Hackzone Cyber Security Blog

Tag: Suricata

Blocking-Malicious-IPs-Using-Suricata

Blocking Malicious IPs Using Suricata: A Step-by-Step Guide

By

On September 2, 2024

In CyberSecurity

Table of Contents

  1. Introduction to Suricata and IP Blocking
  2. Why Block Malicious IPs? 🤔
  3. Setting Up Suricata for IP Blocking
  4. Creating Rules to Block Malicious IPs
  5. Testing and Verifying IP Blocking
  6. Monitoring and Updating IP Lists
  7. Conclusion: Stay Ahead of the Threats 🚀

Introduction to Suricata and IP Blocking

In the ever-evolving landscape of cybersecurity, proactive measures are essential to safeguard your network from malicious activities. Suricata, an open-source network threat detection engine, is a powerful tool in your security arsenal. In this guide, we’ll dive into how to block malicious IPs using Suricata, helping you fortify your network against potential threats.

Why Block Malicious IPs? 🤔

Blocking malicious IPs is a critical component of network security. Malicious IPs are often associated with:

  • Brute force attacks 🔓
  • Phishing campaigns 🎣
  • Malware distribution 🦠
  • DDoS attacks 🚫

By blocking these IPs, you reduce the risk of unauthorized access and data breaches, ensuring your network remains secure and your data protected.

Setting Up Suricata for IP Blocking

Installation

Before you can start blocking malicious IPs, you need to have Suricata installed. Here’s a quick guide to get you started:

sudo apt-get update
sudo apt-get install suricata

Once installed, you can check the version to ensure everything is up-to-date:

suricata -V

Configuring Suricata

After installation, you’ll need to configure Suricata to enable IP blocking. Open the configuration file (usually located at /etc/suricata/suricata.yaml):

sudo nano /etc/suricata/suricata.yaml

Within this file, you’ll want to ensure that the drop and reject actions are properly configured to handle malicious IPs effectively.

Creating Rules to Block Malicious IPs

Suricata uses rules to detect and respond to network threats. To block a specific IP address, you can create a custom rule. For example, to block the IP 192.168.1.100, add the following rule to your custom rules file (e.g., /etc/suricata/rules/local.rules):

drop ip any any -> 192.168.1.100 any (msg:"Blocked Malicious IP"; sid:1000001; rev:1;)

This rule tells Suricata to drop all traffic to and from the specified IP, effectively blocking it.

Testing and Verifying IP Blocking

After creating your rules, it’s essential to test and verify that Suricata is correctly blocking the malicious IPs. You can do this by:

  1. Restarting Suricata to apply the new rules:
sudo systemctl restart suricata
  1. Generating traffic to the blocked IP and observing Suricata’s logs to ensure the traffic is being dropped.

Logs can be checked at:

/var/log/suricata/fast.log

Look for entries that indicate the rule has been triggered and the IP has been blocked.

Monitoring and Updating IP Lists

Blocking malicious IPs isn’t a one-time task. Threat actors are constantly evolving, so it’s crucial to regularly update your IP blocklist. You can automate this process by integrating Suricata with a threat intelligence feed that provides up-to-date information on malicious IPs.

Suricata supports various types of IP lists, which can be configured in your suricata.yaml file. Make sure to regularly check your logs and adjust your rules as needed to stay ahead of emerging threats.

Conclusion: Stay Ahead of the Threats 🚀

Blocking malicious IPs with Suricata is a straightforward yet highly effective way to bolster your network’s defenses. By following the steps outlined in this guide, you can proactively protect your systems from a wide range of cyber threats. Remember, cybersecurity is an ongoing process—stay vigilant, keep your rules up to date, and continue to monitor your network for any signs of malicious activity.

Ready to take your network security to the next level? Start using Suricata today and keep those malicious IPs at bay! 💪

How-to-View-Offending-Domains-in-Suricata-Alerts

📊 How to View Offending Domains in Suricata Alerts: A Step-by-Step Guide 🛡️

By

On August 27, 2024

In CyberSecurity, Network Security

If you’re using Suricata for network security, monitoring and analyzing alerts is crucial. One important aspect is identifying offending domains that trigger alerts. This step-by-step guide will show you how to view these domains, ensuring you can take timely action to secure your network.

📋 Table of Contents

  1. Introduction
  2. Step 1: Set Up Suricata
  3. Step 2: Write a DNS Alert Rule
  4. Step 3: Enable Payload Printing
  5. Step 4: Check the Logs
  6. Step 5: Analyze Alerts
  7. Conclusion

Introduction

Suricata is a powerful open-source IDS/IPS capable of monitoring network traffic and detecting suspicious activities. If you’re looking to pinpoint domains that trigger alerts, this guide will walk you through the process. By following these steps, you’ll enhance your network monitoring and response capabilities.

