Hackzone Cyber Security Blog

Tag: Heuristic Analysis

How to Install Suricata on pfSense

How to Install Suricata on pfSense: A Step-by-Step Guide

By

On August 25, 2024

In CyberSecurity, Network Security

Looking to enhance your network security with Suricata on pfSense? This comprehensive guide will walk you through the installation and configuration process, making it easy to set up this powerful Intrusion Detection System (IDS) on your pfSense firewall.

Introduction

Suricata is a versatile and powerful open-source network threat detection engine that can function as an IDS, IPS, and network security monitoring tool. When paired with pfSense, a popular open-source firewall and router platform, Suricata provides robust protection against network intrusions. In this guide, we’ll show you how to install and configure Suricata on pfSense, step by step.

Why Choose Suricata for pfSense?

Suricata offers several advantages when integrated with pfSense:

  • Deep Packet Inspection: Suricata provides comprehensive inspection of network traffic.
  • High Performance: It is optimized for multi-threading, making it suitable for modern networks.
  • Customizable Rules: Suricata allows for custom rule sets tailored to your specific security needs.
  • Real-Time Alerts: Get instant notifications when potential threats are detected.

Step 1: Preparing Your pfSense Environment 🔧

Before we dive into the installation, ensure that your pfSense environment is up to date and ready for Suricata.

  1. Log in to pfSense: Access your pfSense dashboard via your web browser.
  2. Update pfSense: Navigate to System > Update and apply any available updates to ensure you’re running the latest version.
  3. Backup Your Configuration: It’s always good practice to back up your pfSense configuration before making major changes. Go to Diagnostics > Backup & Restore and create a backup.

Step 2: Installing Suricata on pfSense 📦

Installing Suricata on pfSense is straightforward thanks to its integration into the pfSense package manager.

  1. Access the Package Manager: In your pfSense dashboard, go to System > Package Manager.
  2. Install Suricata:
    • Click on the Available Packages tab.
    • Search for Suricata.
    • Click Install and then Confirm. Wait for the installation to complete.

Step 3: Configuring Suricata on pfSense ⚙️

Once installed, it’s time to configure Suricata to suit your network security needs.

Interface Configuration 🌐

  1. Navigate to Suricata Settings: Go to Services > Suricata.
  2. Add an Interface:
    • Click on the Interfaces tab.
    • Click + Add to create a new Suricata interface.
    • Select the network interface you want Suricata to monitor (e.g., WAN or LAN).
    • Configure the interface settings, including enabling the interface and selecting your desired IPS mode.
  3. Save and Apply: After configuring the interface, click Save and then Apply Changes.

Setting Up Suricata Rules 📄

Suricata relies on rule sets to detect potential threats. Let’s configure those now.

  1. Download Rule Sets:
    • Go to the Updates tab within Suricata.
    • Enable automatic updates for the Emerging Threats (ET) rules or any other rule sets you prefer.
    • Click Update to download the latest rules.
  2. Assign Rules to Interfaces:
    • Go to the Rules tab.
    • Assign rule categories to the Suricata interface(s) you configured.
    • Enable or disable specific rules based on your network security needs.

Configuring Alerts and Logging 🔔

Proper alerting and logging are essential for monitoring your network security.

  1. Enable Logging:
    • Go to the Logging tab.
    • Enable EVE JSON output to get detailed logs.
    • Configure the log retention settings according to your storage capabilities.
  2. Set Up Alerts:
    • Under the Alerts tab, configure how and when Suricata should alert you.
    • You can also integrate with external logging systems like Syslog or Splunk for centralized monitoring.

Step 4: Testing Your Suricata Setup 🧪

Testing is a crucial step to ensure Suricata is working as expected.

Generate Test Traffic: Use tools like nmap to simulate network traffic and trigger Suricata alerts.

nmap -sS -Pn -p 80,443 <your-pfsense-ip>

Check Logs: Go to the Logs tab in Suricata and verify that alerts are being generated and logged as expected.

Step 5: Fine-Tuning Suricata for Optimal Performance 🎯

To get the best performance out of Suricata on pfSense, consider the following tips:

  • Adjust Rule Sets: Disable unnecessary rules that may slow down performance or generate false positives.
  • Optimize Hardware Settings: Ensure your pfSense hardware is adequate for the network load. Consider enabling multi-threading in Suricata for better performance.
  • Regular Updates: Keep both pfSense and Suricata rules up to date to protect against the latest threats.

Conclusion 🎉

Congratulations! You have successfully installed and configured Suricata on pfSense. Your network is now fortified with one of the most powerful IDS/IPS tools available. Remember to regularly monitor your logs, update your rules, and fine-tune your settings to maintain optimal security.

