Instalei em 3 sensores da honeynet o meu querido snort. Logicamente o Snort só detecta o que já conhece, visto que são regras de blacklist, mas acho interessante ter ele rodando em paralelo com os daemons.
Abaixo a lista das TOP30 regras que alertaram:
8241 [**] [1:2017162:2] ET SCAN SipCLI VOIP Scan [**]
5469 [**] [1:2402000:3709] ET DROP Dshield Block Listed Source group 1 [**]
4309 [**] [1:2001219:19] ET SCAN Potential SSH Scan [**]
2308 [**] [1:2011716:4] ET SCAN Sipvicious User-Agent Detected (friendly-scanner) [**]
2179 [**] [1:2010935:2] ET POLICY Suspicious inbound to MSSQL port 1433 [**]
2129 [**] [1:2010937:2] ET POLICY Suspicious inbound to mySQL port 3306 [**]
1862 [**] [1:2008578:6] ET SCAN Sipvicious Scan [**]
1162 [**] [1:2402001:3709] ET DROP Dshield Block Listed Source group 1 [**]
1031 [**] [1:2500108:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 55 [**]
624 [**] [1:2500132:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 67 [**]
568 [**] [1:2400000:2488] ET DROP Spamhaus DROP Listed Traffic Inbound group 1 [**]
280 [**] [1:2101411:12] GPL SNMP public access udp [**]
249 [**] [1:2500028:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 15 [**]
232 [**] [1:2500106:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 54 [**]
220 [**] [1:2500066:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 34 [**]
203 [**] [1:2403350:1829] ET CINS Active Threat Intelligence Poor Reputation IP TCP group 26 [**]
125 [**] [1:2403346:1829] ET CINS Active Threat Intelligence Poor Reputation IP TCP group 24 [**]
118 [**] [1:2500138:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 70 [**]
105 [**] [1:2009699:1] ET VOIP REGISTER Message Flood UDP [**]
92 [**] [1:2500022:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 12 [**]
90 [**] [1:2101616:9] GPL DNS named version attempt [**]
84 [**] [1:2500136:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 69 [**]
84 [**] [1:2010936:2] ET POLICY Suspicious inbound to Oracle SQL port 1521 [**]
73 [**] [1:2500100:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 51 [**]
68 [**] [1:2500062:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 32 [**]
52 [**] [1:2500102:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 52 [**]
47 [**] [1:2403331:1829] ET CINS Active Threat Intelligence Poor Reputation IP UDP group 16 [**]
45 [**] [1:2403333:1829] ET CINS Active Threat Intelligence Poor Reputation IP UDP group 17 [**]
44 [**] [1:2500140:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 71 [**]
43 [**] [1:2403324:1829] ET CINS Active Threat Intelligence Poor Reputation IP TCP group 13 [**]
TOP30 IP de origem que geraram essas regras:
1343 43.255.189.38
1063 61.240.144.66
796 155.94.64.250
767 23.92.80.90
755 218.77.79.43
648 23.92.80.27
528 61.240.144.65
438 61.240.144.64
414 61.240.144.67
369 61.160.224.130
351 46.165.249.2
351 185.94.111.1
327 222.186.27.171
326 61.160.224.128
313 192.187.115.202
289 188.138.1.239
242 124.158.12.201
235 23.92.80.95
234 173.193.12.244
233 188.227.186.16
231 69.64.33.115
227 46.165.210.84
225 71.6.135.131
220 62.210.71.22
218 192.3.8.210
215 94.102.49.168
210 61.160.224.129
207 23.92.80.97
195 162.244.35.24
189 222.186.21.133
Pretendo colocar sensores internos em redes reais, o que acredito que adicionará outros alertas, porém é válido ativar essas regras caso não as possua.
Ainda estou em fase de testes e pretendo num futuro compartilhar essas informações de forma automatica (API) ou site.
Happy Snorting!
Rodrigo "Sp0oKeR" Montoro
