Powershell Empire - Detection with Zeek

Transitioning to Zeek, let's now see what we can learn from a quick analysis. First up, the version of Zeek I'm using.

┌──(root💀securitynik)-[/tmp/zeek]
└─# zeek4 --version
zeek4 version 4.2.0-dev.448

Let's look at this from 3 different perspectives. First, let's simply run Zeek and take a look at the logs that have been created based on our Indicators of Compromise (IoC). Running Zeek against the pcap file.

┌──(root💀securitynik)-[/tmp/zeek]
└─# zeek --no-checksums -r /home/securitynik/packets/empire-full-session.pcap 

Looking at the logs created.

┌──(root💀securitynik)-[/tmp/zeek]
└─# ls *.log
conn.log  dns.log  files.log  http.log  packet_filter.log  pe.log  reporter.log  ssh.log  weird.log

In a production environment, you will have lots more logs. So we don't want to go through all the logs. Let's leverage grep to find our IoCs..

┌──(root💀securitynik)-[/tmp/zeek]
└─# grep --perl-regexp "\/(?i)(news|login|admin).*?php" *.log --color=always | more
...
http.log:1637431443.514058      CcC0YB2heOkR9Gnpi4      10.0.0.110      1650    10.0.0.107      443     3       POST    10.0.0.107
/news.php       -       1.1     securitynik-launcher-bat-User-Agent     -       206     44506   200     OK      -       -       (empty) -       -       -     F4wiHG1bpwW03v71vh       -       -       FghBlt1qKU0utYSHd7      -       -
http.log:1637431506.697538      CcC0YB2heOkR9Gnpi4      10.0.0.110      1650    10.0.0.107      443     4       GET     10.0.0.107
/admin/get.php  -       1.1     Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko    -       0       1279    200     OK      -       -     (empty)  -       -       -       -       -       -       FvSNLf3mGluOXZ5Qu       -       text/html
http.log:1637431566.836488      CcC0YB2heOkR9Gnpi4      10.0.0.110      1650    10.0.0.107      443     5       GET     10.0.0.107
/login/process.php      -       1.1     Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko    -       0       1279    200     OK      -     -(empty) -       -       -       -       -       -       F6xbg04XsiJmRygrwc      -       text/html
...

At this point, we identify Zeek has logs pertaining to this activity. Let's figure out which logs this activity is found in.

┌──(root💀securitynik)-[/tmp/zeek]
└─# grep --perl-regexp "\/(?i)(news|login|admin).*?php" *.log | awk --field-separator ':' '{ print $1 }' | sort | uniq --count | sort --numeric --reverse      
   1807 http.log

Looks like activity was only seen in the http.log. Focusing here a bit more, extracting a few key fields.

┌──(root💀securitynik)-[/tmp/zeek]
└─# zeek-cut -d ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri  < http.log | grep --perl-regexp "\/(?i)(news|login|admin).*?php"
ts                                  uid                 id.orig_h   id.orig_p   id.resp_h   id.resp_p  method  host             uri
....
2021-11-20T20:21:40-0500        Cp6N4630HCYa17LUa8      10.0.0.110      1697    10.0.0.107      443     GET     10.0.0.107      /news.php
2021-11-20T20:22:20-0500        CwazkE3YeyHUnSxQ7f      10.0.0.110      1723    10.0.0.107      443     GET     10.0.0.107      /admin/get.php
2021-11-20T20:22:38-0500        C9qPFB1lfO6u42p4G3      10.0.0.110      1699    10.0.0.107      443     GET     10.0.0.107      /login/process.php
...

Picking on the first UID, to see where else activity has been identified.

┌──(root💀securitynik)-[/tmp/zeek]
└─# grep "Cp6N4630HCYa17LUa8" *.log | cut --fields 1 --delimiter ":" | sort | uniq --count | sort --numeric --reverse
    315 files.log
    311 http.log
      1 conn.log

Looking at the 1 entry in the conn.log, while there is a lot to see, extracting a few fields and looking at the duration, shows this activity lasted 18437.626252 seconds or 307 hours or 5 days.

┌──(root💀securitynik)-[/tmp/zeek]
└─# zeek-cut -d ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes < conn.log | grep "C9qPFB1lfO6u42p4G3"                                           
2021-11-20T18:02:04-0500        C9qPFB1lfO6u42p4G3      10.0.0.110      1699    10.0.0.107      443     tcp     http    18437.626252    55444   462342

Looking at the files.log, I did not really find anything of interest. 

┌──(root💀securitynik)-[/tmp/zeek]
└─# grep "Cp6N4630HCYa17LUa8" files.log | more
1637449322.213963       FbvsAO3tTXJzOyuaj4      10.0.0.107      10.0.0.110      Cp6N4630HCYa17LUa8      HTTP    0       (empty) text/html       -       0.000479        -       F       1279    1279    0       0       F       -       -       -       -       -       -
        -
1637449382.306875       FkJSID2jB0CMQfrcZb      10.0.0.107      10.0.0.110      Cp6N4630HCYa17LUa8      HTTP    0       (empty) text/html       -       0.000484        -       F       1279    1279    0       0       F       -       -       -       -       -       -
        -
1637449442.421711       F4DJ7Z1wfsWwZ0INka      10.0.0.107      10.0.0.110      Cp6N4630HCYa17LUa8      HTTP    0       (empty) text/html       -       0.000375        -       F       1279    1279    0       0       F       -       -       -       -       -       -
        -
1637449502.518040       Fnn8vklGr2q1mTGt2       10.0.0.107      10.0.0.110      Cp6N4630HCYa17LUa8      HTTP    0       (empty) text/html       -       0.000484        -       F       1279    1279    0       0       F       -       -       -       -       -       -

....

Additionally, no files were actually extracted as can be seen by the absenece of the extracted folder.

┌──(root💀securitynik)-[/tmp/zeek]
└─# ls -l extracted_files/
ls: cannot access 'extracted_files/': No such file or directory

We can spend more time poking around. However, the objective was to do some basic detection and we have achieved that. 

Second, let's take a look at a Zeek signature to detect our IoC. 

While Zeek can be used for signature detection, it is not the recommended way to use Zeek. However, since it does provide the capability to perform some basic signature based detection, then let's take advantage of this feature.

Couple of different ways to do this. Let's take one.

# This signature is about detecting PowerShell Empire in my lab

signature powershellEmpire
    {
	# look into the IP Header at offset 6 for tcp 
	header ip[9] == 0x06
			
        # Look for the soruce address representing out protected network
	# Look at the IP header, start at offset 12 and span 4 bytes for the
	# the source IP
	header ip[12:4] == 10.0.0.110/32
			
	# Look for the destination address 
	# Look at the IP header, start at offset 15 and span 4 bytes for the
	# the destination IP			
	# Consider anything going to none 10.0.0.0/32 destinations as something we don't own.
	header ip[16:4] != 10.0.0.110/32
			
	# Look for destination port 443
	header tcp[2:2] == 443
		
	# Look for the ASCII strings news or admin or login followed by php
	http /.*(news|admin|login).*\.php/
			
	# Ensure the 3-way handshake has completed and
	# The traffic is coming from an originator
	tcp-state established,originator 
			
	# Generate an event
	event "SUSPICIOUS POSSIBLE Powershell Empire Activity"
		
    }

Running Zeek

┌──(root💀securitynik)-[/tmp]
└─# zeek --readfile /home/securitynik/packets/empire-full-session.pcap --rulefile /home/securitynik/packets/powershell.sig --no-checksums

Verifying the files created 

┌──(root💀securitynik)-[/tmp]
└─# ls *.log
conn.log  dns.log  files.log  http.log  notice.log  packet_filter.log  pe.log  signatures.log  ssh.log  weird.log

Taking at look at the signature.log file, we see ...

