Itx8071-task2

This homework assignment requires the knowledge from Modules 6 and 7.

Create SEC rules that accomplish the following event correlation task:

1) the rules must process netfilter firewall syslog events about blocked packets sent to local TCP and UDP ports. For example, the following two events represent accesses to local ports 23/tcp and 25/tcp which were blocked by the local firewall:

Nov 6 01:13:02 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=192.168.1.67 DST=192.168.1.107 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=20049 DF PROTO=TCP SPT=44963 DPT=23 WINDOW=49640 RES=0x00 SYN URGP=0 Nov 6 01:13:08 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=192.168.1.104 DST=192.168.1.107 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=36362 DF PROTO=TCP SPT=56918 DPT=25 WINDOW=29200 RES=0x00 SYN URGP=0

The rules must also process Apache web server syslog events with status codes 403 (Forbidden) and 404 (Not Found). For example, the following event represents GET request from client 192.168.1.101 to URL /banner.png that was not found (status code is 404):

Nov 6 19:05:37 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:05:37 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"

2) if some URL is requested from 5 different clients within 5 minutes with status code 403 or 404, this URL must be memorized as false positive for the following 15 minutes. For example, if the following events appear in the log, the URL /offers/sales-offer.html must be memorized as false positive at Nov 6 19:06:17 for 15 minutes, since it has been accessed by 5 different clients 192.168.1.101, 192.168.1.103, 192.168.1.104, 192.168.2.16, and 192.168.7.33 within 5 minutes (between Nov 6 19:03:49 and Nov 6 19:06:17):

Nov 6 19:03:48 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:03:48 +0200] "GET /images/poweredby.png HTTP/1.1" 200 3956 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 19:03:49 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:03:49 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 19:03:59 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:03:59 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 19:04:07 localhost apache: 192.168.1.102 - - [06/Nov/2016:19:04:07 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 19:04:22 localhost apache: 192.168.1.103 - - [06/Nov/2016:19:04:22 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 19:04:29 localhost apache: 192.168.1.103 - - [06/Nov/2016:19:04:29 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 19:04:40 localhost apache: 192.168.1.104 - - [06/Nov/2016:19:04:40 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 19:05:01 localhost apache: 192.168.2.16 - - [06/Nov/2016:19:05:01 +0200] "GET /offers/sales-offer.html HTTP/1.1" 403 225 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 19:06:17 localhost apache: 192.168.7.33 - - [06/Nov/2016:19:06:17 +0200] "GET /offers/sales-offer.html HTTP/1.1" 403 225 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 19:26:16 localhost apache: 192.168.1.101 - - [06/Nov/2016:19:26:16 +0200] "GET /images/apache_pb.gif HTTP/1.1" 200 2326 "http://192.168.1.206/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36"

3) if some host probes 3 different ports and accesses 3 different URLs within 60 seconds, so that status codes for URL accesses are 403 and/or 404 and none of the URLs has been previously memorized as false positive, send an e-mail to root@localhost about offending activities from this host.

Note that ports in netfilter firewall messages must be distinguished not only by port number but also by transport protocol (in other words, ports 53/tcp and 53/udp must be considered different ports).

Also note that the detection should be done with a sliding window approach -- if the counting operation for some host has not seen enough events during 60 seconds, the 60 second detection window should be moved forward.

After an e-mail alert has been issued about the host, disable further alerts for this host for 2 hours.

For example, suppose the following events are observed and the URL /offers/sales-offer.html has been previously memorized as false positive: Nov 6 18:51:01 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=1881 DF PROTO=TCP SPT=16333 DPT=25 WINDOW=5840 RES=0x00 SYN URGP=0 Nov 6 18:51:07 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=23421 DF PROTO=TCP SPT=34342 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 Nov 6 18:51:08 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:51:08 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 18:51:08 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:51:08 +0200] "GET /banner2.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 18:51:08 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=23421 DF PROTO=TCP SPT=34342 DPT=80 WINDOW=29200 RES=0x00 SYN URGP=0 Nov 6 18:51:09 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:51:09 +0200] "GET /banner.png HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 18:51:12 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=31442 DF PROTO=TCP SPT=47846 DPT=21 WINDOW=49640 RES=0x00 SYN URGP=0 Nov 6 18:51:13 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:51:13 +0200] "GET /offers/sales-offer.html HTTP/1.1" 404 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 18:51:14 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.93 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=17209 DF PROTO=TCP SPT=11652 DPT=23 WINDOW=7290 RES=0x00 SYN URGP=0 Nov 6 18:51:52 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.7 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=31442 DF PROTO=TCP SPT=47846 DPT=445 WINDOW=49640 RES=0x00 SYN URGP=0 Nov 6 18:52:05 localhost apache: 10.1.1.7 - - [06/Nov/2016:18:52:05 +0200] "GET /docs/report.doc HTTP/1.1" 403 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" Nov 6 18:52:14 localhost kernel: iptables: IN=eth0 OUT= MAC=X SRC=10.1.1.93 DST=10.13.25.59 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=17209 DF PROTO=TCP SPT=11652 DPT=23 WINDOW=7290 RES=0x00 SYN URGP=0

The event correlation rules must produce an alarm at Nov 6 18:52:05 about offending host 10.1.1.7, since between Nov 6 18:51:07 and Nov 6 18:52:05 this host has: 1) probed 4 distinct ports 80/tcp, 21/tcp, 23/tcp, and 445/tcp, 2) accessed 3 distinct URLs /banner.png, /banner2.png, and /docs/report.doc

  with status codes 404 and 403.

Note that probe against port 25/tcp at Nov 6 18:51:01 does not fit into the 60 second window. Also, note that when the third distinct port 23/tcp is probed at Nov 6 18:51:14, an alarm can not be produced, since at that moment only two distinct URLs /banner.png and /banner2.png have been accessed (access to /offers/sales-offer.html must be ignored, since it has been previosly detected as false positive).

Some hints for accomplishing this assignment: - don't try to solve the whole assignment with just one rule, but rather write

 several rules which interact,

- in order to accomplish subtask 2 (detection of port probes and URL accesses

 from the same host within 60 second window), use EventGroup2 rule.

Apart from studying the examples from the course slides, have a look at the SEC man page (installed at the virtual machines or found at http://simple-evcorr.github.io/man.html).