nerdexam
GIAC

GSEC · Question #306

A security analyst has entered the following rule to detect malicious web traffic: alert tcp any -> 192.168.1.0/24 SO (msg: Attempted SQL Injection!"; sld:20000001;) How can this rule be changed to…

The correct answer is B. Add more detail in the rule to make it more specific to the attack pattern. A generic IDS rule lacking specific attack pattern matching generates excessive false positives, and adding precise content matching to the rule reduces them.

Network Security

Question

A security analyst has entered the following rule to detect malicious web traffic:

alert tcp any -> 192.168.1.0/24 SO (msg: Attempted SQL Injection!"; sld:20000001;) How can this rule be changed to reduce false positives?

Options

  • AChange the rule to make it apply bi -directional to source and destination
  • BAdd more detail in the rule to make it more specific to the attack pattern
  • CAdd an additional rule to apply to destination port 443 as well as 80
  • DMake the IP range more general so that it applies to all webservers

How the community answered

(43 responses)
  • A
    7% (3)
  • B
    77% (33)
  • C
    14% (6)
  • D
    2% (1)

Why each option

A generic IDS rule lacking specific attack pattern matching generates excessive false positives, and adding precise content matching to the rule reduces them.

AChange the rule to make it apply bi -directional to source and destination

Making the rule bidirectional expands the volume of traffic inspected, which would likely increase rather than decrease false positives.

BAdd more detail in the rule to make it more specific to the attack patternCorrect

Adding specific content matches - such as SQL keywords, special characters, or known malicious payloads - via the Snort 'content' keyword causes the rule to trigger only on traffic that closely resembles an actual SQL injection attempt. The current rule matches all TCP traffic destined for the subnet with no payload inspection, making it far too broad. Narrowing the match criteria with detailed pattern signatures reduces false positives by filtering out benign traffic.

CAdd an additional rule to apply to destination port 443 as well as 80

Adding port 443 broadens the rule's scope to cover additional traffic, increasing the chance of matching legitimate HTTPS requests.

DMake the IP range more general so that it applies to all webservers

Expanding the destination IP range to all web servers makes the rule less specific and increases the likelihood of triggering on benign traffic.

Concept tested: Tuning IDS/IPS Snort rules to reduce false positives

Source: https://docs.snort.org/rules/options/payload/content

Topics

#Snort rules#IDS tuning#false positives#rule specificity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSEC Practice