┌──(root💀securitynik)-[/tmp]
└─# zeek-cut -d -m < signatures.log                                                                                                                            
ts      uid     src_addr        src_port        dst_addr        dst_port        note    sig_id  event_msg       sub_msg sig_count       host_count
2021-11-20T13:03:59-0500        CskRYg2jaNXRC0fLy8      10.0.0.110      1650    10.0.0.107      443     Signatures::Sensitive_Signature powershellEmpire      10.0.0.110: SUSPICIOUS POSSIBLE Powershell Empire Activity       /news.php       -       -
2021-11-20T16:03:25-0500        Ckr2TD12vYGon6LR58      10.0.0.110      1686    10.0.0.107      443     Signatures::Sensitive_Signature powershellEmpire      10.0.0.110: SUSPICIOUS POSSIBLE Powershell Empire Activity       /admin/get.php  -       -
2021-11-20T16:51:53-0500        CI3BQ34gmAYusuQ6Yf      10.0.0.110      1689    10.0.0.107      443     Signatures::Sensitive_Signature powershellEmpire      10.0.0.110: SUSPICIOUS POSSIBLE Powershell Empire Activity       /login/process.php      -       -
2021-11-20T17:12:48-0500        CT0hHi3BBoldu0NY3e      10.0.0.110      1690    10.0.0.107      443     Signatures::Sensitive_Signature 
...

Looking at the notice.log we see ...

┌──(root💀securitynik)-[/tmp]
└─# zeek-cut -d -m < notice.log | more
ts      uid     id.orig_h       id.orig_p       id.resp_h       id.resp_p       fuid    file_mime_type  file_desc       proto   note    msg     sub     src   dst      p       n       peer_descr      actions suppress_for    remote_location.country_code    remote_location.region  remote_location.city    remote_location
.latitude       remote_location.longitude
2021-11-20T13:03:59-0500        CskRYg2jaNXRC0fLy8      10.0.0.110      1650    10.0.0.107      443     -       -       -       tcp     Signatures::Sensitive_S
ignature        10.0.0.110: SUSPICIOUS POSSIBLE Powershell Empire Activity      /news.php       10.0.0.110      10.0.0.107      443     -       -       Notice:
:ACTION_LOG     3600.000000     -       -       -       -       -
...

Third, Zeek Scripting 

Now that we have used a signature to detect our Powershell Empire activity, let's now get to the more laborious but better way of using Zeek. Specifically it's scripting capabilities.

# Define the modules to use
@load base/files/extract
@load base/files/hash
@load base/frameworks/notice
@load base/frameworks/logging
@load base/protocols/conn
@load base/protocols/http


module PSEmpire;

export {
	global hit_count: int = 0;
	global compromised_psempire_hosts: set[addr] = { } &redef &write_expire=7 days;
	global empire_file_names: pattern = /news|admin|process/;		
		
	# Setup our notice capabilities
	redef enum Notice::Type += { suspicious_psempire_compromised_host };
	redef Notice::type_suppression_intervals += { [suspicious_psempire_compromised_host] = 1day };
		
	# Setup our own log
	redef enum Log::ID += { PSEmpire::LOG };
		
	option msg = "Say what you want to see";		
				
	# Define the log the fields for the PSEmpire log records
	type Info: record 
	    {
		ts: time &log;		# Add a timestamp
		src_host: addr &log;	# Add the source IP		
		src_port: port &log;	# Add the source port
		dst_host: addr &log;	# Add the destination IP
		dst_port: port &log;	# Add the destination port
		msg: string &log;	# Add the message info
	    };		
			
	}


# Execute this when zeek starts up
event zeek_init()
    {
	print "[*] Zeek has started ... ";
	print "[*] Initializing the log stream ... ";
	Log::create_stream(LOG, [$columns=Info, $path="PSEmpire"]);
	print "-----------------------------------------------------";		
	print "[*] Hunting for POWERSHELL EMPIRE Activity ... ";
	print "-----------------------------------------------------";
    }


# Check the HTTP Request
event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string)
    {
	# print fmt("[*] HTTP Request structure: METHOD:%s | ORIGINAL_URI:%s | UNESCAPED_URI:%s", method, original_URI, unescaped_URI);
					
	if (c$id$orig_h == 10.0.0.110 && c$id$resp_p == 443/tcp && empire_file_names in original_URI)
            {
		PSEmpire::hit_count += 1;
		print fmt("[*] SUSPICIOUS POWERSHELL EMPIRE ACTIVITY %s:%s -> %s:%s", c$id$orig_h, c$id$orig_p, c$id$resp_h, c$id$resp_p);
		add compromised_psempire_hosts[c$id$orig_h];						
							
		# Write information to our log file
		    Log::write(LOG, Info(
		    $ts=network_time(),
		    $src_host = c$id$orig_h,
		    $src_port = c$id$orig_p,
		    $dst_host = c$id$resp_h,
		    $dst_port = c$id$resp_p,
		    $msg = "PowerShell Empire Activity Found!"
		));			

		# Raise our notice
		NOTICE([ 
		    $note=suspicious_psempire_compromised_host,
		    $msg = "SUSPICIOUS POWERSHELL EMPIRE ACTIVITY",
		    $sub = "A host is suspected to be infected with Powershell Empire CnC",
		    $conn = c,
		    $suppress_for = 60min,
		    $identifier = cat(c$id$orig_h,c$id$orig_p,c$id$resp_h,c$id$resp_p)																	
		    ]);
		}
	}

	
# Get the file Hashes and extract the files
event file_new(f: fa_file)		
    {
	if (f$source == "HTTP")
	{					
    	    for ( cid, cconns in f$conns )
	    {
		# print cconns$http$uri;
		if ( empire_file_names in cconns$http$uri  && cid$orig_h in compromised_psempire_hosts && cid$resp_h != 10.0.0.110 )
		    {
			local f_name = "EMPTY";
			local f_name_array = split_string(cconns$http$uri, /\//);   # Split the string by /
						
			if (|f_name_array| == 3)
			    f_name = f_name_array[2];
			else
			    f_name = f_name_array[1];

			local extracted_filename = fmt("%s-%s-%s", f$source, f$id, f_name );
			print fmt("   \\->  Extracted file: %s", extracted_filename );
					
			# Get the SHA256 Hashes of the files
			Files::add_analyzer(f, Files::ANALYZER_SHA256);
					
			# Extract the file
			Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename=extracted_filename]);
						}
	    }
    }			`
}
	
	
	
# Finally some quick code to execute when Zeek ends
event zeek_done()
    {
	if ( |PSEmpire::hit_count| == 0 )
    	    {
		print "-----------------------------------------------------";
		print "[*] Lucky you! No PowerShell Empire IoCs found!";
		return;
	    }
		
	print "-----------------------------------------------------";
	print fmt("[*] We have %d hits for Powershell related IoCs", PSEmpire::hit_count );
	print fmt("[*] There is/are %d unique IP(s) across the %d hits", |compromised_psempire_hosts|, PSEmpire::hit_count);
	for ( ip in compromised_psempire_hosts )
	    {
		print fmt ("   \\- %s", ip);
	    }
		print "[*] Zeek has ended. :-( ";
	
        }

When the above code is run, get on the screen.

