FTD · SNORT

FTD-style: stop malware finding its server through DNS

Malware on PC1 must find its command server before it can do harm, and it does that with an ordinary DNS lookup. Rule DNS-OUT lets PC1 ask the DNS server outside (198.51.100.1) on UDP 53, so the lookup leaves like any other. This time the IPS goes on an outbound rule.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On PC1, look up a normal name and the malware’s name. Both are answered: traffic udp 198.51.100.1 53 payload "DNS query A www.example.com", then traffic udp 198.51.100.1 53 payload "DNS query A c2-update.badexample.net".
On the Intrusion screen, add a Snort rule for the malware domain: drop udp any any -> any 53 (msg:"DNS lookup of a known malware domain"; content:"c2-update"; nocase; sid:1000020; rev:1;)
Create IPS policy DNS-IPS (base connectivity, mode prevention), set rule 1000020 to drop in it, and attach it to rule DNS-OUT, the outbound rule.
Deploy. On PC1, the malware’s lookup is dropped and names rule 1000020, and the normal lookup is still answered.

Start this lab

Before you start

Ask which way the traffic starts: the lookup starts inside and goes out, so it matches DNS-OUT, not the inbound HTTP-WEB. The answer coming back is part of the same flow. A custom rule starts disabled in every policy, so turn it on with ips-rule.

Concept

An access rule reads the address, Snort reads the contents

An access rule allows or blocks by address and port, so it passes an attack on an allowed port. An Allow rule with an IPS policy sends its traffic through Snort, which reads the contents and compares them with its rules. Prevention mode drops what a drop rule matches, and detection mode only reports it, so you can see what a policy would break before you trust it.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.