<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi<div class=""><br class=""></div><div class="">I have been trying to modify an existing rule for crypto miners to cope with traffic from what is presumably a related mining script. The issue is that the json has items in a different order.</div><div class=""><br class=""></div><div class="">I have a pcap of the new traffic from Moloch and I have created a cut down config file which loads a single file with the new rule in it:</div><div class=""><br class=""></div><div class="">alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Cryptocurrency Miner Checkin"; )</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><font face="Menlo" class="">sensors@secmontst01:~$ suricata -c suri-test.yaml -r ~rful011/180612-zj4MWV_96udJEZLpZ-rqyYu9.pcap <br class=""></font></div><div class=""><font face="Menlo" class="">Initialization syslog logging with format "[%i] <%d> -- ".<br class="">13/6/2018 -- 15:20:23 - <Notice> - This is Suricata version 4.0.4 RELEASE<br class="">13/6/2018 -- 15:20:23 - <Info> - CPUs/cores online: 16<br class="">13/6/2018 -- 15:20:23 - <Info> - Protocol detection and parser disabled for smb protocol.<br class="">13/6/2018 -- 15:20:23 - <Info> - Protocol detection and parser disabled for dcerpc protocol.<br class="">13/6/2018 -- 15:20:23 - <Info> - Protocol detection and parser disabled for dcerpc protocol.<br class="">13/6/2018 -- 15:20:23 - <Info> - No 'host-mode': suricata is in IDS mode, using default setting 'sniffer-only'<br class="">13/6/2018 -- 15:20:23 - <Info> - 1 rule files processed. 1 rules successfully loaded, 0 rules failed<br class="">13/6/2018 -- 15:20:23 - <Info> - Threshold config parsed: 0 rule(s) found<br class="">13/6/2018 -- 15:20:23 - <Info> - 1 signatures processed. 0 are IP-only rules, 0 are inspecting packet payload, 0 inspect application layer, 0 are decoder event only<br class="">13/6/2018 -- 15:20:23 - <Info> - Syslog output initialized<br class="">13/6/2018 -- 15:20:23 - <Info> - reading pcap file /home/rful011/180612-zj4MWV_96udJEZLpZ-rqyYu9.pcap<br class="">13/6/2018 -- 15:20:24 - <Notice> - all 17 packet processing threads, 2 management threads initialized, engine started.<br class="">13/6/2018 -- 15:20:24 - <Info> - pcap file end of file reached (pcap err code 0)<br class="">13/6/2018 -- 15:20:24 - <Notice> - Signal Received. Stopping engine.<br class="">13/6/2018 -- 15:20:24 - <Info> - time elapsed 0.402s<br class="">13/6/2018 -- 15:20:24 - <Notice> - Pcap-file module read 36 packets, 5452 bytes<br class="">13/6/2018 -- 15:20:24 - <Info> - Alerts: 0<br class="">13/6/2018 -- 15:20:24 - <Info> - cleaning up signature grouping structure… complete<br class=""><br class=""></font></div><div class=""><br class=""></div><div class="">As ususal I appear to be missing something! It is a long time since I dabbled in rule writing.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Related to this can I have a bunch of content items that will match even if the items occur in a different order in the traffic? For example:</div><div class=""><br class=""></div><div class=""><span style="font-size: 14.666666984558105px;" class=""><font face="Menlo" class="">{"id":"1","jsonrpc":"2.0","method":"login","params":{"agent":"MinerGateWin/8.1","login”: …</font></span><font face="Menlo" class=""><span style="font-size: 14.666666984558105px;" class="">…</span></font></div><div class=""><span style="font-size: 14.666666984558105px;" class=""><font face="Menlo" class=""><br class=""></font></span></div><div class=""><span style="font-size: 14.666666984558105px;" class="">the current rule expects the “login” before the “agent” in the params hash. In the original rule the content after “params” is “login”; distance 0 then content “agent” …</span></div><div class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></div><div class=""><span style="font-size: 14.666666984558105px;" class="">From my reading of the manual I can’t see a way of writing a single rule which will match when to params are in any order. I.e. anchor all the searches at the beginning of hash. My understanding is that distance always relates to previous match. Correct ?</span></div><div class=""><span style="font-size: 14.666666984558105px;" class=""><br class=""></span></div><div class=""><span style="font-size: 14.666666984558105px;" class="">Russell</span></div></div></body></html>