┌──(securitynik㉿securitynik)-[/tmp]
└─$ zeek --readfile /home/securitynik/packets/empire-full-session.pcap --rulefile /home/securitynik/packets/powershell.sig --no-checksums /home/securitynik/packets/psEmpire.zeek 

[*] Zeek has started ... 
[*] Initializing the log stream ... 
-----------------------------------------------------
[*] Hunting for POWERSHELL EMPIRE Activity ... 
-----------------------------------------------------
[*] SUSPICIOUS POWERSHELL EMPIRE ACTIVITY 10.0.0.110:1650/tcp -> 10.0.0.107:443/tcp
   \->  Extracted file: HTTP-FJAtZe4W1F6uRwvmM3-news.php
[*] SUSPICIOUS POWERSHELL EMPIRE ACTIVITY 10.0.0.110:1650/tcp -> 10.0.0.107:443/tcp
   \->  Extracted file: HTTP-FbbFCu4T8l288RA3R7-news.php
   \->  Extracted file: HTTP-FIWqGKoACo24S6dS8-news.php
[*] SUSPICIOUS POWERSHELL EMPIRE ACTIVITY 10.0.0.110:1650/tcp -> 10.0.0.107:443/tcp
   \->  Extracted file: HTTP-F4wiHG1bpwW03v71vh-news.php
   \->  Extracted file: HTTP-FghBlt1qKU0utYSHd7-news.php
...

-----------------------------------------------------
[*] We have 1807 hits for Powershell related IoCs
[*] There is/are 1 unique IP(s) across the 1807 hits
   \- 10.0.0.110
[*] Zeek has ended. :-( 

 

Notice above it says we extracted the files. Let's verify that by using ls on the extract_files folder

┌──(securitynik㉿securitynik)-[/tmp]
└─$ ls extract_files/
HTTP-F04ExA4j0mLQtMJfxd-get.php      HTTP-Fesf2Y3CmRhWycz7Pf-process.php  HTTP-Fp6Yax4DsWlpbttqR6-news.php
HTTP-F04Fi9X4phawyMEXl-news.php      HTTP-FeshuKrFfyOgA6uH5-process.php   HTTP-FPCjffBSpvM3iS48f-process.php
HTTP-F05oktdIUrPchmqg-news.php       HTTP-FEskgT2JF9cCFwnBcf-get.php      HTTP-FpcYVS1xKGD4yv2rCb-get.php
HTTP-F05vS52MRDIDb1BIyi-process.php  HTTP-Festcg1mUFuQygmVe-get.php       HTTP-FPeqrG4Ur8DlkjgYv4-process.php
....

Looks good!

┌──(securitynik㉿securitynik)-[/tmp]
└─$ zeek-cut -d ts fuid tx_hosts rx_hosts conn_uids source filename sha256 < files.log  | more
2021-11-20T13:03:59-0500        FJAtZe4W1F6uRwvmM3      10.0.0.107      10.0.0.110      CjvLUV2ZfpZGgNfiHj      HTTP    -     41ab2b2d10eb9fdcf1d667ec4f45db99ec1761c06a4e2d61a789710fb0c08a04
2021-11-20T13:04:02-0500        FbbFCu4T8l288RA3R7      10.0.0.110      10.0.0.107      CjvLUV2ZfpZGgNfiHj      HTTP    -     bf896ec20bad0ee772db7ea44b6bf45c2b7401687808bf8474591f0e1612b01c
2021-11-20T13:04:02-0500        FIWqGKoACo24S6dS8       10.0.0.107      10.0.0.110      CjvLUV2ZfpZGgNfiHj      HTTP    -     600df9d2f01f3388e2154bfacc557b6add77cddce147b1cdebc30ad188b57edb

Looking at our custom log file PSempire.log.

┌──(securitynik㉿securitynik)-[/tmp]
└─$ zeek-cut -d -m < PSEmpire.log | more                                                                                    
ts      src_host        src_port        dst_host        dst_port        msg
2021-11-20T13:03:59-0500        10.0.0.110      1650    10.0.0.107      443     PowerShell Empire Activity Found!
2021-11-20T13:04:02-0500        10.0.0.110      1650    10.0.0.107      443     PowerShell Empire Activity Found!
2021-11-20T13:04:03-0500        10.0.0.110      1650    10.0.0.107      443     PowerShell Empire Activity Found!
2021-11-20T13:05:06-0500        10.0.0.110      1650    10.0.0.107      443     PowerShell Empire Activity Found!
2021-11-20T13:06:06-0500        10.0.0.110      1650    10.0.0.107      443     PowerShell Empire Activity Found!
2021-11-20T13:07:06-0500        10.0.0.110      1650    10.0.0.107      443     PowerShell Empire Activity Found!
2021-11-20T13:08:07-0500        10.0.0.110      1650    10.0.0.107      443     PowerShell Empire Activity Found!
2021-11-20T13:09:07-0500        10.0.0.110      1650    10.0.0.107      443     PowerShell Empire Activity Found!

Well That's it for this post and this series.

Other posts in this series:

Beginning Powershell Empire - The Attack in 10 steps
Powershell Empire Log Analysis
Powershell Empire Packet Analysis
Powershell Empire Detection with Snort
Powershell Empire - Detection with Zeek

References:

https://zeek.org/2020/06/08/7-dos-and-donts-for-zeek-scripting/

https://old.zeek.org/brocon2018/slides/Aashish_Sharma.pdf

https://docs.zeek.org/en/master/logs/conn.html

https://docs.zeek.org/en/master/logs/files.html

https://docs.zeek.org/en/master/frameworks/signatures.html

https://sansorg.egnyte.com/dl/8VIrX1K87d/?

https://docs.zeek.org/en/master/frameworks/notice.html

http://ce.sc.edu/cyberinfra/docs/workshop/Bro%20Intrusion%20Detection%20System%20(IDS).pdf

http://ce.sc.edu/cyberinfra/workshops/Material/Zeek/Lab%206.pdf

https://www.youtube.com/watch?v=XXGVi2JF-v0

Powershell Empire - Detection with Snort3

Do keep in mind, as I write these rules, this is basically from a learning perspective. Putting these into production, does not mean you will have the same detection. This is primarily because these values can be changed by the threat actor, thus resulting in an evasion of your IDS/IPS. This is being done primarily from my lab's perspective.

First verifying the version of Snort being used.

┌──(root💀securitynik)-[~/snort-files/snort3-3.1.18.0/build]
└─# snort --version                                

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.1.18.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2021 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.5
           Using LuaJIT version 2.1.0-beta3
           Using OpenSSL 1.1.1l  24 Aug 2021
           Using libpcap version 1.10.1 (with TPACKET_V3)
           Using PCRE version 8.44 2020-02-12
           Using ZLIB version 1.2.11
           Using FlatBuffers 2.0.5
           Using Hyperscan version 5.4.0 2021-12-11
           Using LZMA version 5.2.5

Creating my configuration file (snort.lua) and our rule files (local.rules) to use for this post.

┌──(root💀securitynik)-[~/packets]
└─# touch snort.lua && touch local.rules

Testing the configuration and rule file along with some command line options, I will be using.