Step 1: Set Up Suricata 🔧

Before diving into DNS alerts, ensure Suricata is properly installed and configured on your system. If you haven’t set it up yet, refer to the Suricata Quickstart Guide for installation and basic configuration instructions. This will ensure you have a working base to build upon.

Step 2: Write a DNS Alert Rule 📝

To capture DNS queries and identify offending domains, you need to create a custom alert rule. Here’s an example rule that you can add to your Suricata configuration:

alert dns any any -> any any (msg:"BAD URL IN DNS QUERY"; dns.query; dataset:isset,domains-bl64; classtype:bad-unknown; sid:90000001; rev:1;)

Explanation:

  • alert dns any any -> any any: This part defines the rule for DNS traffic.
  • msg:"BAD URL IN DNS QUERY": The message that will be logged when the rule is triggered.
  • dns.query: Specifies that the rule applies to DNS queries.
  • dataset:isset,domains-bl64: Checks the DNS query against a dataset of known bad domains.
  • classtype:bad-unknown: The classification of the alert.
  • sid:90000001: A unique identifier for the rule.
  • rev:1: The revision number of the rule.

Step 3: Enable Payload Printing 🖨️

To see the actual domain names that triggered the alerts, you need to enable payload printing. Modify your suricata.yaml file to include the following settings:

types:
  - alert:
      payload: yes
      payload-printable: yes

Explanation:

  • payload: yes: Enables payload printing.
  • payload-printable: yes: Ensures the payload is displayed in a readable format.

These settings will allow Suricata to include the DNS query payload in the alert logs, making it easier to see which domains triggered the alerts.

Step 4: Check the Logs 📂

Once your rule is set and payload printing is enabled, you need to monitor your Suricata logs for alerts. Logs are typically stored in /var/log/suricata/. To view real-time alerts, use the following command:

bashCopy codesudo tail -f /var/log/suricata/eve.json

Explanation:

  • sudo tail -f: Displays the end of the log file in real-time.
  • /var/log/suricata/eve.json: The file where Suricata writes JSON formatted logs.

This command will show you the latest alerts, including the domains that triggered them.

Step 5: Analyze Alerts 🔍

With your logs open, look for entries that correspond to your DNS alert rule. The output will include details such as:

  • Offending Domain: The domain name that matched the rule.
  • Timestamp: When the alert was triggered.
  • Source and Destination IPs: Information about where the query came from and where it was directed.

By analyzing these entries, you can identify and investigate potentially malicious domains, taking necessary actions to secure your network.

Conclusion 🎉

By following these steps, you can effectively view and analyze offending domains in Suricata alerts. This process enhances your ability to monitor and respond to potential threats, strengthening your network security posture. For ongoing protection, regularly update your rules and monitor your logs.

Feel free to reach out if you have any questions or need further assistance with Suricata! 😊

Step-by-Step Guide: How to Install and Configure Suricata IDS on Kali Purple

By

On August 25, 2024

In CyberSecurity, Network Security

Protect your network with Suricata! Learn how to install and configure this powerful Intrusion Detection System (IDS) on Kali Purple with our easy-to-follow guide. Whether you’re a cybersecurity enthusiast or a seasoned professional, this guide will help you secure your network in no time.

📋 Table of Contents

  1. Introduction
  2. Step 1: Update Your System 🔄
  3. Step 2: Install Suricata 📦
  4. Step 3: Verify the Installation ✅
  5. Step 4: Configure Suricata ⚙️
  6. Step 5: Download and Update Suricata Rules 📄
  7. Step 6: Start Suricata 🚀
  8. Step 7: Test the Installation 🧪
  9. Step 8: Automate Suricata Startup 🔧
  10. Conclusion 🎉

Introduction

Suricata is an open-source network threat detection engine that can function as an IDS, IPS, and Network Security Monitoring (NSM) tool. With Kali Purple, you have a powerful platform at your fingertips for enhancing your network security. In this guide, we’ll walk you through the steps to install and configure Suricata, complete with examples to make the process easy and intuitive.

Step 1: Update Your System 🔄

Before we dive into installing Suricata, let’s ensure your Kali Purple system is up to date. Running updates regularly helps you avoid potential compatibility issues.

sudo apt update && sudo apt upgrade -y

Step 2: Install Suricata 📦

Suricata is available directly from the Kali Linux repositories, making installation a breeze.

sudo apt install suricata -y

Step 3: Verify the Installation ✅

Let’s confirm that Suricata has been installed correctly. This step will give you peace of mind knowing everything is in place.

suricata --build-info

This command provides detailed information about your Suricata installation, including the version and compile-time options.

