- attack-responses.rules
-
My personal favorite set of rules. They detect when a host on your
local network is sending a known response to a successful attack.
While it might not be as useful as catching the attacker before he
has succeeded, the alerts these rules generate are very often not
false positives. There are some that are a little noisy—in
particular the rule that alerts on a "403 -
Forbidden" HTTP response.
- backdoor.rules
-
Detects traffic generated by backdoor network connections,
including those created by attackers using many rootkits and stealthy
remote control applications (like subseven,
netbus, and deepthroat).
- bad-traffic.rules
-
Watches for illegal packet header
settings like a TCP and UDP port 0 traffic, or a SYN packet to a
multicast address.
- chat.rules
-
Disabled by default. It watches for people using
instant messengers and other Internet
chat protocols. If this activity is
against your organization's security policy, enable
this rule set.
- ddos.rules
-
Alerts on traffic generated by many well-known distributed
denial-of-service
mechanisms, including
Trin00
and
shaft.
The Stacheldraht rules can be noisy, since
they are just looking for specific words in the payload that may be
common in your environment.
- deleted.rules
-
Actually not referenced by default in the
snort.conf file; really just a museum of old
Snort rules.
- dns.rules
-
Alerts on attacks against DNS servers (including detection of
zone transfers).
- dos.rules
-
Detects traffic generated by known
denial-of-service
attacks. It will detect some specifically named attacks like
winnuke and jolt, but will
also detect classes of attacks like IGMP and
teardrop attacks.
- experimental.rules
-
This is where new types of rules are included. This file is included
by default, so check it for new rules. Very often this is just an
empty file.
- exploit.rules
-
Includes the signatures of many known
exploits. Seeing an alert generated by these rules should not cause
immediate panic. They indicate that an exploit
attempt has occurred. When you see one of these
alerts, verify that the target system is, in fact, vulnerable to the
attack. Hopefully, you have the system patched or updated to address
the vulnerability the exploit attempted to attack.
- finger.rules
-
Alerts on many known types of attack against the
finger service that runs by default on many
Unix-based operating systems. If you have the finger service disabled
on your systems (I do, where possible), you can disable this rule
set.
- ftp.rules
-
Generates alerts when known attacks are detected against the
FTP service.
- icmp-info.rules
-
This noisy little set of rules is disabled by default. It may be
useful when troubleshooting a specific ICMP problem on your network, but in
general it just generates noise and should remain disabled.
- icmp.rules
-
Alerts when it sees the signs of pings
specific to particular attack tools. These alerts can be very useful.
The "destination unreachable" rules
can be very noisy, though, and if you choose to keep this set of
rules enabled, consider turning off the loud
"unreachable" rules.
- imap.rules
-
Generates alerts when known attacks against the
IMAP email service are detected.
- info.rules
-
Disabled by default. They generate alerts on a variety of traffic
that is normally found on a healthy, secure network. They may be
useful in troubleshooting some issues, though.
- local.rules
-
Stores
rules
that you create.
- misc.rules
-
Contains rules that don't fit easily into other
categories. In my experience, they generate a large number of false
positives on traffic that should not be a concern on a network that
utilizes reasonable defense-in-depth strategies. I usually disable
this entire rule set.
- multimedia.rules
-
Disabled by default. If it is against your
organization's security policies to run
multimedia applications across the
network, enable this rule set.
- mysql.rules
-
Detects known attacks against
mySQL database servers.
- netbios.rules
-
Detects several of the recent Windows-attacking worms that
are causing headaches for network and system administrators around
the world. Some of the alerts can generate false positives (namely
the administrative share access rules and the rules that alert on SMB
and NetBIOS access). If the Snort sensor is watching Internet traffic
only and NetBIOS traffic is not allowed in or out of your
environment, consider disabling this rule set.
- nntp.rules
-
Contains signatures that indicate attack against
network time
protocol servers.
- oracle.rules
-
Detects known attacks against
Oracle database servers.
