<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Have you tried logging http to file, to ensure that suricata is
decoding it? <br>
</p>
<p>Have you tried enabling the http-events rules?</p>
<p><a
href="https://github.com/OISF/suricata/blob/master/rules/http-events.rules">https://github.com/OISF/suricata/blob/master/rules/http-events.rules</a></p>
<p>In my personal experience, I haven't seen any evidence of
malicious behavior over tls from common sources (trusted
domains/IPs) to our clients. This is based on cross-referencing
EDR alerts with suricata. We sinkhole bad IPs and domains
automatically, which will stop the bulk of these attacks entirely
from 'known bad' sources. I have observed malicious activity
inbound over tls to servers, however. <br>
</p>
<p>For malware that uses tls, like Dridex, the EmergingThreats team
will release signatures for the certificates, so you may actually
be losing visibility by decoding the traffic. I'm not sure if
they have sigs to detect the decoded CnC traffic for malware
families that utilize tls. <br>
</p>
<p>-Coop<br>
</p>
<div class="moz-cite-prefix">On 2/25/2020 8:53 AM, Federico Foschini
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAFRU1Xubn1tFcdBX85YKGjmDXNYYQssPoTCjfXaA4epqMTJj_Q@mail.gmail.com">
<p style="margin:0px 0px 1.2em!important">Hello,<br>
I’ve configured my firewall to mirror SSL-decrypted traffic to a
server in which I’m running suricata 5.0</p>
<p style="margin:0px 0px 1.2em!important">I cannot trigger any
alert on this type of traffic, even if using zeek or wireshark I
can clearly see that the traffic is HTTP (but on port 443).</p>
<p style="margin:0px 0px 1.2em!important">In <code style="font-size:0.85em;font-family:Consolas,Inconsolata,Courier,monospace;margin:0px 0.15em;padding:0px 0.3em;white-space:pre-wrap;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-radius:3px;display:inline">suricata.yaml</code>
I’ve added port 443 in HTTP_PORTS variable:</p>
<pre style="font-size:0.85em;font-family:Consolas,Inconsolata,Courier,monospace;font-size:1em;line-height:1.2em;margin:1.2em 0px"><code style="font-size:0.85em;font-family:Consolas,Inconsolata,Courier,monospace;margin:0px 0.15em;padding:0px 0.3em;white-space:pre-wrap;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-radius:3px;display:inline;white-space:pre;overflow:auto;border-radius:3px;border:1px solid rgb(204,204,204);padding:0.5em 0.7em;display:block!important">port-groups:
HTTP_PORTS: "[80,81,311,383, 443, ...]"
</code></pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Cooper Nelson
Network Security Analyst
UCSD ITS Security Team
<a class="moz-txt-link-abbreviated" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042</pre>
</body>
</html>