• Home

  • Documents

  • Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata...
39
© 2017 SPLUNK INC. © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant, Emerging Technologies | Splunk November 2017

Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

  • Upload
    others

  • View
    36

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

Malware Analysis:Suricata & Splunk for better rule writing

Anthony Tellez, CISSP, CEH, CNDALead Consultant, Emerging Technologies | SplunkNovember 2017

Page 2: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward-looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.

Forward-Looking Statements

THIS SLIDE IS REQUIRED FOR ALL 3 PARTY PRESENTATIONS.

Page 3: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

Biography Who Am I?

• Time In Service @ Splunk > 3 Years• Previous: U.S. Gov Contractor, Geospatial Analyst• Specializations

• Cryptography• Information Security – Red Team

• Data Scientist• Security Analytics• Data Visualization

• Responsible for the relationship between emerging technologies and field organization• Acquisitions• Incubation• Product Development• https://github.com/anthonygtellez/

Page 4: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

Overview & Objectives

Why am I giving this talk?

Page 5: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Objectives of the talk▶ Building a “test range”▶ Finding “Bad Data”▶ Exploratory Data Analysis▶ Iteration & Experimentation▶ Operationalizing Insights to understand rules

AgendaThis is where the subtitle goes

Page 6: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

ObjectiveWhy did I commit to two talks?

Page 7: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Problem: Training security analysts on spotting bad activity in network traffic is difficult, in many cases they only see the out of the box alerts of many IDS/IPS tools.

▶ This leads to analysts becoming overly reliant on the out of the box threat intelligence solutions and signatures found in various products. These analysts sometimes will learn through experience how to adjust signatures for their own environment to reduce noise or alert on certain activities.

▶ The purpose of this talk is to provide a training framework to bootstrap an analyst so they can hunt like a pro and contribute back to the organization.

Objectives of the TalkAKA Why did I commit to do two talks?

Page 8: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

Building A Test RangeDo you really need your own lab?

Page 9: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Advice• A test range doesn’t have to mirror your own Enterprise network, committing to a lab

environment of this size becomes cost prohibitive and eventually requires staff to manage.• Using pcaps you can easily sample in a virtual machine, micro instance (AWS) or raspberry pi

(yes, Suricata runs on the pi!)• MHN Honeynets/Honeypots can be troublesome to manage long term.

• AWS micro (Free Tier) instances will last about 30ish days before all of the disk space is consumed.

• ~30 days worth of data is usually more than enough to hunt. • Summary: Choose the method that is going to be easiest for you to learn.

Building A Test RangeDo you really need a lab?

Page 10: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ For purposes of this talk, we will look at the VM/Raspberry Pi option:• Virtual Machine

• Ubuntu 16.04• Suricata 4.0.1• Splunk 7.0.0• Oinkmaster 2.0

Building A Test RangeDo you really need a lab?

Page 11: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

Finding Bad (Labeled) Data

Everything is infected.

Page 12: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

• One of the most difficult tasks as a newbie analyst is figuring out what behaviors are bad.• There are obvious signs such as: attempted access to services on privileged ports.

• How many analysts know all of the privileged ports & services that normally run on those ports?

• What is the likelihood that anyone wants to see alerts every time SSH, RDP or TELNET connections are seen in the DMZ?

• Another key problem with this approach is the data is unlabeled for the most part without some form of threat intelligence or incident response process.• Labled malware samples are freely available from various sources:• http://www.malware-traffic-analysis.net• ^ This resource provides them in PCAP format

Finding Bad (Labeled) DataIf everything is under attack how do you write signatures?

Page 13: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

Exploratory Data Analysis

What am I even looking at?

