Introduction

To improve security and protect DNS appliances and users from DNS-based attacks, including protecting users from malicious websites, TCPWave includes Suricata, a powerful and high-performance rule-based network threat detection and prevention system. Suricata can monitor network traffic, including DNS traffic, in real time to detect and prevent malicious activity. Administrators can create and import rules for Suricata, including from third parties, to drop specific packets and produce alerts on specific packets and series of packets. Also, rules can be used permanently or temporarily, such as while waiting for a security patch to be created, tested, and deployed after a new vulnerability has been identified.

A default ruleset for Suricata is included with TCPWave that consists of over 2,500 DNS-related rules that produce alerts. It is based on Proofpoint Emerging Threats Open Ruleset and can be modified. These default rules primarily detect protocol anomalies, higher than expected frequencies of specific packets and DNS queries, and queries for domains related to malware, ransomware, command and control, phishing, and tunnels.

These threat detection and prevention capabilities help protect DNS Appliances and users by using DNS-specific rules and considering traffic patterns that go beyond the functionality of general-purpose firewalls. To enable administrators to understand and take advantage of these capabilities, information on the following topics is presented in the sections below:

Overview of Suricata Rules

As described in the Introduction, Suricata uses rules to detect and drop malicious packets. More specifically, when a rule matches the contents of a packet or series of packets, Suricata can drop the potentially harmful packet(s) and generate an alert or just generate an alert. Suricata runs on TCPWave DNS Appliances, and Suricata alerts are displayed in the Fault Management section of TCPWave.

TCPWave customers can use the default Suricata ruleset included with TCPWave, rulesets from third parties, their own custom rulesets, or a combination of these. The default TCPWave ruleset consists of over 2,500 DNS-related rules that produce alerts and is based on Proofpoint Emerging Threats' Open Ruleset. These default rules primarily detect protocol anomalies, higher than expected frequencies of specific packets and DNS queries, and queries for domains related to malware, ransomware, command and control, phishing, and tunnels. After these rules are imported into a template in TCPWave, they can be viewed in the TCPWave GUI. Also, these rules can be viewed in the suricata-dns.rules file in the /opt/tcpwave/var/lib/suricata/rules directory on TCPWave IPAM Appliances.

For those interested in better understanding Suricata rules, overview information on two example rules from the TCPWave default ruleset and one custom rule is presented here. Rules consist of three parts, which are color-coded in the following example rule from the default ruleset:

alert dns any any -> any any (msg:"ET MALWARE Suspected Snugy DNS Backdoor Initial Beacon"; content:"|00 00 01 00 01|"; endswith; dns.query; bsize:>19; content:"646"; offset:2; depth:5; fast_pattern; pcre:"/^[qbedm]{1}[a-zA-Z]{1,3}646[a-zA-Z0-9]{1,3}+\./";reference:url,unit42.paloaltonetworks.com/xhunt-campaign-backdoors/;reference:md5,162959ebfd839229969d5e830c7d1dbc;classtype:command-and-control;sid:2031193;rev:2;metadata:attack_target Client_Endpoint,created_at 2020_11_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2021_04_09;)

A summary of the rule parts is as follows:

Furthermore, in the Options part of a rule, various keywords can be used, and these typically vary in different rules. The rule above is presented again, but this time with the keywords highlighted:

alert dns any any -> any any (msg:"ET MALWARE Suspected Snugy DNS Backdoor Initial Beacon"; content:"|00 00 01 00 01|"; endswith; dns.query; bsize:>19; content:"646"; offset:2; depth:5; fast_pattern; pcre:"/^[qbedm]{1}[a-zA-Z]{1,3}646[a-zA-Z0-9]{1,3}+\./";reference:url,unit42.paloaltonetworks.com/xhunt-campaign-backdoors/; reference:md5,162959ebfd839229969d5e830c7d1dbc;classtype:command-and-control;sid:2031193;rev:2; metadata:attack_target Client_Endpoint,created_at 2020_11_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2021_04_09;)

Note that as per the pcre keyword (which stands for Perl-compatible regular expression), part of the matching criteria in this example rule is a regular expression.

The following example DDoS rule, which is also from the default ruleset, considers the frequency that a matching packet occurs and will generate an alert only if there have been 10 or more DNS queries to ns1.hostasa.org within 2 minutes:

alert dns any any -> any any (msg:"ET MALWARE Likely Linux/Xorddos.F DDoS Attack Participation (ns1.hostasa.org)"; threshold:type both, track by_src, count 10, seconds 120; dns.query; content:"ns1.hostasa.org"; depth:15; fast_pattern;nocase; endswith; reference:md5,3c49b5160b981f06bd5242662f8d0a54; classtype:trojan-activity; sid:2021327; rev:5; metadata:created_at 2015_06_23, former_category CURRENT_EVENTS, updated_at 2020_09_17;)

An example custom rule, which is not in the default rules, is shown below, and it drops DNS queries for www.facebook.com:

drop dns any any -> any any (msg:"TCPWave DNS TITAN This is a drop test for www.facebook.com"; dns_query; content:"www.facebook.com"; depth:20; fast_pattern; endswith; nocase; classtype:pup-activity; sid:200; rev:2;)

With this rule in use, the output of a query for www.facebook.com from a dig command is as shown in the screenshot below:

Note that since an Action of Drop was used in the rule, dig timed out waiting for a query response. If an Action of Reject were used, then in addition to the query being dropped, a rejection message would have been sent to the dig client.

Rules can vary greatly in their purpose and complexity. Complete information on Suricata rules, including on rule format and DNS keywords in rules, is in the Suricata User Guide in the section on rules, which is available at https://suricata.readthedocs.io/en/latest/rules/index.html.

Configuring Suricata in TCPWave

Detailed information on these two configuration steps is provided in the subsections below.

Create a NSM Template