Step 4: Configure Suricata ⚙️

Now, it’s time to configure Suricata to fit your network environment.

Set the Network Interface 🌐

Suricata needs to know which network interface to monitor. Open the configuration file and make the necessary adjustments.

sudo nano /etc/suricata/suricata.yaml

Inside the file, locate the af-packet section and set your network interface.

af-packet:
  - interface: eth0
    threads: auto
    defrag: yes
    cluster-type: cluster_flow
    cluster-id: 99
    copy-mode: ips
    checksum-checks: auto

Configure Logging 📝

Proper logging ensures you have the data needed for analysis. Here’s an example configuration:

default-log-dir: /var/log/suricata/

outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      types:
        - alert:
        - http:
        - dns:
        - tls:
        - ssh:
        - flow:

Step 5: Download and Update Suricata Rules 📄

Suricata uses rules to detect potential threats. Keeping these rules up to date is crucial.

Install suricata-update:

sudo apt install python3-pip 
sudo pip3 install --pre --upgrade suricata-update

Update Rules:Download the latest rule sets.

sudo suricata-update

Verify the Rule Configuration:Ensure the rules are configured correctly.

sudo suricata -T -c /etc/suricata/suricata.yaml

Step 6: Start Suricata 🚀

Now that Suricata is configured, it’s time to start it up!

IDS Mode (monitoring only):

sudo suricata -c /etc/suricata/suricata.yaml -i eth0
  • IPS Mode (monitoring and blocking):
sudo suricata -c /etc/suricata/suricata.yaml --af-packet=eth0

Step 7: Test the Installation 🧪

Test Suricata by generating some network traffic. Use nmap or another tool to initiate traffic that should trigger alerts.

nmap -sS -Pn -p 80,443 <target-ip>

Check the logs:

tail -f /var/log/suricata/eve.json

You should see alerts matching the traffic.

Step 8: Automate Suricata Startup 🔧

To ensure Suricata starts automatically when your system boots, enable it as a service.

sudo systemctl enable suricata
sudo systemctl start suricata

Conclusion 🎉

Congratulations! You’ve successfully installed and configured Suricata IDS on Kali Purple. Your network is now better protected against potential threats. Regularly update your rules and monitor your logs to maintain robust security.

Feel free to share your experiences or ask questions in the comments below! 😊

Learn how to identify and prevent malware attacks with Suricata intrusion detection system rules

How To Detect Malware With Suricata Rules.

By

On February 1, 2023

In CyberSecurity, Distributed Denial of Service, Malware, Network Security, Ransomware, Trojan

Suricata is a highly efficient, open-source, and multi-platform network security engine that incorporates advanced Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) technologies. Developed and maintained by the Open Information Security Foundation (OISF) community since 2009, Suricata offers a comprehensive solution for detecting and preventing network security threats.

As we already explained in this article, an IDS is a passive system that is responsible for monitoring the behavior of a network to detect and report on possible unauthorized intrusions, while an IPS is an active system that works as an extension of the IDS and that , in addition to sending alerts on detections, it can also block malicious activity within the network – such as brute force attacks, DDoS, or attacks that seek to exploit vulnerabilities – and create a log with the intrusion. All this from the traffic, the file signatures, and the heuristic analysis of the flow. Additionally, IPS allows adding policies and restricting access to users and / or even applications.

That said, the most common uses for Suricata are related to scanning network traffic and analyzing traffic logs within a sandbox or sandbox environment (such as running malware). However, we can also use this tool for creating rules in order to classify malware.

Testing Meerkat

Next, we are going to see a simple example of how to use Suricata for malware classification.

Suppose we have a machine destined to perform dynamic analysis of malware samples, we could add different Suricata rules to be able to classify the type of malware that is running according to the traffic.

In this case, while a sample of the Trickbot banking Trojan is running on the network , a .pcap file is generated with information on the behavior of the traffic.

Through the network flow generated by the malware and knowing its behavior, we could create some rules in Suricata in the /etc/suricata/

rules folder :

In this Image you can see the list of some rules that come by default when installing Suricata.