┌──(root💀securitynik)-[~/packets]
└─# snort --pcap-list empire-full-session.pcap -A cmg --tweaks talos --pcap-show -k none -d -R local.rules -v  -c snort.lua --daq pcap -T
--------------------------------------------------
o")~   Snort++ 3.1.18.0
--------------------------------------------------
Loading snort.lua:
        hosts
        host_cache
        active
        packets
        decode
        so_proxy
        trace
        search_engine
        process
        network
        host_tracker
        output
        daq
        alerts
Finished snort.lua:
Loading rule args:
Loading local.rules:
Finished local.rules:
Finished rule args:
--------------------------------------------------
Network Policy : policy id 0 : snort.lua
--------------------------------------------------
Inspection Policy : policy id 0 : snort.lua
--------------------------------------------------
so_proxy:
--------------------------------------------------
pcap DAQ configured to read-file.
--------------------------------------------------
host_cache
    memcap: 8388608 bytes

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

Ok rather than continuing to learn more about Snort, let's jump right into our configuration file and the rules. See the reference for one of my previous blogs on building Snort3. I will add comments to the snort.lua and local.rules to ensure we understand what my rules are doing. Additionally, I will be taking advantage of both the service rules as well as the traditional snort2 rules structure.

Somethings to keep in mind, when writing rules, focus on the vulnerability not the exploit. Focus on what you have control over, not what the attackers do. Focus on what is leaving your network more than what is entering your network.

Let's go!

Here is the custom snort.lua configuration file I am using.

-- take advantage of Snort3 defaults
include '/usr/local/etc/snort/snort_defaults.lua' 

-- take advantage of snort default classifications
classifications = default_classifications

-- Tell Snort3 what is our protected network so it can monitor it.
HOME_NET = [[10.0.0.110/32]]

-- This represents every network other than our protected network 
EXTERNAL_NET = '!$HOME_NET'


local_variables = 
  {
    nets = 
        {
	    HOME_NET = HOME_NET,
	    EXTERNAL_NET = EXTERNAL_NET,
	}
 }
	
	
ips = 
	{
	    variables = local_variables
	}		
	
	
-- Be able to profile the activities, get statistics
profiler = { }

-- Enable the Stream Inspector
stream = { }

-- Reasemmebe TCP
stream_ip = { 
		policy = "windows";
	}

-- Reasemmebe TCP
stream_tcp = {
	policy = "windows";
	require_3whs = 300;
	track_only = false;
 }
 
 
-- setup a binder
wizard = default_wizard
binder = 
	{
	    { when = { proto = 'tcp', ports = [[80 443]] },	use = { type = 'http_inspect' } },
	    { when = { service = 'http' },	use = { type = 'http_inspect' } },		
	    {	use = { type = 'wizard' } }, 
	}
	

-- Define the HTTP inspector
http_inspect = { }
		
event_filter =
{
-- alerts once per 60 seconds then ignore any additional events during the 60 seconds.
    { gid = 1, sid = 4000001, type = 'both', track = 'by_src', count = 1, seconds = 60},
    { gid = 1, sid = 4000002, type = 'both', track = 'by_src', count = 1, seconds = 60},
    { gid = 1, sid = 4000003, type = 'both', track = 'by_src', count = 1, seconds = 60},
    { gid = 1, sid = 4000004, type = 'both', track = 'by_src', count = 1, seconds = 60},
   
}

Below represents the contents of my local.rules file after the first rule is developed.

alert tcp $HOME_NET any -> $EXTERNAL_NET 443
    (
	rem: "This rule is looking for Powershell Empire /news.php, hence the 'msg' option";
	msg: "POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /news.php detected";
	
        rem: "Looking for HTTP method GET. Using the Hex values instead of the string in the first 3 bytes of the payload";
	http_method; 
	content: "|47 45 54|", offset 0, depth 3;
			
	rem: "find the string /news.php in the path. ";
	http_uri: path;
	content: "/news.php", distance 0, within 9, nocase;			
						
	rem: "Looking for HTTP Version 1.1";
	http_version: request;
	content: "1.1";
			
	rem: "Look in the HTTP header for Connection: Keep-Alive";
	http_header: field Connection;
	content: "Keep-Alive", nocase;
			
	rem: "Also look for a cookie that ends with '=', suggesting base64 encoded content";
	http_header: field Cookie;
	regex: "/.*=$/i";
			
	classtype: malware-cnc; 
	reference: url, http://www.securitynik.com;
	sid:4000001;
	rev: 10;
    )

When this rule is run against the pcap.

┌──(root💀securitynik)-[~/packets]
└─#  snort --pcap-list empire-full-session.pcap -A cmg --talos --pcap-show -k none -d -R local.rules -c snort.lua -q | more
Reading network traffic from "empire-full-session.pcap" with snaplen = 1518
11/20-13:03:59.632367 [**] [1:4000001:10] "POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /news.php detected" [**] [Classification: Known malware command and control traffic] [Priority: 1]
 {TCP} 10.0.0.110:1650 -> 10.0.0.107:443

http_inspect.http_method[3]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
47 45 54                                          GET
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_version[8]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
48 54 54 50 2F 31 2E 31                           HTTP/1.1 
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_uri[9]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
2F 6E 65 77 73 2E 70 68  70                       /news.ph p
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_header[93]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
55 73 65 72 2D 41 67 65  6E 74 3A 20 73 65 63 75  User-Age nt: secu
72 69 74 79 6E 69 6B 2D  6C 61 75 6E 63 68 65 72  ritynik- launcher
2D 62 61 74 2D 55 73 65  72 2D 41 67 65 6E 74 0D  -bat-Use r-Agent.
0A 48 6F 73 74 3A 20 31  30 2E 30 2E 30 2E 31 30  .Host: 1 0.0.0.10
37 3A 34 34 33 0D 0A 43  6F 6E 6E 65 63 74 69 6F  7:443..C onnectio
6E 3A 20 4B 65 65 70 2D  41 6C 69 76 65           n: Keep- Alive
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_cookie[61]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
53 65 63 75 72 69 74 79  4E 69 6B 2D 48 54 54 50  Security Nik-HTTP
2D 4C 69 73 74 65 6E 65  72 2D 43 6F 6F 6B 69 65  -Listene r-Cookie
3D 5A 4F 6B 4D 77 38 59  6A 6B 57 32 34 4C 30 41  =ZOkMw8Y jkW24L0A
78 61 63 49 4C 65 38 65  72 4C 38 73 3D           xacILe8e rL8s=
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

Good stuff, looking at the summary.

rule profile (all, sorted by total_time)
#       gid   sid rev    checks matches alerts time (us) avg/check avg/match avg/non-match timeouts suspends
=       ===   === ===    ====== ======= ====== ========= ========= ========= ============= ======== ========
1         14000001  10        12       3      3       556        46       145            13        0        0

We made progress there. Moving to the second rule within the local.rules file, looking for the POST. I will copy most of the content above while making this into a service rule. Additionally, I will look for data at 420 bytes within the body of the HTTP message.

alert http
    (
	rem: "This rule is looking for Powershell Empire /news.php, hence the 'msg' option";
	msg: "POWERSHELL EMPIRE COMPROMISED HOST: POST request made for /news.php detected";
	
	rem: "Looking for HTTP method POST. Using the Hex values instead of the string in the first 3 bytes of the payload";
	http_method; 
	content: "|50 4F 53 54|", offset 0, depth 4;
			
        rem: "find the string /news.php in the path. ";
	http_uri: path;
	content: "/news.php", distance 0, within 9, nocase;			
						
	rem: "Looking for HTTP Version 1.1";
	http_version: request;
	content: "1.1";
			
	rem: "Looking for content greater than 400 bytes in the body of the message";
	http_client_body; 
	isdataat: 420, relative;
			
	classtype: malware-cnc; 
	reference: url, http://www.securitynik.com;
	sid:4000002;
	rev: 10;
    )

When executed, here is what I see.