Have any questions or run into issues? Drop a comment below, and we’ll be happy to help! 😊

How ‘Muddled Libra’ Cybercrime Group Exploits BPO Sector with Sophisticated Social Engineering Techniques

By

On June 24, 2023

In CyberSecurity, Phishing Attack

The BPO sector is currently under attack by a cybercrime group known as Muddled Libra, which employs sophisticated social engineering tactics to gain unauthorized access. These persistent attacks have raised concerns within the cybersecurity community.

Palo Alto Networks Unit 42, in a technical report, revealed that the emergence of the 0ktapus phishing kit in late 2022 introduced a new attack style associated with Muddled Libra. The kit provided a ready-made hosting framework and bundled templates, leading to its widespread adoption. The name “Libra” is used by the cybersecurity company to designate cybercrime groups, while the term “muddled” reflects the uncertainty surrounding the utilization of the 0ktapus framework.

The 0ktapus framework, also referred to as Scatter Swine, was initially discovered in August 2022 in connection with smishing attacks on numerous organizations, including Twilio and Cloudflare. CrowdStrike later disclosed a series of cyber assaults targeting telecom and BPO companies since June 2022. These attacks involved a combination of credential phishing and SIM swapping, and the cluster responsible for them is tracked under different names, such as Roasted 0ktapus, Scattered Spider, and UNC3944.

Kristopher Russo, a senior threat researcher, explained that Muddled Libra was named due to the perplexing landscape surrounding the 0ktapus phishing kit. He noted that while many threat actors have incorporated the kit into their arsenal, merely using it does not classify them as part of Muddled Libra, according to Unit 42’s classification.

The attacks initiated by this e-crime group employ smishing and the 0ktapus phishing kit to gain initial access. They typically culminate in data theft and the establishment of long-term persistence. Another notable characteristic is the group’s utilization of compromised infrastructure and stolen data to carry out subsequent attacks on the customers of their victims. In some instances, they even target the same victims repeatedly to replenish their dataset.

Unit 42, after investigating several Muddled Libra incidents from June 2022 to early 2023, described the group as relentless, methodical, and highly adaptable in their attack strategies. They swiftly adjust their tactics when faced with obstacles. Alongside using a variety of legitimate remote management tools to maintain persistent access, Muddled Libra tamper with endpoint security solutions to evade detection. They also exploit the fatigue caused by multi-factor authentication (MFA) notifications to steal credentials.

Furthermore, the threat actors have been observed gathering lists of employees, their job roles, and cellular phone numbers to execute smishing and prompt bombing attacks. If this approach fails, Muddled Libra actors resort to contacting the organization’s help desk, pretending to be the victims, in order to enroll a new MFA device under their control.

The researchers emphasized the notable success of Muddled Libra’s social engineering tactics. They have demonstrated a remarkable level of confidence when interacting with help desk personnel and other employees over the phone, successfully persuading them to engage in unsafe actions.

The attacks also involve the use of credential-stealing tools like Mimikatz and Raccoon Stealer to escalate privileges. Additionally, various scanners are employed for network discovery, enabling the extraction of data from platforms such as Confluence, Jira, Git, Elastic, Microsoft 365, and internal messaging systems.

Unit 42 speculated that the creators of the 0ktapus phishing kit do not possess the same advanced capabilities as Muddled Libra, and despite some similarities in their tradecraft, there is no definitive connection between the actor and UNC3944.

Learn how to identify and prevent malware attacks with Suricata intrusion detection system rules

How To Detect Malware With Suricata Rules.

By

On February 1, 2023

In CyberSecurity, Distributed Denial of Service, Malware, Network Security, Ransomware, Trojan

Suricata is a highly efficient, open-source, and multi-platform network security engine that incorporates advanced Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) technologies. Developed and maintained by the Open Information Security Foundation (OISF) community since 2009, Suricata offers a comprehensive solution for detecting and preventing network security threats.

As we already explained in this article, an IDS is a passive system that is responsible for monitoring the behavior of a network to detect and report on possible unauthorized intrusions, while an IPS is an active system that works as an extension of the IDS and that , in addition to sending alerts on detections, it can also block malicious activity within the network – such as brute force attacks, DDoS, or attacks that seek to exploit vulnerabilities – and create a log with the intrusion. All this from the traffic, the file signatures, and the heuristic analysis of the flow. Additionally, IPS allows adding policies and restricting access to users and / or even applications.

That said, the most common uses for Suricata are related to scanning network traffic and analyzing traffic logs within a sandbox or sandbox environment (such as running malware). However, we can also use this tool for creating rules in order to classify malware.

Testing Meerkat

Next, we are going to see a simple example of how to use Suricata for malware classification.

Suppose we have a machine destined to perform dynamic analysis of malware samples, we could add different Suricata rules to be able to classify the type of malware that is running according to the traffic.

In this case, while a sample of the Trickbot banking Trojan is running on the network , a .pcap file is generated with information on the behavior of the traffic.

Through the network flow generated by the malware and knowing its behavior, we could create some rules in Suricata in the /etc/suricata/

rules folder :

In this Image you can see the list of some rules that come by default when installing Suricata.