- other-ids.rules
-
Watches for traffic generated by other
IDSs. If you are the only
person authorized to run an IDS in your environment, this can be a
relevant concern. You can likely disable this rule set.
- p2p.rules
-
Disabled by default. They detect activity generated
by peer to peer software. Peer to
peer clients can represent a dangerous vector for the introduction of
viruses, worms, and other malicious code into your environment. If
your organization has policies against the use of such software,
enable this rule set.
- policy.rules
-
Disabled by default. It contains rules that watch for activity that
may against some organization's security policies
(for example, an alert will be generated by PC Anywhere and VNC
traffic, or an anonymous FTP login). Consider reviewing the rules in
this file and leaving those that match your policies enabled, while
disabling the rest (after enabling the rule set itself, of course).
- pop2.rules
-
Generates alerts when known POP2 email service attacks
are detected.
- pop3.rules
-
Generates alerts when known POP3 email service attacks
are detected.
- porn.rules
-
Disabled by default, these rules will alert when a variety of
off-color packet contents go by on the wire. If it is against your
organization's security policy to visit such content
on the Internet, consider enabling the rule set (but be prepared for
some... interesting alerts).
- rpc.rules
-
Generates alerts on attacks against the remote procedure call (RPC) services employed
by nearly every operating system. If the sensor is watching Internet
traffic and RPC activity is not allowed in or out of the environment,
consider disabling this set of rules. If the sensor is watching
internal traffic, some tuning may be necessary, depending on the
types of systems running on the network.
- rservices.rules
-
Alerts when
rservices
(rlogin, rsh, and
rexec) are detected on the network. These are
powerful commands to control remote systems. If you use these in your
environment, you may want to disable this rule set.
- scan.rules
-
Detects a variety of different
network and service scans, from deceptive
portscans to SSH and UpnP service scans. It detects the signatures of
some specific scanning tools, too.
- shellcode.rules
-
Disabled by default. It will detect shellcode in the
packet payload that is attempting to compromise a variety of systems.
This shellcode may be the payload of a successful attack that does
not have its own signature. Since these rules are designed the check
the payloads of all traffic, they can cause a significant performance
hit when enabled.
- smtp.rules
-
Generates alerts when known SMTP email service attacks
are detected.
- snmp.rules
-
Detects a variety of SNMP traffic. SNMP is used to manage
devices on a network and many vulnerabilities have been detected in
the protocol. If you are running a sensor that is only watching
Internet traffic and SNMP traffic is not allowed in or out, you can
disable this rule set.
- sql.rules
-
Detects known attacks against Microsoft SQL Server database servers.
- telnet.rules
-
Alerts on dangerous traffic transmitted in telnet sessions.
- tftp.rules
-
Alerts on attacks against the TFTP service.
- virus.rules
-
Disabled by default. This rule set is not being actively maintained
and the rules really just watch for a variety of file extensions
transmitted in email traffic. The real virus signatures are located
within the specific service's rule sets now.
- web-attacks.rules
-
Disabled by default. It generates alerts when known generic attacks
against web servers are detected. Consider enabling
it, since it does not generate a large number of false positives.
- web-cgi.rules
-
Generates alerts when known attacks against CGI services are
detected.
- web-client.rules
-
Generates alerts when potentially dangerous web client traffic is
detected. Most of these alerts are based on Microsoft
Outlook Web Access traffic and
generate a large number of false positives. Consider disabling this
rule set.
- web-coldfusion.rules
-
Generates alerts when known attacks against
Coldfusion web application
services are detected.
- web-frontpage.rules
-
Generates alerts when known attacks against
Frontpage web authoring services are
detected.
- web-iis.rules
-
Detects known attacks against Microsoft Internet Information Server (IIS) web
servers.
- web-misc.rules
-
Generic web attack detection rules.
- web-php.rules
-
Detects attacks against web servers running
PHP applications (primarily runs on
Apache, but it is possible to run on IIS).
- x11.rules
-
Detects attacks against remote X-Windows
sessions.
