Project

General

Profile

ThreatPattern Definitions » History » Version 10

Luke Murphey, 04/03/2010 03:46 AM

1 1 Luke Murphey
h1. ThreatPattern Definitions
2 1 Luke Murphey
3 6 Luke Murphey
{{>toc}}
4 1 Luke Murphey
5 6 Luke Murphey
ThreatPattern's similar in concept to the signatures used by the Snort IDS system.
6 1 Luke Murphey
7 1 Luke Murphey
h2. Definition Verb
8 1 Luke Murphey
9 1 Luke Murphey
The rules start with a action that indicates what the system should do with the rule. The action verbs are as follows:
10 1 Luke Murphey
11 1 Luke Murphey
|*Verb*|*Operation*                                                |*Notes*|
12 1 Luke Murphey
|Eval  |Causes the rule to be evaluated but no action taken.       |Only valid when an Set option is used. Used to set a flag that may be used in another signature (allows the rules to maintain state).|
13 1 Luke Murphey
|Alert |Causes the rule to indicate that a match has been found.   |Used only to determine if the site may be compromised.|
14 1 Luke Murphey
|Block |Causes the resource to be blocked (end user cannot access) |Useful when using a proxy to control access to the servers; this is not currently used yet.|
15 1 Luke Murphey
16 1 Luke Murphey
{{include(Definition_Naming_Convention)}}
17 1 Luke Murphey
18 1 Luke Murphey
h2. Definition Body
19 1 Luke Murphey
20 1 Luke Murphey
The definition is composed of options that are used to make conclusions about the data provided. Below is a list of the various options:
21 1 Luke Murphey
22 3 Luke Murphey
h3. Meta-Data Options
23 3 Luke Murphey
24 3 Luke Murphey
The following options are used to provide information about the definition:
25 3 Luke Murphey
26 1 Luke Murphey
|*Option*       |*Required*|*Value*   |*Example*   |*Description*|
27 2 Luke Murphey
| ID            | Yes     | <integer> | ID=10012441   |             |
28 2 Luke Murphey
| Message       | Yes     | <string>  | Message="Malicious Website Discovered" | |
29 2 Luke Murphey
| Version       |         | <integer> | Version=3 | |
30 3 Luke Murphey
| Reference     |         | <string>  | url,threatfactor.com | Types of references are: url ,bugtraq, cve, nessus, arachnids, mcafee |
31 3 Luke Murphey
| Severity      |         | <string>  | Severity="Medium" | Must be either low, medium or high and is required if the definition verb is alert or block |
32 3 Luke Murphey
33 3 Luke Murphey
34 3 Luke Murphey
h3. Data Analysis Options (Evaluators)
35 3 Luke Murphey
36 4 Luke Murphey
The following options are used to analyze the data:
37 4 Luke Murphey
38 3 Luke Murphey
|*Option*       |*Required*|*Value*   |*Example*   |*Description*|
39 1 Luke Murphey
| String        |         | <string>  | String=haxored | Looks for the given String value |
40 1 Luke Murphey
| Regex         |         | PCRE      | Regex=/apple/i | Looks for the given Regex (in PCRE format) |
41 1 Luke Murphey
| Byte          |         | Bytes     | Byte=90 90 90 | Looks for the given bytes |
42 3 Luke Murphey
| ContentType   |         | PCRE or <string>  | ContentType=/text.*//i | Matches a given content type. The content type is inferred by the scanning engine based upon the file contents, HTTP headers and file extension. |
43 3 Luke Murphey
| URI           |         | <string>  | URI="http://google.com" |  |
44 3 Luke Murphey
| IgnoreCase    |         |           | | Synonymous with "NoCase" |
45 3 Luke Murphey
| BasicEncoding |         | <string>  | | Causes the evaluator to skip character set encoding and treat the data as if it is raw bytes (or ASCII encoded) |
46 3 Luke Murphey
| IsDataAt      |         | <integer> | | Determines if data is at the given position (i.e. equates to false if the data stream ends before the value provided) |
47 1 Luke Murphey
| Offset        |         | <integer> | Offset=128 | Sets how much data should be skipped from the previous operator |
48 1 Luke Murphey
| Depth         |         | <integer> | Depth=1024 | Sets a maximum depth into the data that the definition will examine (relative to the beginning of the data stream)|
49 1 Luke Murphey
| Within        |         | <integer> | Within=512 | Sets how many characters or bytes to analyze for the previous option before giving up. This is oftentimes used to increase the performance of definitions by limiting the amount of data they have to analyze. |
50 1 Luke Murphey
| ByteTest      |         | operation | 4 digits >= 128 (hexadecimal) | Can accept options such as big-endian, little-endian, hexadecimal, absolute-value and can operate on both digits (character representations of a number) or bytes (integer values) |
51 1 Luke Murphey
| ByteJump      |         | operation | 4 bytes (big-endian, align-8) | Can accept options such as big-endian, little-endian, hexadecimal, absolute-value, octal, align-4 and align-8 and can operate on both digits (character representations of a number) or bytes (integer values)|
52 3 Luke Murphey
53 3 Luke Murphey
h3. Variable Options
54 3 Luke Murphey
55 4 Luke Murphey
The following options are used to set and read variables. Variables are values that are set by one definition and can be read by other definitions. For example, one definition could set a variable named "ActiveXFound" if an ActiveX control is found on a page and other definitions that look for specific ActiveX controls can check to determine if the variable "ActiveXFound" exist before bothering to analyze the data for a specific ActiveX control.