Page 14: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Create a directory called malware_zips

▶ wget the list of urls:• $ while read line; do wget "${line}";

done < ../wget_list.txt

Exploratory Data AnalysisGetting the data to the VM

Page 15: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Create a list of all the zip files• ls > ../all_zips

▶ Decrypt the zip files with the password• while read line; do unzip -P

<password> "${line}"; done < ../all_zips

Exploratory Data AnalysisGetting the data to the VM

Page 16: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Create a list of all the zip files• ls > ../all_zips

▶ Decrypt the zip files with the password• while read line; do unzip -P

<password> "${line}"; done < ../all_zips

Exploratory Data AnalysisGetting the data to the VM

Get the password from: http://www.malware-traffic-analysis.net/about.html

Page 17: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Create a list of all the pcap files• find ./ -name "*.pcap" >> ../all_pcaps

▶ Start Suricata in socket mode• /usr/bin/suricata -c

/etc/suricata/suricata.yaml \--pidfile /var/run/suricata.pid -v --unix-socket=/var/run/666.socket -D

Exploratory Data AnalysisGetting the data to the VM

Page 18: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Run a Test:• /usr/bin/suricatasc /var/run/666.socket

-c "pcap-file /root/malware_zips/2017-03-08-Hancitor-malspam-traffic.pcap /tmp”

• {"message": "Successfully added file to list", "return": "OK"}

• Note: Fully qualified path is required otherwise you will see the following error:

• {"message": "File does not exist", "return": "NOK"}

Exploratory Data AnalysisGetting the data to the VM

Page 19: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Prepare to read malware Samples:• mkdir /tmp/suricata_malware

▶ Modify PCAP list to have fully qualified path:• Using Vi substitution

%s/.\//\/home\/atellez\/malware_zips\//g

Exploratory Data AnalysisGetting the data to the VM

Page 20: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Send the list of PCAPs to the socket for reading and output eve.json to a different directory:• while read line; do /usr/bin/suricatasc

/var/run/666.socket -c "pcap-file ${line} /tmp/suricata_malware" ; done < ../all_pcaps

Exploratory Data AnalysisGetting the data to the VM

Page 21: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Check the output once complete• /root/suricata_malware/eve.json• tail /root/suricata_malware/eve.json

Exploratory Data AnalysisGetting the data to the VM

Page 22: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Index/Parse the Data with Splunk• sudo su - splunk -c "cd

/opt/splunk/etc/apps && git clone https://github.com/anthonygtellez/TA-Suricata.git"

• /opt/splunk/bin/splunk add index suricata

• ./splunk add oneshot/tmp/suricata_malware/eve.json –sourcetype suricata –index suricata

Exploratory Data AnalysisGetting the data to the VM

Page 23: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Search & Validate• Index=suricata

sourcetype=suricata

Optional* source=/tmp/suriata_malware/eve.json

Exploratory Data AnalysisGetting the data to the VM

Page 24: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Index /etc/suricata/rules• Index=surirules• ***Experimental***

Exploratory Data AnalysisGetting the data to the VM

https://github.com/anthonygtellez/TA-Suricata_rules.git

Page 25: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

Iteration & Experimentation

Nothing is perfect the first time

Page 26: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ With both the rules and data in Splunk we can compare signatures and the alerts which fired for the various pcap files.

▶ This gives us a framework and single pane of glass as an analyst to see what an IDS does and the rules associated with an alert.

Iteration & ExperimentationNothing is perfect the first time

Page 27: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Finding which rules fired (the easy way)• index=suricata sourcetype="suricata" event_type=alert

| table alert.signature_id| dedup alert.signature_id| sort alert.signature_id

▶ Use as a subsearch against the rules index▶ index=surirules [| search index=suricata

sourcetype="suricata" event_type=alert | table alert.signature_id| dedup alert.signature_id| rename alert.signature_id AS rule_sid]

Iteration & ExperimentationNothing is perfect the first time

Page 28: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Finding which rules have events in Splunk (the reverse!)• index=surirules

| table rule_sid| dedup rule_sid| sort rule_sid

▶ Use as a subsearch against the event index▶ index=suricata sourcetype="suricata"

event_type=alert [|search index=surirules| table rule_sid| dedup rule_sid| rename rule_sid AS alert.signature_id]

Iteration & ExperimentationNothing is perfect the first time

Page 29: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ The cluster command or patterns tab can be used to cluster rules and events together to identify trends.• Clustering produces poor patterns when

there are less than 5000 events• These events can be used to identify

general trends about the signatures firing in your environment or bias in the sample data.

