And you know me, not one to go without an example. I have one here for you of a signature based
detection rule for snort. And there are other skills here on CBT Nuggets that cover snort.
And what we have here, and I'm going to walk through this step by step for a second because
it's not going to be too far different from the heuristic one, but we have an alert basically
just letting us know the action that's going to be taken here based on this rule being triggered.
And next is going to be the protocol being inspected. In this particular case, TCP.
Now we're also identifying where this rule is going to be looking at, and it's going to be
examining the external network. And for any traffic heading towards the HTTP servers
and the HTTP server ports, whatever's in that variable. So it could be that variable of HTTP
servers is 192.168.0.1 through 10, and the ports are 80 and 443 as an example. We get a message
of, hey, there's a web attack going on where Etsy password access attempt. So that's just the
message itself. Now the next portion of this is only going to look at traffic going to the
server already connected to a TCP session, which is flow to server established. So only basically
running a net stat on this particular one, and you would see that it would be an established
connection. And the content of the payload that we're taking a look at on this TCP side here
has a file name of Etsy password, and this is the actual signature itself being defined.
So it could be another file named Etsy pass, and because it doesn't match specifically to
Etsy password with WD on the end of it, it would just go through. But if the file itself has Etsy
password as the file and the signature of that's where it's from being the file name,
then it would trigger. Now the next portion of this, the no case tell store to ignore the
capitalization. So it could be capital E, lowercase T, uppercase C. So obfuscation through
weird characters would be ignored here. And then the SID of 1,000,001 is just every rule must have
a unique ID number. So in this particular case, this is rule 1,000,001 revision on the end right
here one. So there's no updates to this rule because this is the first rule of this particular
kind. And I'm going to put this in the code box below, but that is a signature based rule for
SNART. Now let's take a look at that very same concept, this time using a heuristic based rule.
We still have alert TCP from the external network going to HTTP servers and their ports.
And this time we have a slightly changed message of heuristic attack directory traversal detected.
And the flow is to the server and establish connection as well. But the magic happens
right here where we have PCRE and a bunch of characters. That PCRE stands for Perl Compatible
Regular Expression. And if that sounds slightly familiar, it's because it's commonly referred to
as regex. Regex is a way for us to be able to search more finite into different programming
languages, networking devices, and also things like SNART rules because it's very defined.
And this group looks for, when I say this group, I'm talking about the regex expression that I
have highlighted for us that will also be in the code box above this video. We're taking a look for
a standard dot dot slash, which is, I'm going to highlight right here, this part right here.
And then we're going to be looking for URL encoded dot dot slash, which is this part right here.
That URL encoded we've covered before. You recognize it with the percent sign 2F as an
example. And then the 2 comma is the heuristic logic. It says, basically, it doesn't care if it
happens once, maybe a typo. But if it sees a pattern, if it sees a repeat of two or more times,
then it's going to consider this an attack and carry on with either doing what the rule is,
in this case, alert. Or if you set up the rule yourself, it could be terminate, drop, whatever
you want to do with that connection or file itself if it's on an endpoint system.
And the last one right here, the slash I, that's case sensitive, meaning like in the
previous rule, it doesn't matter if it's using obfuscation through capitalization or not.
So this is just the exact same rule, just done heuristically, because it's not necessarily
looking for a specific file name. It's just looking for something with dot dot backslash,
anything that looks like it's a directory traversal attack,
and they're floating through the directories up and now.