TOP30 Emerging Threats (ET) Snort alerts e IP nos honeypots
Autor: Rodrigo Sp0oKeR Montoro | Publicado: 2015-07-01T10:04:00-03:00

Instalei em 3 sensores da honeynet o meu querido snort. Logicamente o Snort só detecta o que já conhece, visto que são regras de blacklist, mas acho interessante ter ele rodando em paralelo com os daemons.





Abaixo a lista das TOP30 regras que alertaram:


&nbsp; 8241 [**] [1:2017162:2] ET SCAN SipCLI VOIP Scan [**]&nbsp;&nbsp; 5469 [**] [1:2402000:3709] ET DROP Dshield Block Listed Source group 1 [**]&nbsp;&nbsp; 4309 [**] [1:2001219:19] ET SCAN Potential SSH Scan [**]&nbsp;&nbsp; 2308 [**] [1:2011716:4] ET SCAN Sipvicious User-Agent Detected (friendly-scanner) [**]&nbsp;&nbsp; 2179 [**] [1:2010935:2] ET POLICY Suspicious inbound to MSSQL port 1433 [**]&nbsp;&nbsp; 2129 [**] [1:2010937:2] ET POLICY Suspicious inbound to mySQL port 3306 [**]&nbsp;&nbsp; 1862 [**] [1:2008578:6] ET SCAN Sipvicious Scan [**]&nbsp;&nbsp; 1162 [**] [1:2402001:3709] ET DROP Dshield Block Listed Source group 1 [**]&nbsp;&nbsp; 1031 [**] [1:2500108:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 55 [**]&nbsp;&nbsp;&nbsp; 624 [**] [1:2500132:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 67 [**]&nbsp;&nbsp;&nbsp; 568 [**] [1:2400000:2488] ET DROP Spamhaus DROP Listed Traffic Inbound group 1 [**]&nbsp;&nbsp;&nbsp; 280 [**] [1:2101411:12] GPL SNMP public access udp [**]&nbsp;&nbsp;&nbsp; 249 [**] [1:2500028:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 15 [**]&nbsp;&nbsp;&nbsp; 232 [**] [1:2500106:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 54 [**]&nbsp;&nbsp;&nbsp; 220 [**] [1:2500066:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 34 [**]&nbsp;&nbsp;&nbsp; 203 [**] [1:2403350:1829] ET CINS Active Threat Intelligence Poor Reputation IP TCP group 26 [**]&nbsp;&nbsp;&nbsp; 125 [**] [1:2403346:1829] ET CINS Active Threat Intelligence Poor Reputation IP TCP group 24 [**]&nbsp;&nbsp;&nbsp; 118 [**] [1:2500138:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 70 [**]&nbsp;&nbsp;&nbsp; 105 [**] [1:2009699:1] ET VOIP REGISTER Message Flood UDP [**]&nbsp;&nbsp;&nbsp;&nbsp; 92 [**] [1:2500022:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 12 [**]&nbsp;&nbsp;&nbsp;&nbsp; 90 [**] [1:2101616:9] GPL DNS named version attempt [**]&nbsp;&nbsp;&nbsp;&nbsp; 84 [**] [1:2500136:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 69 [**]&nbsp;&nbsp;&nbsp;&nbsp; 84 [**] [1:2010936:2] ET POLICY Suspicious inbound to Oracle SQL port 1521 [**]&nbsp;&nbsp;&nbsp;&nbsp; 73 [**] [1:2500100:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 51 [**]&nbsp;&nbsp;&nbsp;&nbsp; 68 [**] [1:2500062:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 32 [**]&nbsp;&nbsp;&nbsp;&nbsp; 52 [**] [1:2500102:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 52 [**]&nbsp;&nbsp;&nbsp;&nbsp; 47 [**] [1:2403331:1829] ET CINS Active Threat Intelligence Poor Reputation IP UDP group 16 [**]&nbsp;&nbsp;&nbsp;&nbsp; 45 [**] [1:2403333:1829] ET CINS Active Threat Intelligence Poor Reputation IP UDP group 17 [**]&nbsp;&nbsp;&nbsp;&nbsp; 44 [**] [1:2500140:3603] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 71 [**]&nbsp;&nbsp;&nbsp;&nbsp; 43 [**] [1:2403324:1829] ET CINS Active Threat Intelligence Poor Reputation IP TCP group 13 [**]

TOP30 IP de origem que geraram essas regras:


&nbsp;&nbsp; 1343 43.255.189.38&nbsp;&nbsp; 1063 61.240.144.66&nbsp;&nbsp;&nbsp; 796 155.94.64.250&nbsp;&nbsp;&nbsp; 767 23.92.80.90&nbsp;&nbsp;&nbsp; 755 218.77.79.43&nbsp;&nbsp;&nbsp; 648 23.92.80.27&nbsp;&nbsp;&nbsp; 528 61.240.144.65&nbsp;&nbsp;&nbsp; 438 61.240.144.64&nbsp;&nbsp;&nbsp; 414 61.240.144.67&nbsp;&nbsp;&nbsp; 369 61.160.224.130&nbsp;&nbsp;&nbsp; 351 46.165.249.2&nbsp;&nbsp;&nbsp; 351 185.94.111.1&nbsp;&nbsp;&nbsp; 327 222.186.27.171&nbsp;&nbsp;&nbsp; 326 61.160.224.128&nbsp;&nbsp;&nbsp; 313 192.187.115.202&nbsp;&nbsp;&nbsp; 289 188.138.1.239&nbsp;&nbsp;&nbsp; 242 124.158.12.201&nbsp;&nbsp;&nbsp; 235 23.92.80.95&nbsp;&nbsp;&nbsp; 234 173.193.12.244&nbsp;&nbsp;&nbsp; 233 188.227.186.16&nbsp;&nbsp;&nbsp; 231 69.64.33.115&nbsp;&nbsp;&nbsp; 227 46.165.210.84&nbsp;&nbsp;&nbsp; 225 71.6.135.131&nbsp;&nbsp;&nbsp; 220 62.210.71.22&nbsp;&nbsp;&nbsp; 218 192.3.8.210&nbsp;&nbsp;&nbsp; 215 94.102.49.168&nbsp;&nbsp;&nbsp; 210 61.160.224.129&nbsp;&nbsp;&nbsp; 207 23.92.80.97&nbsp;&nbsp;&nbsp; 195 162.244.35.24&nbsp;&nbsp;&nbsp; 189 222.186.21.133

Pretendo colocar sensores internos em redes reais, o que acredito que adicionará outros alertas, porém é válido ativar essas regras caso não as possua.

Ainda estou em fase de testes e pretendo num futuro compartilhar essas informações de forma automatica (API) ou site.

Happy Snorting!

Rodrigo "Sp0oKeR" Montoro