56 4 Luke Murphey
57 4 Luke Murphey
Below are the relevant variables:
58 4 Luke Murphey
59 3 Luke Murphey
|*Option*       |*Required*|*Value*   |*Example*   |*Description*|
60 3 Luke Murphey
| Set           |         | <string>  | Set="IframeFound"| Sets the given variable (allows rules to maintain state) |
61 1 Luke Murphey
| UnSet         |         | <string>  | UnSet="IframeFound"| Unsets the given variable (allows rules to maintain state) |
62 1 Luke Murphey
| IfSet         |         | <string>  | IfSet="ActiveX"| Makes the action dependent upon whether the variable exists |
63 1 Luke Murphey
| IfNotSet      |         | <string>  | IfNotSet="ActiveX"| Opposite of above |
64 1 Luke Murphey
| Toggle        |         | <string>  | Toggle="JavaScriptFound" |  |
65 1 Luke Murphey
66 1 Luke Murphey
h2. How Definitions Analyze Data
67 1 Luke Murphey
68 7 Luke Murphey
A definition is considered a match when all of the evaluators match the data. For example the definition below will match on any combination of both "Foo" and "Bar" (in no particular order):
69 1 Luke Murphey
70 7 Luke Murphey
<pre>
71 7 Luke Murphey
Alert("Example.Test.FooBar"){
72 7 Luke Murphey
        Message="Foo Bar Was found";
73 7 Luke Murphey
        Severity="Low";
74 7 Luke Murphey
        ID=1000001;
75 7 Luke Murphey
        Version=1;
76 7 Luke Murphey
        String="Foo";
77 7 Luke Murphey
        String="Bar";
78 7 Luke Murphey
}
79 7 Luke Murphey
</pre>
80 1 Luke Murphey
81 7 Luke Murphey
Evaluators can be made relative to one another by using the Offset or Within options. The following definition will match when data contains "Bar" 4 or more characters after "Foo".
82 7 Luke Murphey
83 7 Luke Murphey
<pre>
84 7 Luke Murphey
Alert("Example.Test.FooBar"){
85 7 Luke Murphey
        Message="Foo Bar Was found";
86 7 Luke Murphey
        Severity="Low";
87 7 Luke Murphey
        ID=1000001;
88 7 Luke Murphey
        Version=1;
89 7 Luke Murphey
        String="Foo";
90 7 Luke Murphey
        String="Bar"; Offset=4;
91 7 Luke Murphey
}
92 7 Luke Murphey
</pre>
93 7 Luke Murphey
94 7 Luke Murphey
For performance reasons, you may want to place a limit on how many characters the definition will analyze. In the following example, we have added a limit to that causes the definition to only consider the 64 characters after "Foo" when looking for "Bar":
95 7 Luke Murphey
96 7 Luke Murphey
<pre>
97 7 Luke Murphey
Alert("Example.Test.FooBar"){
98 7 Luke Murphey
        Message="Foo Bar Was found";
99 7 Luke Murphey
        Severity="Low";
100 7 Luke Murphey
        ID=1000001;
101 7 Luke Murphey
        Version=1;
102 7 Luke Murphey
        String="Foo";
103 7 Luke Murphey
        String="Bar"; Offset=4; Within="64";
104 7 Luke Murphey
}
105 7 Luke Murphey
</pre>
106 7 Luke Murphey
107 8 Luke Murphey
Evaluators can be negated using the exclamation mark. The following definition matches when the data contains "Foo" but _does not_ include "Bar" within 64 characters:
108 8 Luke Murphey
109 8 Luke Murphey
<pre>
110 8 Luke Murphey
Alert("Example.Test.FooBar"){
111 8 Luke Murphey
        Message="Foo Bar Was found";
112 8 Luke Murphey
        Severity="Low";
113 8 Luke Murphey
        ID=1000001;
114 8 Luke Murphey
        Version=1;
115 8 Luke Murphey
        String="Foo";
116 8 Luke Murphey
        String!="Bar"; Within="64";
117 8 Luke Murphey
}
118 8 Luke Murphey
</pre>
119 8 Luke Murphey
120 9 Luke Murphey
h2. Mixed Mode Evaluators
121 1 Luke Murphey
122 10 Luke Murphey
NSIA will not allow evaluators that look for byte patterns to be used relative to evaluators looking for strings unless the BasicEncoding option is used. This is due to the fact that the number of bytes per character is highly variable depending on the charset involved; NSIA does not have a method to accurately account for this. Definitions with evaluators that look for data based on raw bytes and character are referred to as "mixed mode" evaluators and result in undefined behavior. Therefore, a definition such as the one below will be rejected:
123 1 Luke Murphey
124 9 Luke Murphey
<pre>
125 9 Luke Murphey
Alert("Example.Test.FooBar"){
126 9 Luke Murphey
        Message="Foo Bar Was found";
127 9 Luke Murphey
        Severity="Low";
128 9 Luke Murphey
        ID=1000001;
129 9 Luke Murphey
        Version=1;
130 9 Luke Murphey
        Byte=46 6F 6F ;
131 9 Luke Murphey
        String="Bar"; Offset=4;
132 9 Luke Murphey
}
133 9 Luke Murphey
</pre>
134 6 Luke Murphey
135 9 Luke Murphey
However, the following definition would be accepted since the evaluators are not relative to one another:
136 6 Luke Murphey
137 6 Luke Murphey
<pre>
138 9 Luke Murphey
Alert("Example.Test.FooBar"){
139 9 Luke Murphey
        Message="Foo Bar Was found";
140 6 Luke Murphey
        Severity="Low";
141 9 Luke Murphey
        ID=1000001;
142 6 Luke Murphey
        Version=1;
143 9 Luke Murphey
        Byte=46 6F 6F ;
144 9 Luke Murphey
        String="Bar";
145 1 Luke Murphey
}
146 1 Luke Murphey
</pre>