┌──(root💀securitynik)-[~/packets]
└─# snort --pcap-list empire-full-session.pcap -A cmg --talos --pcap-show -k none -d -R local.rules -c snort.lua -q | more                                                                                                                                               
Reading network traffic from "empire-full-session.pcap" with snaplen = 1518
11/20-13:04:02.701119 [**] [1:4000002:10] "POWERSHELL EMPIRE COMPROMISED HOST: POST request made for /news.php detected" [**] [Classification: Known malware command and control traffic] [Priority: 1
] {TCP} 10.0.0.110:1650 -> 10.0.0.107:443

http_inspect.http_method[4]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
50 4F 53 54                                       POST
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_version[8]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
48 54 54 50 2F 31 2E 31                           HTTP/1.1 
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_uri[9]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
2F 6E 65 77 73 2E 70 68  70                       /news.ph p
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_header[90]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
55 73 65 72 2D 41 67 65  6E 74 3A 20 73 65 63 75  User-Age nt: secu
72 69 74 79 6E 69 6B 2D  6C 61 75 6E 63 68 65 72  ritynik- launcher
2D 62 61 74 2D 55 73 65  72 2D 41 67 65 6E 74 0D  -bat-Use r-Agent.
0A 48 6F 73 74 3A 20 31  30 2E 30 2E 30 2E 31 30  .Host: 1 0.0.0.10
37 3A 34 34 33 0D 0A 43  6F 6E 74 65 6E 74 2D 4C  7:443..C ontent-L
65 6E 67 74 68 3A 20 34  36 32                    ength: 4 62
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_client_body[462]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
8B 8D 84 5C 4A D7 63 63  B5 F8 11 9C 17 CE 19 A2  ...\J.cc ........
4C 6F F2 79 7F CE BD 41  A3 F3 D5 DC AD BA AF 00  Lo.y...A ........
C1 CC 4E 71 AC C9 7D 56  D0 E7 CF 67 28 B8 62 0D  ..Nq..}V ...g(.b.
C2 3C 58 E7 38 68 84 38  7A C9 B7 0A 11 A8 1A FB  .<X.8h.8 z.......
09 54 56 8E 4C 5F C8 6B  40 87 D2 94 4D C0 8E 76  .TV.L_.k @...M..v
86 4C B0 7D E0 AD 56 70  0E 69 D4 4F 34 07 62 EE  .L.}..Vp .i.O4.b.
D2 0B F4 30 BF 56 8F EA  1A 66 2E 77 9D BB 49 1F  ...0.V.. .f.w..I.
C0 1E AF 58 04 06 91 BD  34 4C 01 37 6E EC C1 2B  ...X.... 4L.7n..+
CF 57 D3 9B 19 99 16 96  65 6C 09 8E 85 CD 5A B6  .W...... el....Z.
0B BE E7 36 38 9B DB 4B  7F B4 00 7C B9 D8 B8 38  ...68..K ...|...8
1E DA 91 C6 33 8C B7 29  7B A3 F9 79 33 A2 DE BB  ....3..) {..y3...
D5 AB 22 3E F3 9D 8E FA  47 CE E2 E0 BF 70 90 89  ..">.... G....p..
E4 1D B8 62 A2 2C F6 DB  C1 90 3A 3C 78 59 4B 54  ...b.,.. ..:<xYKT
47 9B EC 15 9C CA C8 D8  C1 98 A8 37 7C 24 38 59  G....... ...7|$8Y
E7 27 71 AC BC 87 A1 1F  E4 00 96 F6 4C 90 3D 25  .'q..... ....L.=%
78 85 75 11 80 00 A1 AC  03 3C 4D 9D 09 75 8A 46  x.u..... .<M..u.F
B8 54 85 86 2F D0 99 C8  F9 7A 5D 50 6F 61 D7 A7  .T../... .z]Poa..
06 FF F6 70 9F AB 57 2C  A1 BD CA B4 4F 10 B7 D1  ...p..W, ....O...
E5 E6 F4 F1 63 C9 6D 6C  F5 41 8F 31 3F 3B 90 3E  ....c.ml .A.1?;.>
31 EE CA 64 2C 43 50 44  03 A3 51 2D 06 FD 74 49  1..d,CPD ..Q-..tI
A4 68 12 10 4D FF 2E EB  36 3B 1A C7 D2 D9 B1 09  .h..M... 6;......
60 07 30 BB 05 BC 11 B2  3A CB E1 7A 0E F9 72 F6  `.0..... :..z..r.
68 58 E4 B9 64 EB B4 D7  90 0D BD D9 72 A6 D1 A0  hX..d... ....r...
89 99 2D 15 8A A8 04 CB  7D 50 90 3B 4B AC 6F 41  ..-..... }P.;K.oA
--More--

Going back to none service rules. Looking for /admin/get.php.

Here is the rule.

alert tcp $HOME_NET any -> $EXTERNAL_NET 443
    (
	rem: "This rule is looking for Powershell Empire /admin/get.php, hence the 'msg' option";
	msg: "POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /admin/get.php detected";
			
	rem: "Looking for HTTP method GET. Using the Hex values instead of the string in the first 3 bytes of the payload";
	http_method; 
	content: "|47 45 54|", offset 0, depth 3;
			
	rem: "find the string /news.php in the path. ";
	http_uri: path;
	content: "/admin/get.php", distance 0, within 14, nocase;			
						
	rem: "Looking for HTTP Version 1.1";
	http_version: request;
	content: "1.1";
			
	rem: "Also look for a cookie that ends with '=', suggesting base64 encoded content";
	http_header: field Cookie;
	regex: "/.*=$/i";
			
	classtype: malware-cnc; 
	reference: url, http://www.securitynik.com;
	sid:4000003;
	rev: 10;
    )

Here is the result from that rule.

┌──(root💀securitynik)-[~/packets]
└─# snort --pcap-list empire-full-session.pcap -A cmg --talos --pcap-show -k none -d -R local.rules -c snort.lua -q | more                                                                                                                                               
Reading network traffic from "empire-full-session.pcap" with snaplen = 1518
11/20-13:05:06.697538 [**] [1:4000003:10] "POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /admin/get.php detected" [**] [Classification: Known malware command and control traffic] [Priority
: 1] {TCP} 10.0.0.110:1650 -> 10.0.0.107:443

http_inspect.http_method[3]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
47 45 54                                          GET
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_version[8]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
48 54 54 50 2F 31 2E 31                           HTTP/1.1 
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_uri[14]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
2F 61 64 6D 69 6E 2F 67  65 74 2E 70 68 70        /admin/g et.php
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_header[102]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
55 73 65 72 2D 41 67 65  6E 74 3A 20 4D 6F 7A 69  User-Age nt: Mozi
6C 6C 61 2F 35 2E 30 20  28 57 69 6E 64 6F 77 73  lla/5.0  (Windows
20 4E 54 20 36 2E 31 3B  20 57 4F 57 36 34 3B 20   NT 6.1;  WOW64; 
54 72 69 64 65 6E 74 2F  37 2E 30 3B 20 72 76 3A  Trident/ 7.0; rv:
31 31 2E 30 29 20 6C 69  6B 65 20 47 65 63 6B 6F  11.0) li ke Gecko
0D 0A 48 6F 73 74 3A 20  31 30 2E 30 2E 30 2E 31  ..Host:  10.0.0.1
30 37 3A 34 34 33                                 07:443
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_cookie[36]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
73 65 73 73 69 6F 6E 3D  44 72 70 30 53 78 70 6B  session= Drp0Sxpk
54 54 4A 32 62 4B 71 57  30 7A 7A 50 55 56 56 31  TTJ2bKqW 0zzPUVV1
67 32 59 3D                                       g2Y=
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

