mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
106 lines
3.3 KiB
ReStructuredText
106 lines
3.3 KiB
ReStructuredText
LLMNR Keywords
|
|
==============
|
|
|
|
Suricata supports sticky buffers for matching on specific fields
|
|
in LLMNR (Link-Local Multicast Name Resolution) messages.
|
|
|
|
Note that sticky buffers are expected to be followed by one or more
|
|
:doc:`payload-keywords`.
|
|
|
|
llmnr.queries.rrname
|
|
--------------------
|
|
|
|
``llmnr.queries.rrname`` is a sticky buffer that is used to look at the
|
|
name field in LLMNR query resource records.
|
|
|
|
``llmnr.queries.rrname`` will look at both requests and responses, so
|
|
``flow`` is recommended to confine to a specific direction.
|
|
|
|
The buffer being matched on contains the complete re-assembled
|
|
resource name, for example "workstation.local".
|
|
|
|
``llmnr.queries.rrname`` supports :doc:`multi-buffer-matching`.
|
|
|
|
.. container:: example-rule
|
|
|
|
alert llmnr any any -> any 5355 (msg:"LLMNR query for workstation"; \
|
|
flow:to_server; llmnr.queries.rrname; content:"workstation"; nocase; sid:1;)
|
|
|
|
llmnr.answers.rrname
|
|
--------------------
|
|
|
|
``llmnr.answers.rrname`` is a sticky buffer that is used to look at the
|
|
name field in LLMNR answer resource records.
|
|
|
|
``llmnr.answers.rrname`` will look at both requests and responses, so
|
|
``flow`` is recommended to confine to a specific direction.
|
|
|
|
The buffer being matched on contains the complete re-assembled
|
|
resource name, for example "server.local".
|
|
|
|
``llmnr.answers.rrname`` supports :doc:`multi-buffer-matching`.
|
|
|
|
.. container:: example-rule
|
|
|
|
alert llmnr any 5355 -> any any (msg:"LLMNR answer for server.local"; \
|
|
flow:to_client; llmnr.answers.rrname; content:"server.local"; sid:2;)
|
|
|
|
llmnr.authorities.rrname
|
|
------------------------
|
|
|
|
``llmnr.authorities.rrname`` is a sticky buffer that is used to look at the
|
|
rrname field in LLMNR authority resource records.
|
|
|
|
``llmnr.authorities.rrname`` will look at both requests and responses,
|
|
so ``flow`` is recommended to confine to a specific direction.
|
|
|
|
The buffer being matched on contains the complete re-assembled
|
|
resource name, for example "local".
|
|
|
|
``llmnr.authorities.rrname`` supports :doc:`multi-buffer-matching`.
|
|
|
|
.. container:: example-rule
|
|
|
|
alert llmnr any 5355 -> any any (msg:"LLMNR authority record check"; \
|
|
llmnr.authorities.rrname; content:"local"; sid:3;)
|
|
|
|
llmnr.additionals.rrname
|
|
------------------------
|
|
|
|
``llmnr.additionals.rrname`` is a sticky buffer that is used to look at
|
|
the rrname field in LLMNR additional resource records.
|
|
|
|
``llmnr.additionals.rrname`` will look at both requests and responses,
|
|
so ``flow`` is recommended to confine to a specific direction.
|
|
|
|
The buffer being matched on contains the complete re-assembled
|
|
resource name, for example "ns.local".
|
|
|
|
``llmnr.additionals.rrname`` supports :doc:`multi-buffer-matching`.
|
|
|
|
.. container:: example-rule
|
|
|
|
alert llmnr any any -> any 5355 (msg:"LLMNR additional record check"; \
|
|
llmnr.additionals.rrname; content:"ns.local"; sid:4;)
|
|
|
|
llmnr.response.rrname
|
|
---------------------
|
|
|
|
``llmnr.response.rrname`` is a sticky buffer that is used to inspect
|
|
all the rrname fields in a response, in the queries, answers,
|
|
additionals and authorities. Additionally it will also inspect rdata
|
|
fields that have the same format as an rrname (hostname).
|
|
|
|
``rdata`` types that will be inspected are:
|
|
|
|
* CNAME
|
|
* PTR
|
|
* MX
|
|
* NS
|
|
* SOA
|
|
|
|
.. container:: example-rule
|
|
|
|
alert llmnr any 5355 -> any any (msg:"LLMNR response contains suspicious domain"; \
|
|
flow:to_client; llmnr.response.rrname; content:"malicious"; nocase; sid:5;)
|