search

julioliraup / Antiphishing

Suricata rulesets for protect against phishing attack.
GNU General Public License v3.0
2 stars 1 forks source link

DNS rule format feedback #3

Open zoomequipd opened 2 weeks ago

zoomequipd commented 2 weeks ago

a couple of things regarding the dns rules

alert dns $HOME_NET any -> any any (msg:"AT Related Malicious Domain (www[.]enduluxe[.]com/) in DNS Lookup"; dns.query; content:"www.enduluxe.com"; isdataat:!1,relative; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; classtype:social-engineering; sid:6000016; rev:1; metadata: signature_severity Major;)

1) you might consider truncating www. off the domain and using dotprefix transformations and endswith modifier.

In many cases, domains controlled by phishing actors will setup several subdomains. For example in the referenced signature, this domain was observed with subdomain in the past (it was a LONG time ago, but proves the point nontheless) https://urlscan.io/search/#page.domain%3Aenduluxe.com

2) if the intention is to match "exact" domains, this is fine, but consider using the bsize modifier to actually make it exact.

3) defang domains by using a space instead of the [.] as per the [Suricata Community Style Guide (https://github.com/sidallocation/suricata-style-guide/blob/main/style-guide.md)

  Defang domain names by using a space before the label separator to avoid accidental information leaks
     Example: Observed Malicious Win32/Badhombre DNS Query (tromf .mx)

4) remove the trailing / from the domain in the MSG www[.]enduluxe[.]com/ --> www[.]enduluxe[.]com

Proposed format of exact match

alert dns $HOME_NET any -> any any (msg:"AT Related Malicious Domain (www .enduluxe .com) in DNS Lookup"; dns.query; bsize:16; content:"www.enduluxe.com";  reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; classtype:social-engineering; sid:6000016; rev:1; metadata: signature_severity Major;)

Proposed format of non-exact match

alert dns $HOME_NET any -> any any (msg:"AT Related Malicious Domain (www .enduluxe .com) in DNS Lookup"; dns.query; dotprefix; content:".enduluxe.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; classtype:social-engineering; sid:6000016; rev:1; metadata: signature_severity Major;)
zoomequipd commented 2 weeks ago

you might consider truncating www. off the domain and using dotprefix transformations and endswith modifier. In many cases, domains controlled by phishing actors will setup several subdomains. For example in the referenced signature, this domain was observed with subdomain in the past (it was a LONG time ago, but proves the point nonetheless) https://urlscan.io/search/#page.domain%3Aenduluxe.com

It looks like you do this with the TLS rules on thetls.sni buffer, so probably worth doing here as well. Same concept.

julioliraup commented 2 weeks ago

Gg, i'll apply its changes. About subdomains, I can't think of a solution that automatically removes the subdomain without affecting trusted sites like github.io, for example. I'll follow Suricata style guide!

zoomequipd commented 2 weeks ago

About subdomains, I can't think of a solution that automatically removes the subdomain without affecting trusted sites like github.io, for example.

you might check out the Public Suffix List, which is design to solve this problem. There are many python libraries that make use of it.

julioliraup commented 2 weeks ago

Do you think these changes address the points raised in your feedback? @zoomequipd

zoomequipd commented 2 weeks ago

Have you considered using urllib.parse to do your domain/path/etc extraction instead of manually parsing it?

julioliraup commented 2 weeks ago

Yes, I think it would be good for the future, if we were to add more complexity to the code it would be even better

julioliraup commented 2 weeks ago

you might check out the Public Suffix List, which is design to solve this problem. There are many python libraries that make use of it.

Thanks, I understand, but I need a whitelist to avoid false positives.

julioliraup commented 2 weeks ago

I can make it searching: if more than 3 subdomain of tld then make a rule