Before proceeding with the generation of the rule to detect Trickbot, we will see a short description of the basic fields to generate rules in Suricata:

Action HeaderRule Options
  • Action: corresponds to the action (drop, alert, etc.) that Suricata will perform when the rule is identified in the network flow.
  • Header: this section corresponds to the specific network flow to be analyzed. From origin to destination. With the word “any” we can tell Meerkat that all ports will be analyzed.
  • Rule: rule to implement to detect malware in our case. Within this field there are keywords that help us create our rule:
    • Msg: alert message that Suricata will issue.
    • flow: network flow.
    • Content: contains the character string to be searched within the traffic.
    • Reference: contains references, in this case we put a verification MD5 hash of a Trickbot sample.
    • Sid: ID of the identified rule.
    • Rev: version of the rule.
    • Classtype: provides information on the classification of rules and alerts.

Taking as an example the rule for Trickbot malware, let’s proceed to add the Suricata rule in the / etc / suricata / rules directory for its detection: We save our rule for Trickbot taken from the aforementioned repository

Now we go on to analyze the traffic with Suricata by executing the command:
sudo suricata -c /etc/suricata/suricata.yaml -r [file.pcap]:

The previous statement generates four files:

The eve.json file is the file that interests us the most at the moment, since it is the output file that provides information about alerts, anomalies, metadata, and even information about specific files and logs:

If we search for the name of the message “ Trickbot “ with the command:

grep “Trickbot” eve.json

We will see that our rule was able to detect the malicious file as Trickbot.

To close this proof of concept it is important to mention that Suricata is a very useful tool to perform Threat Hunting . It is capable of identifying network protocols (TPC, UDP, HTTP, ICMP, etc.) enabling real-time control of the traffic generated on our network and controlling the presence of possible malicious codes. The latter can be done through MD5 checks, as we saw in the Trickbot rule.

On the other hand, we also recommend reviewing the Suricata Open Source repository of Emerging Threats rules , where you can find rules that detect new threats.
install-Suricata-in-Linux

How to install Suricata in Linux.

By

On January 16, 2023

In CyberSecurity, Distributed Denial of Service, Ethical Hacking, Malware, Network Security, Ransomware, Trojan

Suricata is an open-source network intrusion detection and prevention system (IDS/IPS) that can be used to detect and prevent cyber attacks on a computer network. It uses a variety of techniques, including signature-based detection and protocol analysis, to identify and block malicious traffic.

Installing Suricata on a Linux operating system is a multi-step process that involves the following steps:

Table of contents

1. Verify that your Linux system meets the minimum requirements for running Suricata. This includes checking that you have a supported version of Linux and that you have the necessary dependencies installed.

A supported version of Linux: Suricata is compatible with various Linux distributions such as Ubuntu, Debian, Fedora, and CentOS. You can check your Linux version by running the command.
  • GCC compiler: Suricata requires a C compiler to build the source code. You can check if GCC is installed on your system by running the command
"gcc --version"
  • Libpcap library: Suricata uses the libpcap library to capture network traffic. You can check if libpcap is installed on your system by running the command 
"ldconfig -p | grep libpcap"
  • libyaml library: Suricata uses the libyaml library for parsing YAML files. You can check if libyaml is installed on your system by running the command 
"ldconfig -p | grep libyaml"
  • libjansson library: Suricata uses the libjansson library for JSON data handling. You can check if libjansson is installed on your system by running the command 
"ldconfig -p | grep libjansson"
  • libmagic library: Suricata uses the libmagic library to detect file types. You can check if libmagic is installed on your system by running the command 
"ldconfig -p | grep libmagic"

Please note that these commands are for checking the dependencies in Ubuntu and Debian based distributions. In other distributions, the package manager commands may be different, for example, in Red Hat-based systems, you should use yum instead of apt-get.

2. Download the latest version of Suricata from the official website (https://suricata-ids.org/download/)

3.Extract the downloaded package using the command 

tar -xvzf suricata-version.tar.gz

4. Change directory to the extracted package by running 

cd suricata-version

5. Run the command 

"./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var"

to configure the installation.

6. Run the command to build the source code.

"make"

7. Run the command to install Suricata.

sudo make install-full

8. Configure Suricata by editing the configuration file located at /etc/suricata/suricata.yaml.

9. Start Suricata by running the command

(assuming that the interface you want to listen on is eth0)

"suricata -c /etc/suricata/suricata.yaml -i eth0"

10. Verify that Suricata is running correctly by checking the output of the command 

sudo suricata -i eth0 --list-runmode-helpers

It’s always recommended to check the official documentation of Suricata for the specific version that you are installing and to be aware of the dependencies that your system needs to have installed before proceeding with the installation. It’s always recommended to consult the official documentation of Suricata for the specific version that you are installing and to be aware of the dependencies that your system needs to have installed.

Powered by WordPress & Theme by Anders Norén