... and the final rule, looking for /login/process.php.

alert tcp $HOME_NET any -> $EXTERNAL_NET 443
    (
	rem: "This rule is looking for Powershell Empire /login/process.php, hence the 'msg' option";
	msg: "POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /login/process.php detected";
			
	rem: "Looking for HTTP method GET. Using the Hex values instead of the string in the first 3 bytes of the payload";
	http_method; 
	content: "|47 45 54|", offset 0, depth 3;
			
	rem: "find the string /login/process.php in the path. ";
	http_uri: path;
	content: "/login/process.php", distance 0, within 18, nocase;			
						
	rem: "Looking for HTTP Version 1.1";
	http_version: request;
	content: "1.1";
			
	rem: "Also look for a cookie that ends with '=', suggesting base64 encoded content";
	http_header: field Cookie;
	content: "session", nocase;
	regex: "/^session.*=$/i";
					
	classtype: malware-cnc; 
	reference: url, http://www.securitynik.com;
	sid:4000004;
	rev: 10;
    )

Here is what the results look like, when snort is run against the pcap.

┌──(root💀securitynik)-[~/packets]
└─# snort --pcap-list empire-full-session.pcap -A cmg --talos --pcap-show -k none -d -R local.rules -c snort.lua -q | more
Reading network traffic from "empire-full-session.pcap" with snaplen = 1518
11/20-13:06:06.836488 [**] [1:4000004:10] "POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /login/process.php detected" [**] [Classification: Known malware command and control traffic] [Prio
rity: 1] {TCP} 10.0.0.110:1650 -> 10.0.0.107:443

http_inspect.http_method[3]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
47 45 54                                          GET
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_version[8]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
48 54 54 50 2F 31 2E 31                           HTTP/1.1 
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_uri[18]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
2F 6C 6F 67 69 6E 2F 70  72 6F 63 65 73 73 2E 70  /login/p rocess.p
68 70                                             hp
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_header[102]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
55 73 65 72 2D 41 67 65  6E 74 3A 20 4D 6F 7A 69  User-Age nt: Mozi
6C 6C 61 2F 35 2E 30 20  28 57 69 6E 64 6F 77 73  lla/5.0  (Windows
20 4E 54 20 36 2E 31 3B  20 57 4F 57 36 34 3B 20   NT 6.1;  WOW64; 
54 72 69 64 65 6E 74 2F  37 2E 30 3B 20 72 76 3A  Trident/ 7.0; rv:
31 31 2E 30 29 20 6C 69  6B 65 20 47 65 63 6B 6F  11.0) li ke Gecko
0D 0A 48 6F 73 74 3A 20  31 30 2E 30 2E 30 2E 31  ..Host:  10.0.0.1
30 37 3A 34 34 33                                 07:443
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

http_inspect.http_cookie[36]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
73 65 73 73 69 6F 6E 3D  72 2B 57 77 61 4F 42 61  session= r+WwaOBa
55 4C 50 37 6C 34 37 4B  72 64 68 55 30 41 42 4C  ULP7l47K rdhU0ABL
36 49 30 3D                                       6I0=
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

Ok. Then good stuff. With all of those in place we can now conclude, we are good to go for this detection. Taking a few different looks at the outputs.

First up JSON format.

┌──(root💀securitynik)-[~/packets]
└─# snort --pcap-list empire-full-session.pcap -A alert_json --talos --pcap-show -k none -d -R local.rules -c snort.lua -q | more                                                                                                                                        
Reading network traffic from "empire-full-session.pcap" with snaplen = 1518
{ "timestamp" : "11/20-13:03:59.632367", "pkt_num" : 9, "proto" : "TCP", "pkt_gen" : "stream_tcp", "pkt_len" : 164, "dir" : "C2S", "src_ap" : "10.0.0.110:1650", "dst_ap" : "10.0.0.107:443", "rule" : 
"1:4000001:10", "action" : "allow" }
{ "timestamp" : "11/20-13:04:02.701119", "pkt_num" : 18, "proto" : "TCP", "pkt_gen" : "stream_tcp", "pkt_len" : 462, "dir" : "C2S", "src_ap" : "10.0.0.110:1650", "dst_ap" : "10.0.0.107:443", "rule" :
 "1:4000002:10", "action" : "allow" }
{ "timestamp" : "11/20-13:05:06.697538", "pkt_num" : 51, "proto" : "TCP", "pkt_gen" : "stream_tcp", "pkt_len" : 148, "dir" : "C2S", "src_ap" : "10.0.0.110:1650", "dst_ap" : "10.0.0.107:443", "rule" :
 "1:4000003:10", "action" : "allow" }
{ "timestamp" : "11/20-13:06:06.836488", "pkt_num" : 58, "proto" : "TCP", "pkt_gen" : "stream_tcp", "pkt_len" : 148, "dir" : "C2S", "src_ap" : "10.0.0.110:1650", "dst_ap" : "10.0.0.107:443", "rule" :
 "1:4000004:10", "action" : "allow" }
...

Looking at alert fast

┌──(root💀securitynik)-[~/packets]
└─# snort --pcap-list empire-full-session.pcap -A alert_full --talos --pcap-show -k none -d -R local.rules -c snort.lua -q | more
Reading network traffic from "empire-full-session.pcap" with snaplen = 1518
[**] [1:4000001:10] "POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /news.php detected" [**]
11/20-13:03:59.632367 
[**] [1:4000002:10] "POWERSHELL EMPIRE COMPROMISED HOST: POST request made for /news.php detected" [**]
11/20-13:04:02.701119 
[**] [1:4000003:10] "POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /admin/get.php detected" [**]
11/20-13:05:06.697538 
[**] [1:4000004:10] "POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /login/process.php detected" [**]

Looking at the talos alert_talos ...

┌──(root💀securitynik)-[~/packets]
└─# snort --pcap-list empire-full-session.pcap -A alert_talos --talos --pcap-show -k none -d -R local.rules -c snort.lua -q | more                                                                     
Reading network traffic from "empire-full-session.pcap" with snaplen = 1518

##### empire-full-session.pcap #####
        [1:4000001:10] POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /news.php detected (alerts: 3)
        [1:4000002:10] POWERSHELL EMPIRE COMPROMISED HOST: POST request made for /news.php detected (alerts: 3)
        [1:4000003:10] POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /admin/get.php detected (alerts: 452)
        [1:4000004:10] POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /login/process.php detected (alerts: 377)
#####

Looking at the above, I like the alert_talos as it gives me a summary of the alerts, rather than triggering all the alerts to the screen. Good job Talos!

Taking a final pass when snort is run without the -q option and with the -v option we see.

