Taking a bite out of logs with Sagan

Size: px

Start display at page:

Download "Taking a bite out of logs with Sagan"

Rudolf Holland
5 years ago
Views:

1 Taking a bite out of logs with Sagan By Champ Clark III (AKA - Da Beave) cclark@quadrantsec.com Sagan Website: Slides: 1

2 Telephreak.org 2

3 finger Security researcher Network Quadrant Information Security. Syngress author White papers Various magazines (Wired, 2600, etc). Founder of Telephreak & Deathrow OpenVMS cluster. Defensive computing programmer 3

4 What is Sagan? Sagan is a open source, multi-threaded *nix application written in C that preforms real time log analysis. 4

5 What is Sagan? Sagan leverages some existing technologies rather than re-inventing the wheel... Namely... 5

6 Sourcefire s Snort 6

7 Sagan Snort like features. Uses the same SQL schema. Unified2 output format. Rule sets are very similar. 7

8 Correlation. 8

9 How does Sagan receive log data? 9

10 Sagan & Snort Correlation Points. Timestamps. Source / Destination. Protocol ( UDP / TCP / ICMP ). Protocol port being used. Classification. 10

11 How are the data/events correlated? 11

12 Log normalization. 12

13 ACME Corp Centralized Logging Setup Centralized Logging Address: Target IP Address: Attackers IP address:

14 ACME Corp Centralized Logging Setup Syslog source == Syslog destination ==

15 Where is the attackers IP address? 15

16 Lame. 16

17 Attack Syslog Message: sshd[666]: Failed keyboard-interactive/pam for invalid user dabeave from port ssh2 17

18 Attack Syslog Message: sshd[666]: Failed keyboard-interactive/pam for invalid user dabeave from port ssh2 18

19 How Sagan See s the Attack. Records the timestamp. It knows this attack is TCP. The target port is likely TCP/22. The source port is TCP/ The invalid login is dabeave. The true source is The destination/target is Classification line up with Snort rules. 19

20 Really? How? 20

21 Attack Syslog Message: sshd[666]: Failed keyboard-interactive/pam for invalid user dabeave from port ssh2 21

22 Stored to our Snort IDS Database. 22

23 Security Consoles. 23

24 Snorby.org 24

25 Snorby.org 25

26 Snorby.org 26

27 Snorby.org 27

28 Snorby.org 28

29 Snorby.org 29

30 Sguil.sf.net 30

31 One place for log events and IDS/IPS events. 31

32 Your choice of security console doesn t matter to Sagan. 32

33 BASE 33

34 BASE 34

35 BASE 35

36 Prelude 36

37 Prelude 37

38 The console doesn t matter. 38

39 Sagan rules. 39

40 Let s write a Sagan rule for it. sshd[666]: Failed keyboard-interactive/pam for invalid user dabeave from port ssh2 40

41 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; program: sshd; pri: 1; sid: ; rev:6;) 41

42 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; program: sshd; pri: 1; sid: ; rev:6;) 42

43 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; program: sshd; pri: 1; sid: ; rev:6;) 43

44 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; program: sshd; pri: 1; sid: ; rev:6;) 44

45 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; program: sshd; pri: 1; sid: ; rev:6;) 45

46 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; program: sshd; pri: 1; sid: ; rev:6;) 46

47 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; program: sshd; pri: 1; sid: ; rev:6;) 47

48 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; program: sshd; pri: 1; sid: ; rev:6;) 48

49 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; program: sshd; pri: 1; sid: ; rev:6;) 49

50 That s it. 50

51 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid user"; content: "invalid user ; nocase; program: sshd; classtype: attempted- user; sid: ; rev:7;) 51

52 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid or Illegal user"; pcre: "/invalid illegal/i ; content: user ; nocase; program: sshd; classtype: attempted- user; sid: ; rev:7;) 52

53 /\x7c\d+\x2e\d+\x2e\d+\x2e\d+ \x7c.*\x7cyuri\ s+v1\x2e\d+\x7c/smi 53

54 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid or Illegal user"; pcre: "/invalid user illegal user/ i ; program: sshd; classtype: attempted- user; sid: ; rev:8;) 54

55 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid or Illegal user"; pcre: "/invalid user illegal user/ i ; program: sshd; threshold: type limit, track by_src, count 5, seconds 300; classtype: attempted- user; sid: ; rev:8;) 55

56 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid or Illegal user"; pcre: "/invalid user illegal user/ i ; program: sshd; threshold: type limit, track by_src, count 5, seconds 300; after: track by_src, count 3, seconds 300; classtype: attempted- user; sid: ; rev:9;) 56

57 Nifty, I still don t see Log normalization. Only detection. 57

58 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid or Illegal user"; pcre: "/invalid user illegal user/ i ; program: sshd; threshold: type limit, track by_src, count 5, seconds 300; after: track by_src, count 3, seconds 300; normalize: openssh; classtype: attempted- user; sid: ; rev:10;) 58

59 liblognorm 59

60 Failed keyboard-interactive/pam for invalid user dabeave from port ssh2 60

61 Failed keyboard-interactive/pam for invalid user %username:word% from %src-ip:ipv4% port %srcport:number% ssh2 61

62 Current Sagan Rules adtran, apache, apc-emu, arp, asterisk, attack, bash, bind, bonding, bro-ids, cacti, cisco-ios, cisco-pixasa, courier, dns, dovecot, fortinet, ftpd, grsec, hordeimp, hostapd, imapd, ipop3d, juniper, kismet, linux-kernel, milter, mysql, nginx, ntp, openssh, ossec, php, postfix, postgresql, pptp, procurve, pure-ftpd, racoon, roundcube, rsync, samba, sendmail, snort, solaris, sonicwall, squid, su, syslog, tcp, telnet, tripwire, vmpop3d, vmware, vpopmail, vsftpd, weblabrinth, windows (event logs), wordpress, xinetd, zeus. 62

63 Output Plugins. (see the sagan.conf) 63

64 output smtpserver=

65 output external: /home/user/ myscript parseable 65

66 output database: log, mysql, user=sagan password=pw dbname=sagan host=

67 output unified2: filename sagan.u2, limit

68 output alert_fwsam: /mypassword 68

69 alert tcp $EXTERNAL_NET any - > $HOME_NET 22 (msg:"[openssh] Invalid or Illegal user"; pcre: "/invalid user illegal user/ i ; program: sshd; threshold: type limit, track by_src, count 5, seconds 300; after: track by_src, count 3, seconds 300; normalize: fwsam: src, 1 day; openssh; classtype: attempted- user; sid: ; rev:10;) 69

70 Preprocessors. (See the sagan.conf) 70

71 preprocessor sagan-trackclients: client_timeout

72 Sagan Preprocessors In Development Log anomaly detection. Websense Threatseeker integration. DShield Integration. 72

73 Q & A? 73

The Bro Network Security Monitor

The Bro Network Security Monitor Bro Integrations: Some Misc. Bro Related Stuff Jon Schipp, NCSA BroCon15 MIT, Cambridge, Massachusetts Agenda Outlining a few things I ve worked on ISLET - Software that