Before proceeding with the generation of the rule to detect Trickbot, we will see a short description of the basic fields to generate rules in Suricata:

Action HeaderRule Options
  • Action: corresponds to the action (drop, alert, etc.) that Suricata will perform when the rule is identified in the network flow.
  • Header: this section corresponds to the specific network flow to be analyzed. From origin to destination. With the word “any” we can tell Meerkat that all ports will be analyzed.
  • Rule: rule to implement to detect malware in our case. Within this field there are keywords that help us create our rule:
    • Msg: alert message that Suricata will issue.
    • flow: network flow.
    • Content: contains the character string to be searched within the traffic.
    • Reference: contains references, in this case we put a verification MD5 hash of a Trickbot sample.
    • Sid: ID of the identified rule.
    • Rev: version of the rule.
    • Classtype: provides information on the classification of rules and alerts.

Taking as an example the rule for Trickbot malware, let’s proceed to add the Suricata rule in the / etc / suricata / rules directory for its detection: We save our rule for Trickbot taken from the aforementioned repository

Now we go on to analyze the traffic with Suricata by executing the command:
sudo suricata -c /etc/suricata/suricata.yaml -r [file.pcap]:

The previous statement generates four files:

The eve.json file is the file that interests us the most at the moment, since it is the output file that provides information about alerts, anomalies, metadata, and even information about specific files and logs:

If we search for the name of the message “ Trickbot “ with the command:

grep “Trickbot” eve.json

We will see that our rule was able to detect the malicious file as Trickbot.

To close this proof of concept it is important to mention that Suricata is a very useful tool to perform Threat Hunting . It is capable of identifying network protocols (TPC, UDP, HTTP, ICMP, etc.) enabling real-time control of the traffic generated on our network and controlling the presence of possible malicious codes. The latter can be done through MD5 checks, as we saw in the Trickbot rule.

On the other hand, we also recommend reviewing the Suricata Open Source repository of Emerging Threats rules , where you can find rules that detect new threats.
install-Suricata-in-Linux

How to install Suricata in Linux.

By

On January 16, 2023

In CyberSecurity, Distributed Denial of Service, Ethical Hacking, Malware, Network Security, Ransomware, Trojan

Suricata is an open-source network intrusion detection and prevention system (IDS/IPS) that can be used to detect and prevent cyber attacks on a computer network. It uses a variety of techniques, including signature-based detection and protocol analysis, to identify and block malicious traffic.

Installing Suricata on a Linux operating system is a multi-step process that involves the following steps:

1. Verify that your Linux system meets the minimum requirements for running Suricata. This includes checking that you have a supported version of Linux and that you have the necessary dependencies installed.

A supported version of Linux: Suricata is compatible with various Linux distributions such as Ubuntu, Debian, Fedora, and CentOS. You can check your Linux version by running the command.
  • GCC compiler: Suricata requires a C compiler to build the source code. You can check if GCC is installed on your system by running the command
"gcc --version"
  • Libpcap library: Suricata uses the libpcap library to capture network traffic. You can check if libpcap is installed on your system by running the command 
"ldconfig -p | grep libpcap"
  • libyaml library: Suricata uses the libyaml library for parsing YAML files. You can check if libyaml is installed on your system by running the command 
"ldconfig -p | grep libyaml"
  • libjansson library: Suricata uses the libjansson library for JSON data handling. You can check if libjansson is installed on your system by running the command 
"ldconfig -p | grep libjansson"
  • libmagic library: Suricata uses the libmagic library to detect file types. You can check if libmagic is installed on your system by running the command 
"ldconfig -p | grep libmagic"

Please note that these commands are for checking the dependencies in Ubuntu and Debian based distributions. In other distributions, the package manager commands may be different, for example, in Red Hat-based systems, you should use yum instead of apt-get.

2. Download the latest version of Suricata from the official website (https://suricata-ids.org/download/)

3.Extract the downloaded package using the command 

tar -xvzf suricata-version.tar.gz

4. Change directory to the extracted package by running 

cd suricata-version

5. Run the command 

"./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var"

to configure the installation.

6. Run the command to build the source code.

"make"

7. Run the command to install Suricata.

sudo make install-full

8. Configure Suricata by editing the configuration file located at /etc/suricata/suricata.yaml.

9. Start Suricata by running the command

(assuming that the interface you want to listen on is eth0)

"suricata -c /etc/suricata/suricata.yaml -i eth0"

10. Verify that Suricata is running correctly by checking the output of the command 

sudo suricata -i eth0 --list-runmode-helpers

It’s always recommended to check the official documentation of Suricata for the specific version that you are installing and to be aware of the dependencies that your system needs to have installed before proceeding with the installation. It’s always recommended to consult the official documentation of Suricata for the specific version that you are installing and to be aware of the dependencies that your system needs to have installed.

Powered by WordPress & Theme by Anders Norén