┌──(root💀securitynik)-[~/packets]
└─# snort --pcap-list empire-full-session.pcap -A alert_talos --talos --pcap-show -k none -d -R local.rules -c snort.lua -v

--------------------------------------------------
o")~   Snort++ 3.1.18.0
--------------------------------------------------
Loading snort.lua:
Loading /usr/local/etc/snort/snort_defaults.lua:
Finished /usr/local/etc/snort/snort_defaults.lua:
	Lua Allowlist Keywords for snort.lua:
		default_classifications, default_ftp_server, default_gtp,
		default_hi_port_scan, default_js_norm_built_in_ident, default_low_port_scan,
		default_med_port_scan, default_references, default_smtp, default_variables,
		default_wizard, ftp_command_specs, gtp_v0_info, gtp_v0_msg, gtp_v1_info,
		gtp_v1_msg, gtp_v2_info, gtp_v2_msg, http_methods, icmp_hi_sweep,
		icmp_low_sweep, icmp_med_sweep, ip_hi_decoy, ip_hi_dist, ip_hi_proto,
		ip_hi_sweep, ip_low_decoy, ip_low_dist, ip_low_proto, ip_low_sweep,
		ip_med_decoy, ip_med_dist, ip_med_proto, ip_med_sweep, netflow_versions,
		sip_requests, smtp_default_alt_max_command_lines, tcp_hi_decoy, tcp_hi_dist,
		tcp_hi_ports, tcp_hi_sweep, tcp_low_decoy, tcp_low_dist, tcp_low_ports,
		tcp_low_sweep, tcp_med_decoy, tcp_med_dist, tcp_med_ports, tcp_med_sweep,
		telnet_commands, udp_hi_decoy, udp_hi_dist, udp_hi_ports, udp_hi_sweep,
		udp_low_decoy, udp_low_dist, udp_low_ports, udp_low_sweep, udp_med_decoy,
		udp_med_dist, udp_med_ports, udp_med_sweep
	hosts
	so_proxy
	stream_tcp
	packets
	alerts
	host_tracker
	http_inspect
	binder
	wizard
	stream_ip
	search_engine
	profiler
	ips
	trace
	classifications
	active
	host_cache
	decode
	stream
	process
	output
	network
	daq
Finished snort.lua:
Loading rule args:
Loading local.rules:
Finished local.rules:
Finished rule args:
--------------------------------------------------
rule counts
       total rules loaded: 4
               text rules: 4
            option chains: 4
            chain headers: 2
--------------------------------------------------
port rule counts
             tcp     udp    icmp      ip
     dst       3       0       0       0
   total       3       0       0       0
--------------------------------------------------
ips policies rule stats
              id  loaded  shared enabled    file
               0       4       0       4    snort.lua
--------------------------------------------------
service rule counts          to-srv  to-cli
                     http:        4       4
                    http2:        4       4
                    total:        8       8
--------------------------------------------------
fast pattern service groups  to-srv  to-cli
                      key:        2       2
                   header:        2       2
--------------------------------------------------
search engine
                instances: 8
                 patterns: 16
            pattern chars: 212
               num states: 204
         num match states: 16
             memory scale: KB
             total memory: 14.2461
           pattern memory: 0.824219
        match list memory: 2.09375
        transition memory: 10.3281
--------------------------------------------------
Flow Tracking
--------------------------------------------------
stream:
            ip_frags_only: disabled
                max_flows: 476288
               max_aux_ip: 16
          pruning_timeout: 30
                 ip_cache: { idle_timeout = 180, cap_weight = 0 }
                tcp_cache: { idle_timeout = 3600, cap_weight = 11000 }
                udp_cache: { idle_timeout = 180, cap_weight = 0 }
               icmp_cache: { idle_timeout = 180, cap_weight = 0 }
               user_cache: { idle_timeout = 180, cap_weight = 0 }
               file_cache: { idle_timeout = 180, cap_weight = 32 }
--------------------------------------------------
Network Policy : policy id 0 : snort.lua
--------------------------------------------------
Inspection Policy : policy id 0 : snort.lua
--------------------------------------------------
binder:
                 bindings:
                           { when = { proto = tcp, ports = 80 443 },
                             use = { type = http_inspect } }
                           { when = { service = http },
                             use = { type = http_inspect } }
                           { when = { },
                             use = { type = wizard } }
--------------------------------------------------
http_inspect:
            request_depth: -1 (unlimited)
           response_depth: -1 (unlimited)
                    unzip: enabled
            normalize_utf: enabled
           decompress_pdf: disabled
           decompress_swf: disabled
           decompress_zip: disabled
           decompress_vba: disabled
         script_detection: disabled
     normalize_javascript: disabled
max_javascript_whitespaces: 200
   js_normalization_depth: -1
 js_norm_identifier_depth: 65536
    js_norm_max_tmpl_nest: 32
js_norm_max_bracket_depth: 256
  js_norm_max_scope_depth: 256
                percent_u: disabled
                     utf8: enabled
           utf8_bare_byte: disabled
              iis_unicode: disabled
    iis_unicode_code_page: 1252
        iis_double_decode: enabled
      oversize_dir_length: 300
       backslash_to_slash: enabled
            plus_to_space: enabled
            simplify_path: enabled
              xff_headers: x-forwarded-for true-client-ip
request_body_app_detection: enabled
--------------------------------------------------
so_proxy:
--------------------------------------------------
stream_ip:
                max_frags: 8192
             max_overlaps: 0
          min_frag_length: 0
                  min_ttl: 1
                   policy: windows
          session_timeout: 60
--------------------------------------------------
stream_tcp:
             flush_factor: 0
                  max_pdu: 16384
               max_window: 0
                   no_ack: disabled
            overlap_limit: 0
                   policy: windows
              queue_limit: { max_bytes = 4194304, max_segments = 3072 }
         reassemble_async: enabled
             require_3whs: 300
          session_timeout: 180
           small_segments: { count = 0, maximum_size = 0 }
               track_only: disabled
--------------------------------------------------
wizard:
--------------------------------------------------
pcap DAQ configured to read-file.
--------------------------------------------------
host_cache
    memcap: 8388608 bytes
Commencing packet processing
++ [0] empire-full-session.pcap
Reading network traffic from "empire-full-session.pcap" with snaplen = 1518
Instance 0 daq pool size: 256
Instance 0 daq batch size: 64

