Project

General

Profile

Actions
Copy link

Bug #1516

closed

ShellCode Rule does not get fired in Suricata but it does in Snort

Added by Guru Medidation over 8 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

Rule: 2101390
Which looks for Shellcode signature "CCCCCCC"
Does not get fired with Suricata but it does with Snort. Even if I think it is a false positive I would have expected the rule to be fired with Suricata.

This is Suricata version 2.1dev (rev 834c366)

Attached is the PCAP that triggers the alert with Snort.

I also suspect teh following rule have the same problem: 2102314 and 2012252 . Also related to ShellCode
I have checked and those rules are not suppressed in my threshold.config or disabled.

Thanks,
Bugs.

Files

Download all files
empty.test-file (10 Bytes) empty.test-file Peter Manev, 07/27/2015 03:49 AM
ShellCode.pcap (1.5 KB) ShellCode.pcap Pcap with Shellcode alert - 1 packet, enough to trigger in snort but doesnt with Suricata. Guru Medidation, 07/27/2015 04:08 AM
Actions
Copy link
 #1

Updated by Peter Manev over 8 years ago

I don't see the pcap :)

Actions
Copy link
 #2

Updated by Guru Medidation over 8 years ago

Ok, I clicked on CHOOSE FILES, selected my pcap. I can see it here and it has a tag of "internal sever".
I write this note... click submit.
Can you see it now?

Actions
Copy link
 #3

Updated by Guru Medidation over 8 years ago

Another attempt at uploading the pcap, this time using a different browser.
If this does not work... is the upload option broken?

Actions
Copy link
 #4

Updated by Peter Manev over 8 years ago

off note - testing the upload file - it was reported to be some sort of a problem with that by the user.

Actions
Copy link
 #5

Updated by Peter Manev over 8 years ago

off note - testing the upload file - please excuse me for the multiple updates.

Actions
Copy link
 #6

Updated by Peter Manev over 8 years ago

off note - testing the upload file - please excuse me for the multiple updates.

Actions
Copy link
 #8

Updated by Guru Medidation over 8 years ago

Thanks to ebf0 on IRC, this is not an issue and can be closed.
Shellcode are not detected on port 80, that's the reason why it doesn't fire on Suricata, it is by designed and not an issue.
My bad!

This issue can be closed.

PS:
  1. grep SHELLCODE_PORTS /etc/suricata/suricata.yaml SHELLCODE_PORTS: "!80"
Actions
Copy link
 #9

Updated by Peter Manev over 8 years ago

  • Status changed from New to Closed
Actions
Copy link

Also available in: Atom PDF