Detection Rules Using Snort

Task :

• Writing 3 different detection rules for detecting any executable download (IDS MODE)

---

Snort Installation :

---

Writing rules in Snort :

nano /etc/snort/rules/local.rules

and paste

alert tcp any any -> any 80 (msg:"Executable Download Detected (.exe)"; flow:to_client,established; content:".exe"; nocase; http_uri; sid:1000001; rev:1;)
alert tcp any any -> any 80 (msg:"Executable MIME Download Detected"; flow:to_client,established; content:"application/x-msdownload"; http_header; nocase; sid:1000002; rev:1;)
alert tcp any any -> any 80 (msg:"Executable Binary Payload Detected (MZ header)"; flow:to_client,established; content:"MZ"; offset:0; depth:2; sid:1000003; rev:1;)

---

Testing :

Run Snort in a terminal:

sudo snort -c /etc/snort/snort.conf -r Downloads/1.pcap -A fast

Link of the pcap file Download

Sheet Cheat Link Download