<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p>Hi Alexis<br></p><p>Its all about keeping ahead, in fact keeping up, with the game really.<br></p><p>You are right about the temporary point. In the commercial world what really happens is that businesses will have some sort of regular feed of rules and a mechanism for managing and enabling them. With that in place they can rely on the provider to push new rules out in line with the content changes you refer too. You will often find many rules for exactly the same problem with very slight variants. Therefore, in most cases, that maintains the security or protection from a changing attack. Of course awareness of such change is the key to getting new signatures out.<br></p><p>I am not an expert at writing rules, but I would agree with your point about the payload too. Here are a couple of links for you to get some more info from:<br></p><p><a href="http://doc.emergingthreats.net/bin/view/Main/SuricataSnortSigs101">http://doc.emergingthreats.net/bin/view/Main/SuricataSnortSigs101</a> <br></p><p><a href="http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node32.html">http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node32.html</a> <br></p><p>You may already have come across them. <br></p><p>Since you say, you are new with these concepts, I am assuming you really do want to learn to "make the bread rather than someone else making it for you" so good luck with your rule writing and do please share your creations.<br></p><p>regards<br></p><p>Amar<br></p><blockquote type="cite">On June 30, 2017 at 11:48 AM Alexis Fredes Hadad <amfh2408@gmail.com> wrote:<br><br><div dir="ltr"><div><div><div><div>Hello Amar! <br><br></div>Thanks for your help! I am new at the rules field. I saw that the rule looks for binary content. I think that this solution is a temporary one because if the ransomware changes, the content changes too, so in that case the IDS will not able to detect the new variant. Am I right?<br></div>Besides, I think that use pcre would be a better solution, but for that you need the payload of the ransomware. Please tell me if I am wrong. As I said before, I am new with these concepts. At present I am trying to create a rule for Petrwrap and I only have the hex content.<br><br></div>Thanks,<br></div>Alexis<br></div><div class="ox-c9a9780d05-gmail_extra"><br><div class="ox-c9a9780d05-gmail_quote">2017-06-30 9:03 GMT-03:00 oisf <a href="http://countersnipe.com">countersnipe.com</a> <<a href="mailto:oisf@countersnipe.com" target="_blank">oisf@countersnipe.com</a>>:<br><blockquote><u></u><div><p>Hi Alexis<br></p><p>Suricata in fact is very appropriate tool for ransomware and very effective one too.<br></p><p>The rule category you need to look in is trojan-activity and there are thousands of rules in there. Please find below details of one such rule to do with the recent wannacry stuff. I have cut and pasted from a rule manager in order to show you all of the options more clearly.</p><p>Hope it helps.<br></p><p>regards<br></p><p>Amar.<br></p><table style="border-collapse: collapse; line-height: 1em; margin: 0.5em auto;" class="ox-c9a9780d05-m_5902090765713308647mce-item-table mce-item-table" cellspacing="0" cellpadding="0" border="0"><tbody><tr><td style="text-align: left; border-bottom: 1px solid #555555; padding: 0.4em 1em; border-top: 1px solid #555555;" width="10" valign="top"> </td><td style="text-align: left; border-bottom: 1px solid #555555; padding: 0.4em 1em; border-top: 1px solid #555555;" valign="top"><div class="ox-c9a9780d05-m_5902090765713308647tabArea"><a class="ox-c9a9780d05-m_5902090765713308647activetab" href="https://demo1.countersnipe.com:8443/signature/signature?page=summary&signatureID=22541" target="_blank">Summary</a> <a class="ox-c9a9780d05-m_5902090765713308647tab" href="https://demo1.countersnipe.com:8443/signature/signature?page=view&signatureID=22541" target="_blank">View</a> <a class="ox-c9a9780d05-m_5902090765713308647tab" href="https://demo1.countersnipe.com:8443/signature/signature?page=action&signatureID=22541" target="_blank">Action</a><br></div><br><p>Suricata Rule: ACTION smb any any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible ETERNALBLUE Exploit M3 MS17-010"; sid:2024430; rev:2; classtype:trojan-activity; flow:to_server,established; content:"|ff|SMB|32 00 00 00 00 18 07 c0|"; offset:4; depth:12; content:"|00 00 00 00 00 00 00 00 00 00 00 08 ff fe 00 08|"; distance:2; within:16; fast_pattern; content:"|0f 0c 00 00 10 01 00 00 00 00 00 00 00 f2 00 00 00 00 00 0c 00 42 00 00 10 4e 00 01 00 0e 00 0d 10 00|"; distance:2; within:34; isdataat:1000,relative; threshold: type both, track by_src, count 10, seconds 1; )</p>Name: ET CURRENT_EVENTS Possible ETERNALBLUE Exploit M3 MS17-010 <br> Sid: 2024430 <br> Revision: 2 <br> Classification: trojan-activity (High)<br> Group: <a href="https://demo1.countersnipe.com:8443/signature/signature?action=List&signatureGroupID=52" target="_blank">trojan-activity</a><br> Protocol: smb <br> Source: any <br> Source Port: any <br> Direction: -> <br> Destination: $HOME_NET <br> Destination Port: any</td></tr></tbody></table><blockquote type="cite"><div><div class="ox-c9a9780d05-h5">On June 29, 2017 at 8:42 PM Alexis Fredes Hadad <<a href="mailto:amfh2408@gmail.com" target="_blank">amfh2408@gmail.com</a>> wrote:<br><br><div dir="ltr"><div><div><div>Hello everyone!<br></div>I want to know if there is any rule for ransomware detection in Suricata. I know that Suricata is not the more appropiate tool for that kind of malware but I was investigating how to do a rule with pcre. Anyone knows if exist a rule for that? Or a rule set which contain that? At present I am using the free version of Emerging Threats and it has a file of rules for malware but I couldn't find nothing related to ransomware.<br><br></div>Thanks,<br></div>Alexis</div></div></div><span class="">______________________________<wbr/>_________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@<wbr/>openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/<wbr/>support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.<wbr/>openinfosecfoundation.org/<wbr/>mailman/listinfo/oisf-users</a><br></span></blockquote></div></blockquote></div><br></div>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br></blockquote><p><br></p><div class="io-ox-signature"><p>Kind regards<br></p><p>Amar Rathore</p><p>CounterSnipe Systems LLC <br>Tel: +1 617 701 7213 <br>Mobile: +44 (0) 7876 233333 <br>Skype ID: amarrathore <br>Web: www.countersnipe.com <http://www.countersnipe.com/> <br><br></p><p><span style="font-size: 8pt;">This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.</span></p><p><span style="font-size: 8pt;">E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions.</span> <br></p></div></body></html>