Security Onion deploys Suricata with the Emerging Threats Open ruleset on
installation. This thesis examines whether these default rules are sufficient to
detect an attack on a vulnerable web application. A test network with an
intrusion detection system and a purpose-built vulnerable application was
set up in an isolated virtual environment, and the attack was carried out
twice, once with the default tool settings and once with knowledge of the
loaded rules. The noisy run triggered thirty unique alerts, while the covert
run produced none despite reaching the same outcome. The causes lie in
rules bound to attacker-controlled attributes, threshold evasion, decoding
mismatches and the description of syntax rather than behaviour. In addition
to shortcomings within the ruleset itself, it was determined that default
rules do not provide good enough protection without adaptation to the
specific environment. On this basis, a custom ruleset tailored to the system
was developed, and its effectiveness was evaluated both in terms of attack
detection and the generation of false positives. The final ruleset reliably
detects covert attacks as well as all evasion techniques used.
|
