Snort mailing list archives
RE: netbios rules question
From: "Orit Vidas" <orit () securimine com>
Date: Tue, 30 Nov 2004 13:37:57 -0800
Ravi, There is always a conflict between: 1. I want to have rules that monitor almost everything that is interesting, and, 2. I don't want to have rules that generate too many alerts. SFS is a tool that enables you to enjoy both worlds. With SFS you can leave your 'noisy' rules active and have SFS build the 'normal' behavior of these rules into its behavioral model. From that time, alerts that match the normal activity will be given a 'low priority' by SFS and more importantly, if these rules generate alerts that deviate from the normal activity, SFS will identify it and will give these alerts (although coming from the same rule!!!) high priority. In your case, if you apply SFS, you will still be able to see the A.A.A.A and B.B.B.B alerts on the report, but if these alerts are normal to the activity of your system, they will be assigned a low priority which means you can ignore them. However, if an alert deviates from this "normal" behavior of your system, SFS will assign it a higher priority level for your attention. Hence, you will be able to detect any suspicious behavior from within and from the outside. You can download SFS for FREE at <http://www.securimine.com/download.html> www.securimine.com/download.html Orit Vidas <http://www.securimine.com/> www.securimine.com -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Esler, Joel - Contractor Sent: Tuesday, November 30, 2004 11:29 AM To: RKejariwal () fiberlink com; snort-users () lists sourceforge net Subject: RE: [Snort-users] netbios rules question I would most likely say that these are information signatures. They aren't false positive, but if you do alot of drive/network shares and stuff like that, you're going to see that kind of thing. Joel -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of RKejariwal () fiberlink com Sent: Tuesday, November 30, 2004 2:13 PM To: snort-users () lists sourceforge net Subject: [Snort-users] netbios rules question Hi All I had a question regarding netbios rules. Lately I have been receiving a lot of the alerts as shown below where A.A.A.A and B.B.B.B are all internal hosts to my network. In addition B.B.B.B is the IP address of our domain controller. Is this merely false positiive or something i should be concerned about. How do I go abt troubleshooting further to see what exactly is happenig. Any help will be appreciated Thanks Ravi [**] [1:2466:4] NETBIOS SMB-DS IPC$ share unicode access [**] [Classification: Generic Protocol Command Decode] [Priority: 3] 11/30-14:05:00.173386 A.A.A.A:1105 -> B.B.B.B:139 TCP TTL:128 TOS:0x0 ID:22636 IpLen:20 DgmLen:128 DF ***AP*** Seq: 0xD1482D9A Ack: 0x4A54B89D Win: 0xFFFF TcpLen: 20 [**] [1:2404:5] NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] 11/30-14:05:00.163386 A.A.A.A:1105 -> B.B.B.B:445 TCP TTL:128 TOS:0x0 ID:22635 IpLen:20 DgmLen:1440 DF ***AP*** Seq: 0xD1482822 Ack: 0x4A54B769 Win: 0xFAB7 TcpLen: 20 [Xref => http://www.eeye.com/html/research/advisories/ad20040226.html][Xref => http://www.securityfocus.com/bid/9752] The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.799 / Virus Database: 543 - Release Date: 11/19/2004 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.799 / Virus Database: 543 - Release Date: 11/19/2004
Current thread:
- netbios rules question RKejariwal (Nov 30)
- Re: netbios rules question sekure (Nov 30)
- <Possible follow-ups>
- RE: netbios rules question Esler, Joel - Contractor (Nov 30)
- RE: netbios rules question Orit Vidas (Nov 30)
- RE: netbios rules question Orit Vidas (Dec 01)