topic Re: How to escape special characters (i.e. colon) in miner rule in General Topics

How to escape special characters (i.e. colon) in miner rule

LucaMarchiori — Fri, 03 Nov 2017 15:48:31 GMT

Hi,

I have a rule for Panos syslog miner to block FTP brute force login attempt that is not working. I suspect this is because the threat_name has a colon in it, and is not being parsed properly. This is what my rule looks like:

conditions:
- type == "THREAT"
- log_subtype == "vulnerability"
- severity == "high"
- src_zone == "WAN"
- dest_zone == "DMZ"
- 'threat_name == "FTP'':'' login Brute Force attempt(40001)"'
fields:
- log_subtype
- threat_name
indicators:
- src_ip

I first needed to add extra quatation marks around the colon to pass the yaml validation, and after that more quotation marks are automatically added upon saving the rule. I've tried removing the threat_name line altogether, and replacing it with

signature_id == 40001

but that does not seem to be working either.

tldr: Anyone know what is the proper way to escape characters like ":" or "-" in MineMeld?

Re: How to escape special characters (i.e. colon) in miner rule

lmori — Thu, 09 Nov 2017 09:06:32 GMT

Hi @LucaMarchiori,

that's one of the confusing things with YAML, there too many ways to represent and quote strings.

Could you try this:

conditions:
- type == "THREAT"
- log_subtype == "vulnerability"
- severity == "high"
- src_zone == "WAN"
- dest_zone == "DMZ"
- 'threat_name == "FTP: login Brute Force attempt(40001)"'
fields:
- log_subtype
- threat_name
indicators:
- src_ip

or this (YAML is a superset of JSON, so you can also use JSON):

{
  "conditions": [
    "type == \"THREAT\"",
    "log_subtype == \"vulnerability\"",
    "severity == \"high\"",
    "src_zone == \"WAN\"",
    "dest_zone == \"DMZ\"",
    "threat_name == \"FTP: login Brute Force attempt(40001)\""
  ],
  "fields": [
    "log_subtype",
    "threat_name"
  ],
  "indicators": [
    "src_ip"
  ]
}

Re: How to escape special characters (i.e. colon) in miner rule

LucaMarchiori — Thu, 09 Nov 2017 19:54:31 GMT

Hi @lmori

Thank you for your response. I'll test the syntax you have suggested as soon as I can. Do you happen to know if there is a lenght limit in place as well?

For instance, a somewhat longer threat name like:

threat_name == "LinkSys E-series Routers Remote Code Execution Vulnerability(36358)"

after validation invariably becomes:

  - >-
    threat_name == "LinkSys E-series Routers Remote Code Execution
    Vulnerability(36358)"

which does not seem to work. Several spaces get automatically added between Execution and Vulnerability. If I shorten the threat name a few characters, it passes validation just fine. Initially I thought the "-" character was causing the problem, but may be the treat name is too long?

EDIT: your suggested syntax is working for FTP: login Brute Force attempt(40001).

Re: How to escape special characters (i.e. colon) in miner rule

lmori — Tue, 14 Nov 2017 05:29:55 GMT

Hi @LucaMarchiori,

I will check and be right back.

Luigi

Re: How to escape special characters (i.e. colon) in miner rule

LucaMarchiori — Mon, 04 Dec 2017 19:48:29 GMT

Hi @lmori

I was wondering if you had a chance to check on threat_name lenght issue. Any threats with longer names, for instance:

threat_name == "OpenSSL TLS Malformed Heartbeat Request Found - Heartbleed(36397)"

after yaml verification becomes:

- >-
threat_name == "OpenSSL TLS Malformed Heartbeat Request Found -
Heartbleed(36397)"

which does not seem to be working.

Re: How to escape special characters (i.e. colon) in miner rule

lmori — Tue, 26 Dec 2017 07:45:49 GMT

Hi @LucaMarchiori,

sorry for the late repy, you could try this instead as condition:

conditions:
  - type == 'THREAT'
  - contains(threat_name, 'Heartbleed') == true

Re: How to escape special characters (i.e. colon) in miner rule

LucaMarchiori — Tue, 02 Jan 2018 16:33:54 GMT

Hi @lmori

Just as a side note, validation turned this:

- contains(threat_name, 'Heartbleed') == true

into this:

- 'contains(threat_name, ''Heartbleed'') == true'

I'm giving it a try.

Re: How to escape special characters (i.e. colon) in miner rule

LucaMarchiori — Fri, 05 Jan 2018 15:44:35 GMT

Hi @lmori

your solution worked for Heartbleed. For threats that have no such distinctive name, would you think it's possible to use directly the threat ID?

For instance:

- contains(threat_name, '(36397)') == true