Globomantics was happy with our initial demonstration of Snort
and gave us the green light to load up some more rules and
expand our detection capabilities.
In this exercise,
we're going to look at obtaining and enabling both the community rules and the
registered rules and loading them into our rules directory.
Once we have them,
we're going to start Snort and select these rules
files and then test the configuration.
Let's head over to Snort's website and see if we can't find some rules files.
Snort's website, snort.org, is full of information about how to
configure Snort, write rules, and operate the Snort server. Under
the Rules section on the Downloads page,
we can see three tiers of rules files, Community, Registered, and Subscription.
You might also notice that the Registered and
Subscription options are grayed out.
We could try to download the files from this page,
but there's a section more suited to our command‑line
environment. On the home page, under Step 3,
we can see wget commands already formatted for us.
Unfortunately, this one is for the version 2 ruleset,
but we could just replace the filename with the snort3
filename you'll find right here.
Let's go to our Snort server and run that command.
And once you've downloaded them,
we need to run a tar command to extract our files.
Now that we've extracted our files,
we can move the community.rules file and add sid‑msg.map
file over to our local rules directory.
Now that those are staged, let's take a look at how
to obtain some registered rules.
You obtain the registered rules using the same process,
but we're going to need an oinkcode, which you can get
by signing up if you haven't already.
I'm going to go ahead and sign in.
If you didn't write down the oinkcode, don't worry.
Once we navigate to the same section of the home
page and click Registered rules, we can see the commands we need to enter.
Since we're looking for version 3, we're going to want this second command here.
So we'll go ahead and grab that and bring it over to our Snort server.
And once we run that,
we'll see that it actually downloaded the registered rules files.
Now we just have to go through the file extraction process.
Now,
if we look at what was extracted, the extracted directories are the rules
directory, builtins, and etc. Let's go ahead and pull that rules
directory over and create a registered directory.
Now let's head over to that rules directory and see what we've got.
And we can see here that one of the benefits from the registered
rules is that you get all of your rules files broken out by the
type of rule that they're associated with,
which is significantly more organized than the community.rules file.
Now we have all the rules files where we want in the rules
directory with our local.rules file.
If you look inside the community.rules file,
you're going to notice the majority of the rules are commented out.
Most of the registered rules files are the same.
This is done purposely so you can enable only the rules that you need.
We're going to only use one of the registered rules files,
snort3‑os‑windows.rules. The uncommented rules in this one and the
community.rules file will be sufficient for our demo here.
Now we just need to enable the builtin rules and try out the
community.rules with a Snort command. To enable the builtin
rules, we need to edit snort.lua.
We'll go to that IPS section I was talking about earlier in this module,
and we'll just uncomment this line.
Now we're ready to test the configuration and try to run Snort with the
community.rules file and the builtin rules enabled. To do that, we're
going to use our same Snort command as before,
but this time our rules file would be the snort3‑community.rules.
Once it's running, we can immediately see some alerts popping up on the screen.
Let's go ahead and try to run an Nmap scan and enable its scripts to
see if we can generate some additional alerts.
This should generate a significant amount of traffic. To do
that, we'll type nmap ‑sC, and we'll go ahead and target my
Metasploitable machine at this IP address.
Now while that's running, you can already kind of see in the background here,
but I'll navigate over to it. Now we can immediately see this scan is
generating alerts based on the builtin and community rules that we
enabled. For one last step, let's set these rules to run without
having to type the rule path and the command and activate one of
those registered rule files.
To make those changes,
we first need to change our Snort defaults file and enter the right file
paths for our server. Within the Snort defaults folder, you need to navigate
to these file paths down here. I already changed these paths to reflect the
correct directories. If you are following the install guide, these are the
right paths for you to enter.
Some of the folders haven't been created yet,
which is our next step in the process.
If you're following your own directory structure,
just make sure that you have the directory names correct
and replace this path with your own.
Go ahead and create the directories and folders that you don't already have.
Once that's done,
we'll have to create a file called ips.include and add some content to
the file to specify the rules that we want loaded.
Create an ips.include file in your rules directory like this one,
and then go in and edit it. In this file, we'll include three rule
files that we want Snort to load when it starts up.
To do that,
you're going to use an include statement followed by the
directory where those files are located.
All three of these files are in my rules directory.
If you've not already moved snort3‑os‑windows.rules into your rules
folder, you're going to want to do that or enter the correct directory
path if it's still in the register directory.
Once you have these directories entered,
we have one last step to enable this configuration, and that's to make
sure snort.lua knows where to find these directories.
To change that,
you're going to go in the same IPS section, and you're going
to add in a line that looks like this,
which is include = RULE_PATH we set within our Snort defaults folder.
This is the variable that we'd use to call it,
followed by ips.include, which should be located in your rules folder.
If your paths are different,
make sure that you place the appropriate path in
this statement or it will not work.
Now we can test our configuration.
Let's go ahead and run a Snort command,
and this time we won't specify a rules file.
Alright, Snort loaded correctly.
We can see here we have 1915 total rules loaded and a few
other statistics of the different types,
so it definitely loaded the correct rules files.
We can verify that right here,
seeing that it finished loading the ips.include, which
included the snort3‑community.rules,
the local.rules, and the snort3‑os‑windows.rules.
So for a quick recap on what we covered in this demo,
we started by obtaining the community and built‑in rulesets from snort.org.
Next,
we loaded the rules we wanted into the appropriate directories and tested our
new community ruleset and the built‑in rules with a port scan.
Once that was successful,
we made a few configuration changes and enabled Snort to load multiple
rulesets without having to specify them in the command line.