, 10 de dezembro de 2015 14:56:08<br><b>Assunto: </b>[Oisf-users] How do I match a URL with a Suricata rule?<br></div><br><div data-marker="__QUOTED_TEXT__"><div dir="ltr"><div><div>Hi,<br><br></div>I am working on a way for URL matching using Suri (2.0.8, but I can upgrade) <br><br>I think the easiest way is using LuaJIT in a rule. The use case is matching "bad URLs" - which are from dynamic Malware analysis. <br><br></div><div>Here is what I tried so far:<br><br></div><div>I create a file and put the bad URLs in there - like this:<br></div><div><br><a href="http://badstuff.com/bad/malware.exe" target="_blank">http://badstuff.com/bad/malware.exe</a><br></div><div><a href="http://reallybadstuff.com/worse/evilware.msi" target="_blank">http://reallybadstuff.com/worse/evilware.msi</a><br></div><div> <br></div><div>I want to match these URLs with Suri. To do this I write a quick rule:<br></div><div><br>$$ more /etc/suricata/rules/custom.rules <br>alert http any any -> any any (msg:"LUAJIT test"; luajit:file.lua; sid:900000; flow:established; rev:1)<br><br></div><div>I have compiled suricata 2.0.8 on a Gentoo system:<br><br>./configure --enable-luajit --with-libpcap_ng-libraries=/usr/local/lib --with-libpcap_ng-includes=/usr/local/include/ --prefix=/usr/ --sysconfdir=/etc/ --localstatedir=/var/ --disable-gccmarch-native --enable-gccprotect --with-libluajit-includes=/usr/include/luajit-2.0<br></div><div><br>...<br> libnss support: no<br> libnspr support: no<br> libjansson support: yes<br> Prelude support: no<br> PCRE jit: yes<br> LUA support: yes<br> libluajit: yes<br>....<br><br></div><div>That looks fine to me. Now I test it:<br>sudo suricata --af-packet=eno1 -S /etc/suricata/rules/custom.rules -v<br><br></div><div>I see the following error:<br> <Info> - Loading rule file: /etc/suricata/rules/custom.rules<br><Error> - [ERRCODE: SC_ERR_LUAJIT_ERROR(212)] - unsupported data type protocol<br> <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error par<br>sing signature "alert http any any -> any any (msg:"LUAJIT test"; luajit:file.lua; sid:900000; flow:established; rev:1)" from file /etc/suricata/rules/custom.rules at line 1<br><Error> - [ERRCODE: SC_ERR_NO_RULES(42)] - No rules loaded from /etc/suricata/rules/custom.rules<br><br></div><div>Does someone know why the rule parser steps out? From what I see the feature is compiled into the engine. I don't see what the error message indicates. <br></div><br>Below is my current lua code for reference. I tested some simpler lua scripts with the same error in the log.<br><br><div>Best,<br></div><div>Marius<br></div><br><div><br>local open = io.open<br><br>function init (args)<br> local needs = {}<br> needs["protocol"] = "http" <br> -- needs["http.uri"] = tostring(true)<br> return needs<br>end<br><br><br>function setup (args)<br> filename = SCLogPath() .. "/" .. name<br> file = assert(io.open(filename, "a"))<br> SCLogInfo("HTTP Log Filename " .. filename)<br> http = 0<br>end<br><br><br>function match(args)<br> --for line in io.lines("bad_urls.txt") do<br> -- print(line)<br> -- end<br> http_host = HttpGetRequestHost()<br> if http_host == nil then<br> return 0 <br> end<br><br> http_uri = HttpGetRequestUriNormalized()<br> if http_uri == nil then<br> return 0<br> end<br><br> local file = io.open("bad_urls.txt", "r");<br> local arr = {}<br> for line in file:lines() do<br> table.insert (arr, line);<br> end<br><br> ts = SCPacketTimeString()<br> ipver, srcip, dstip, proto, sp, dp = SCFlowTuple()<br><br> file:write(ts .. " " .. http_host .. " [**] " .. http_uri .. " [**] " ..<br> http_ua .. " [**] " .. srcip .. ":" .. sp .. " -> " ..<br> dstip .. ":" .. dp .. "\n")<br> file:flush()<br><br><br> a = tostring(args["http.uri"])<br> a = http_host + "/" + a <br><br> for url in arr do<br> net_url = "http://" .. http_host .. http_uri<br> if url == net_url then<br> -- file:write(net_url .. " matches bad url - potential Malware\n")<br> return 1<br> end<br> end<br><br> return 0<br>end<br><br>function deinit (args)<br> SCLogInfo ("Bad URLs transactions logged");<br> file:close(file)<br>end<br></div></div>
<br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net<br></div></div></body></html>