Re: Nessus activity detection quest

[Jeremy Hoel <jthoel () gmail com>]

Wouldn't it also depend on the plugins that you are using with Nessus?

On Thu, Jul 23, 2015 at 1:10 PM, Y M <snort () outlook com> wrote:

> There are about 3-5 signatures that almost always trigger when a Nessus
>  scan is initiated with different scan types, at least in all cases that I
> was able to verify. While these signatures do not identify that a Nessus
> scan in particular is ongoing, but the fact of seeing them trigger together
> is indicative of a Nessus scan in all cases I encountered. I will have to
> dig up some old data to get the sid(s) of these signatures.
>
> YM
>
> ------------------------------
> From: jesler () cisco com
> To: soy_siberiano () yahoo com
> Date: Thu, 23 Jul 2015 11:06:35 +0000
> CC: Snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Nessus activity detection quest
>
>
> So, you are doing a portscan, and the only alerts you see are portscans?
>
>  Nessus doesn't actually send exploits at a machine, it scans for the
> presence of characteristics that would make the machine vulnerable to an
> exploit.  There's nothing for Snort to detect, except the portscan part
> really.
>
> --
> *Joel Esler*
> Manager, Threat Intelligence and Open Source
> Talos Group
> Sent from my iPhone
>
> On Jul 23, 2015, at 1:17 AM, Oleg Ruso <soy_siberiano () yahoo com> wrote:
>
>   Hi List!
>
> snort-2.9.7.0
>
> I`m looking for some Snort rules for a Nessus activity detection.
> Got an another alerts, but my Snort does not reveal a Nessus activity.
> The preprocessor sfportscan detection only i see.
>
> Regards, Alex
>
>
> ------------------------------------------------------------------------------
>
>  _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________ Snort-users mailing list
> Snort-users () lists sourceforge net Go to this URL to change user options
> or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users
> <https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>
> list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!