##### empire-full-session.pcap #####
	[1:4000001:10] POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /news.php detected (alerts: 3)
	[1:4000002:10] POWERSHELL EMPIRE COMPROMISED HOST: POST request made for /news.php detected (alerts: 3)
	[1:4000003:10] POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /admin/get.php detected (alerts: 452)
	[1:4000004:10] POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /login/process.php detected (alerts: 377)
#####
-- [0] empire-full-session.pcap
--------------------------------------------------
Packet Statistics
--------------------------------------------------
daq
                    pcaps: 1
                 received: 17365
                 analyzed: 17365
                    allow: 17365
                 rx_bytes: 6929587
--------------------------------------------------
codec
                    total: 17365       	(100.000%)
                 discards: 1610        	(  9.272%)
                      eth: 17365       	(100.000%)
                     ipv4: 17365       	(100.000%)
                      tcp: 13785       	( 79.384%)
                      udp: 1970        	( 11.345%)
--------------------------------------------------
Module Statistics
--------------------------------------------------
binder
              raw_packets: 3580
                new_flows: 78
          service_changes: 4
                 no_match: 4
                 inspects: 3658
--------------------------------------------------
detection
                 analyzed: 17365
             key_searches: 1314
          header_searches: 2204
                   alerts: 835
             total_alerts: 835
                   logged: 835
--------------------------------------------------
http_inspect
                    flows: 25
                    scans: 4397
              reassembles: 4399
              inspections: 3956
                 requests: 1286
                responses: 464
             get_requests: 1253
            post_requests: 33
           request_bodies: 33
  max_concurrent_sessions: 6
          pipelined_flows: 10
       pipelined_requests: 491
              total_bytes: 898244
--------------------------------------------------
normalizer
           test_tcp_block: 3
--------------------------------------------------
search_engine
               max_queued: 2
            total_flushed: 1318
            total_inserts: 1318
             total_unique: 1318
     non_qualified_events: 483
         qualified_events: 835
           searched_bytes: 335622
--------------------------------------------------
stream
                    flows: 78
             total_prunes: 23
              idle_prunes: 23
--------------------------------------------------
stream_tcp
                 sessions: 78
                      max: 78
                  created: 78
                 released: 69
                 timeouts: 7
             instantiated: 9
                   setups: 78
         discards_skipped: 3
                   events: 12
             syn_trackers: 69
              segs_queued: 7414
            segs_released: 7414
                segs_used: 3224
          rebuilt_packets: 4029
          rebuilt_buffers: 20
            rebuilt_bytes: 1064009
                     gaps: 47
          client_cleanups: 29
          server_cleanups: 10
                     syns: 69
                 syn_acks: 29
                   resets: 54
                     fins: 13
      inspector_fallbacks: 5
        partial_fallbacks: 22
                 max_segs: 816
                max_bytes: 410007
--------------------------------------------------
wizard
                tcp_scans: 4
                 tcp_hits: 4
--------------------------------------------------
Summary Statistics
--------------------------------------------------
timing
                  runtime: 00:00:00
                  seconds: 0.073711
                 pkts/sec: 17365
                Mbits/sec: 52
--------------------------------------------------
module profile (all, depth 255, sorted by total_time)
#                      module layer    checks   time(us)  avg/check  %/caller  %/total
=                      ====== =====    ======   ========  =========  ========  =======
 1                      other     1     17365      26070          1     36.73    36.73
 2                 stream_tcp     1     13785      16034          1     22.59    22.59
 3                        daq     1     17638       9925          0     13.98    13.98
 4               http_inspect     1     16750       4542          0      6.40     6.40
 5                       mpse     1     53710       4029          0      5.68     5.68
 6                  rule_eval     1     18036       2855          0      4.02     4.02
 7                     decode     1     17365       2236          0      3.15     3.15
 8                     stream     1     15755       1919          0      2.70     2.70
 9                     eventq     1     25798       1613          0      2.27     2.27
 10                       paf     1     10990       1427          0      2.01     2.01
 11                    binder     1      3662        313          0      0.44     0.44
 12                    wizard     1         4          8          2      0.01     0.01
--                      total    --     17365      70977          4        --   100.00
--------------------------------------------------
rule profile (all, sorted by total_time)
#       gid   sid rev    checks matches alerts time (us) avg/check avg/match avg/non-match timeouts suspends
=       ===   === ===    ====== ======= ====== ========= ========= ========= ============= ======== ========
1         14000003  10       472     452    452      4310         9         9             0        0        0
2         14000004  10       398     377    377      4139        10        10             0        0        0
3         14000002  10       436       3      3       375         0        38             0        0        0
4         14000001  10        12       3      3       308        25        86             5        0        0
o")~   Snort exiting

When we look above, we see that in one instance of we have 452 alerts and another of 377. The others with 3 we can live with. However, those 300+ and 400+ alerts  can be a real headache for us as analysts, thus contributing to the so called alert fatigue. Let's reduce this noise ... and the fatigue.

Let's add the following event filter to the snort.lua file.

event_filter =
{
  -- alerts once per 60 seconds then ignore any additional events during the 60 seconds.
    { gid = 1, sid = 4000001, type = 'both', track = 'by_src', count = 1, seconds = 60},
    { gid = 1, sid = 4000002, type = 'both', track = 'by_src', count = 1, seconds = 60},
    { gid = 1, sid = 4000003, type = 'both', track = 'by_src', count = 1, seconds = 60},
    { gid = 1, sid = 4000004, type = 'both', track = 'by_src', count = 1, seconds = 60},
}

When Snort3 is run against the pcap, this time we see

┌──(root💀securitynik)-[~/packets]
└─# snort --pcap-list empire-full-session.pcap -A alert_talos --talos --pcap-show -k none -d -R local.rules -c snort.lua  -q
Reading network traffic from "empire-full-session.pcap" with snaplen = 1518

##### empire-full-session.pcap #####
        [1:4000001:10] POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /news.php detected (alerts: 1)
        [1:4000002:10] POWERSHELL EMPIRE COMPROMISED HOST: POST request made for /news.php detected (alerts: 1)
        [1:4000003:10] POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /admin/get.php detected (alerts: 1)
        [1:4000004:10] POWERSHELL EMPIRE COMPROMISED HOST: GET request made for /login/process.php detected (alerts: 1)
#####
--------------------------------------------------
module profile (all, depth 255, sorted by total_time)
#                      module layer    checks   time(us)  avg/check  %/caller  %/total
=                      ====== =====    ======   ========  =========  ========  =======
 1                      other     1     17365      29039          1     39.42    39.42
 2                 stream_tcp     1     13785      15494          1     21.03    21.03
 3                        daq     1     17638      10463          0     14.20    14.20
 4               http_inspect     1     16750       4428          0      6.01     6.01
 5                       mpse     1     53704       4115          0      5.59     5.59
 6                  rule_eval     1     18033       2923          0      3.97     3.97
 7                     stream     1     15755       2240          0      3.04     3.04
 8                     decode     1     17365       2203          0      2.99     2.99
 9                        paf     1     10989       1419          0      1.93     1.93
 10                    eventq     1     25792        994          0      1.35     1.35
 11                    binder     1      3662        336          0      0.46     0.46
 12                    wizard     1         4          7          1      0.01     0.01
--                      total    --     17365      73666          4        --   100.00
--------------------------------------------------
rule profile (all, sorted by total_time)
#       gid   sid rev    checks matches alerts time (us) avg/check avg/match avg/non-match timeouts suspends
=       ===   === ===    ====== ======= ====== ========= ========= ========= ============= ======== ========
1         14000003  10       472     452      1      4786        10        10             0        0        0
2         14000004  10       398     377      1      3933         9        10             0        0        0
3         14000002  10       436       3      1       366         0        38             0        0        0
4         14000001  10        12       3      1       311        25        82             7        0        0

This is much better. From an Analyst perspective, we would prefer to not not have alert fatigue.

This is the end of this post, see you in the next post, where we use Zeek to detect this activity.

Other posts in this series:

Beginning Powershell Empire - The Attack in 10 steps
Powershell Empire Log Analysis
Powershell Empire Packet Analysis
Powershell Empire Detection with Snort
Powershell Empire - Detection with Zeek

References:

https://www.securitynik.com/2021/02/snort3-on-ubuntu-20-initial-setup.html

https://www.youtube.com/watch?v=W1pb9DFCXLw&list=PLpPXZRVU-dX33VNUeqWrMmBNf5FeKVmi-

https://github.com/threatstream/snort/blob/master/etc/classification.config

https://snort.org/faq/readme-filters

https://www.snort.org/downloads