• In this case most of the sample malware is firing on Tor node ip addresses.

Iteration & ExperimentationClustering rules

Page 30: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

Operationalizing Insights

How to justify your time to management

Page 31: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ This information gives us insights into the types of rules likely to fire and provides the analysts information about how to write a simple signature.

▶ All of them are ip based signatures• alert ip

[95.91.100.46,95.91.1.170,96.126.105.219,96.126.117.198,96.126.125.187,96.126.96.9,96.126.96.90,96.18.182.94,96.235.130.252,96.240.10.123] any -> $HOME_NET any ...

Operationalizing InsightsHow to justify your time to management.

Page 32: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ This can be further operationalized by looking at patterns in the data itself.

▶ Remember all of the data in the Suricata index is bad!

▶ An analyst can look at:flow, dns, fileinfo, http, tls, etcand create new signatures based on common patterns they find in the data.

▶ ML & Analytics opportunity?

Operationalizing InsightsHow to justify your time to management.

Page 33: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ DNS Nameservers• OpenNIC

▶ TLS & SSL Versions• TLS < 1.2, SSLv3

▶ SSL Issuer • CN=www.qpktke29.com/O=qpktke29./C=US

▶ Cipher Suite?

Operationalizing InsightsHow to justify your time to management.

Page 34: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Http Content • How are these users getting infected?• Are there any rare or common content types?

Operationalizing InsightsHow to justify your time to management.

Page 35: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Http Content • Are certain user agents or browsers more

common to infection?• Is this a specific OS type of infection?

Operationalizing InsightsHow to justify your time to management.

Page 36: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Common trends can be analyzed to write better rules▶ Is connection to TOR the only give away?▶ Are there things such as query_length, TLS version, etc that are more consistent

signatures?• alert tls any any -> any any (msg:"SURICATA TLS invalid SSLv2 header"; flow:established; app-

layer-event:tls.invalid_sslv2_header; flowint:tls.anomaly.count,+,1; classtype:protocol-command-decode; sid:2230000; rev:1;)

▶ What about certain certificates?• alert tls any any -> any any

(tls.fingerprint:!"26:ca:ea:1d:99:11:d0:14:98:ad:17:47:4a:8d:fa:94:c5:1f:53:1c"; sid:1;)

Rule Writing

Page 37: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Problems• Data becomes unlabeled• Lots of different PCAP files get stored into

single Splunk index• Events overlap difficult to write a specific

signature based on lots of samples of one type of malware when multiple malware are added to the same index

▶ Suggestion (will make pull request) • Metadata - Pcap-filename as output path• Run each pcap or groups of the same malware

in separate eve.logs with labeled paths• Alt: use interface to save PCAP filename

• -This is how Splunk Stream does it

Operationalizing InsightsHow to justify your time to management.

Page 38: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.© 2017 SPLUNK INC.

Thank You

Page 39: Malware Analysis Suricata Splunk 4 Rulewriting · © 2017 SPLUNK INC. Malware Analysis: Suricata & Splunk for better rule writing Anthony Tellez, CISSP, CEH, CNDA Lead Consultant,

© 2017 SPLUNK INC.

