FTD · SNORT · ADVANCED

FTD-style IPS 3: fix a false positive without opening a hole

The help desk complains: since WEB-IPS moved to Balanced, nobody can download cmd.exe-cheatsheet.pdf. Rule 1000105 drops any request naming cmd.exe, and it also catches a real attack. Let the one download through, and keep the attack dropped.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On LAP1, reproduce the complaint and the attack. Both are dropped by rule 1000105: traffic tcp 203.0.113.10 80 payload "GET /downloads/cmd.exe-cheatsheet.pdf", then traffic tcp 203.0.113.10 80 payload "GET /scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir".
Add a narrow pass rule for exactly that download: pass tcp any any -> any 80 (msg:"Help-desk cheat sheet is not an attack"; content:"GET /downloads/cmd.exe-cheatsheet.pdf"; sid:1000070; rev:1;)
Set rule 1000070 to Pass in WEB-IPS. Leave rule 1000105 on drop.
Deploy. The download arrives, and the attack is still dropped by rule 1000105.

Start this lab