Thursday, 31 October 2019

Suricata Cheat Sheet

** WILL FIX CODE HIGHLIGHtING LATER, grr so annoying**

Just some learnings.

Some Cheat sheets so I can organize my notes

To Run Suricata:

Reading a PCAP

sudo suricata -r PCAP
Sudo suricata -r <PCAP> -k none -l .
After running on a PCAP, search log
cat eve.json | jq -c 'select(.event_type="alert")'
cat eve.json | jq -c 'select(.event_type="tls")'
cat eve.json | jq -c  'select(.event_type="http")'
cat eve.json | jq -c  'select(.event_type="dns")'

For listing rules:

More /etc/suricata/rules/emerging-trojan/.rules

Ls -lah /etc/suricata/rules/


enabled http-log, ssh, dns events within suricata.yaml


Load signatures from another file. Edit yaml

Change default-rule-path to /home/user

change rule-fles to customsig.rules

then save customsing.rules in folder

create rule and run in pcap:

sudo suricata -r /home/test/test.pcap -k none -l .

Main Log Formats:


jsn objects, timestamp, flow_id, event_type etc –> Use jq


logs alerts onle


self explanator

Logs stored:


Breaking down rules.


Main sections

Great help to break up the rule into 3 sections, as seen in the image above.

drop == ACTION: alert etc
any == port. [80,81] [80-101] !80
HOME_NET any –> EXTERNAL_NET any == direction of traffic
-> Will only match rule on first packet, no response.

Parts in BLUE:

These are high level key words:

eg: Flow Keywords

Flow matches on direction of the flow.
established to server: means on established connections for CLIENT TO SERVER


<action>:name of flowbit

flowbits: isset, name == generate alwer when rule mataches and condition is set in the flow

Reference == refer to where signature or information came from
MSG == text want to be displayed, no impact on Rule processing
SID ==  Signature ID (needs to be unique)
Rev == Just version number of SID

So breaking down this rule:
alert dns $HOME_NET any -> any any (msg:"Trojam DNS Query Observed" dns_query; content:""; isdataat:!1,relative; reference:url,; classtype:trojan-activity; sid:1; rev:1;)

This rule specifies to alert on DNS for any traffic from the internal network out. Specifically on the DNS protocol, any DNS queries for **The isdataat:!1 means it should match with nothing else after the last byte (being .net)** Then the classtype and reference, sid and rev are there

No comments:

Post a comment