▶ Malware Traffic Analysis, - for the cool labeled data and helping me on my security journey

▶ Jackson Sie, Vladimir Shcherbakov, David Cuvto + Stream SMEs▶ Suricata team for teaching me how to create sockets!▶ David Shpritz for the User Agent TA https://splunkbase.splunk.com/app/1843▶ Other cool projects for training analysts

• https://github.com/threatstream/mhn

▶ Snort SSL TLS inspection• https://www.sans.org/reading-room/whitepapers/vpns/snort-ssl-tls-inspection-37735

CreditWho I stole stuff from / learned from


Uh oh. - sans.org · 3 we8106desk Fortigate NG Firewall 192.168.250.1 suricata-ids Internet OD-FM-CONF-NA (AWS) splunk-02 wenessus1 WE9041SRV 192.168.2.50 LAN WESIFTSVR1 WESTOQSVR1

Uh oh. - sans.org · 3 we8106desk Fortigate NG Firewall 192.168.250.1 suricata-ids Internet OD-FM-CONF-NA (AWS) splunk-02 wenessus1 WE9041SRV 192.168.2.50 LAN WESIFTSVR1 WESTOQSVR1

Documents
SIEMONSTER VERSION 3 HIGH LEVEL DESIGN · dionaea, the network IDS/IPS suricata, elasticsearch-logstash-kibana, ewsposter and docker. Suricata Suricata is a free and open source,

SIEMONSTER VERSION 3 HIGH LEVEL DESIGN · dionaea, the network IDS/IPS suricata, elasticsearch-logstash-kibana, ewsposter and docker. Suricata Suricata is a free and open source,

Documents
Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Documents
Suricata suricatta

Suricata suricatta

Documents
Splunk conf2014 - Splunk for Data Science

Splunk conf2014 - Splunk for Data Science

Technology
Software IDS Dan IPS Suricata

Software IDS Dan IPS Suricata

Documents
SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE

SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE

Documents
Virtualizing Suricata* IPS Using Hyperscan Pattern Matching · Suricata* Overview Suricata is an open source-based intrusion detection system (IDS), intrusion prevention system (IPS),

Virtualizing Suricata* IPS Using Hyperscan Pattern Matching · Suricata* Overview Suricata is an open source-based intrusion detection system (IDS), intrusion prevention system (IPS),

Documents
Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Documents
Suricata User Guide

Suricata User Guide

Documents
Advances in Suricata - DeepSec · 2012-02-02 · Advances in Suricata ... Suricata can efficiently load them all and match with low overhead. Advanced HTTP inspection and logging

Advances in Suricata - DeepSec · 2012-02-02 · Advances in Suricata ... Suricata can efficiently load them all and match with low overhead. Advanced HTTP inspection and logging

Documents
Eric Leblond IDS-suricata

Eric Leblond IDS-suricata

Documents
Suricata ips mode

Suricata ips mode

Documents
Splunk Security: Detecting Unknown Malware and Ransomwarenetworkdatahub.com/assets/wp/Splunk-Security-Detecting-Unknown-… · falling victim to malware attacks. This paper will take

Splunk Security: Detecting Unknown Malware and Ransomwarenetworkdatahub.com/assets/wp/Splunk-Security-Detecting-Unknown-… · falling victim to malware attacks. This paper will take

Documents
Suricata IDPS and Linux kernel - NetDev conf · 1 Suricata Introduction Streaming Performance 2 Suricata and Linux kernel AF_PACKET NFQUEUE 3 Suricata and offloading Interest of

Suricata IDPS and Linux kernel - NetDev conf · 1 Suricata Introduction Streaming Performance 2 Suricata and Linux kernel AF_PACKET NFQUEUE 3 Suricata and offloading Interest of

Documents
SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Documents
Latest advance in Suricata IDPS - RMLLschedule2012.rmll.info/IMG/pdf/2012_rmll_suricata.pdf · Suricata vs Snort Suricata Drived by a foundation Multi-threaded Native IPS Advanced

Latest advance in Suricata IDPS - RMLLschedule2012.rmll.info/IMG/pdf/2012_rmll_suricata.pdf · Suricata vs Snort Suricata Drived by a foundation Multi-threaded Native IPS Advanced

Documents
Suricata 2.0, Netfilter and the PRC - RMLL · Suricata 2.0, Netfilter and the PRC Éric Leblond Stamus Networks July 8, 2014 Éric Leblond (Stamus Networks) Suricata 2.0, Netfilter

Suricata 2.0, Netfilter and the PRC - RMLL · Suricata 2.0, Netfilter and the PRC Éric Leblond Stamus Networks July 8, 2014 Éric Leblond (Stamus Networks) Suricata 2.0, Netfilter

Documents
Paper Suricata (1)

Paper Suricata (1)

Documents
Suricata: détection d'intrusion réseau - eole.ac-dijon.freole.ac-dijon.fr/presentations/2016 juin/ 2016-06-15-Suricata–IDS... · Points clés de Suricata Suricata Analyse pro-tocolaire

Suricata: détection d'intrusion réseau - eole.ac-dijon.freole.ac-dijon.fr/presentations/2016 juin/ 2016-06-15-Suricata–IDS... · Points clés de Suricata Suricata Analyse pro-tocolaire

Documents
Bro Befriends Suricata - The Bro Network Security … · Bro Befriends Suricata 23/09/16 20:23 Page 1 of 47 BRO BEFRIENDS SURICATA SURICATA AND …

Bro Befriends Suricata - The Bro Network Security … · Bro Befriends Suricata 23/09/16 20:23 Page 1 of 47 BRO BEFRIENDS SURICATA SURICATA AND …

Documents
Suricata 2.0, Netfilter and the PRC - stamus-networks.com · Suricata 2.0, Netfilter and the PRC Éric Leblond Stamus Networks April 26, 2014 Éric Leblond (Stamus Networks) Suricata

Suricata 2.0, Netfilter and the PRC - stamus-networks.com · Suricata 2.0, Netfilter and the PRC Éric Leblond Stamus Networks April 26, 2014 Éric Leblond (Stamus Networks) Suricata

Documents
FIAT7IFTA @ dubai 2013 SURICATA PAPER

FIAT7IFTA @ dubai 2013 SURICATA PAPER

Entertainment & Humor
State of Suricata - inliniac.net · 10 years of Suricata Name “Suricata” came from the suggestion of using the Meerkat as mascot Latin Genus name: “Suricata” Late July 2009

State of Suricata - inliniac.net · 10 years of Suricata Name “Suricata” came from the suggestion of using the Meerkat as mascot Latin Genus name: “Suricata” Late July 2009

Documents
Suricata: caso di studio di Intrusion Detection and ...computerscience.unicam.it/marcantoni/tesi/Suricata... · ché Suricata sia un software multipiattaforma, alcune funzionalità

Suricata: caso di studio di Intrusion Detection and ...computerscience.unicam.it/marcantoni/tesi/Suricata... · ché Suricata sia un software multipiattaforma, alcune funzionalità

Documents
SPLUNK SECURITY USE CASE DETECTING UNKNOWN … · WHITE PAPER SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE AND RANSOMWARE Detecting unknown malware and ransomware…

SPLUNK SECURITY USE CASE DETECTING UNKNOWN … · WHITE PAPER SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE AND RANSOMWARE Detecting unknown malware and ransomware…

Documents
Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

Documents
Suricata and the Shark: suriwire · Suricata and the Shark: suriwire É. Leblond Stamus Networks July. 03, 2018 É. Leblond (Stamus Networks) Suricata and the Shark: suriwire July

Suricata and the Shark: suriwire · Suricata and the Shark: suriwire É. Leblond Stamus Networks July. 03, 2018 É. Leblond (Stamus Networks) Suricata and the Shark: suriwire July

Documents
Splunk Insights for Ransomware - ecs-dk.arrow.com · Splunk Insights for Ransomware is the ... What risk does ransomware or a large scale malware attack ... • Vulnerability and

Splunk Insights for Ransomware - ecs-dk.arrow.com · Splunk Insights for Ransomware is the ... What risk does ransomware or a large scale malware attack ... • Vulnerability and

Documents
Performance Testing Suricata The Effect of Configuration Variables On Offline Suricata

Performance Testing Suricata The Effect of Configuration Variables On Offline Suricata

Documents