TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Rob,
Here is a script I did yesterday. I didnt put too much thought into it, so if the code
isnt particularly well written - too bad... but it seems to have found some
interesting things when focused on internal segments, so i thought id pass it on.
I found that several of the more anomalous 'events' often consisted of an attacker
doing only one or two events repeatedly. For example, repeated Socks port probes. So
i figured if isolated every attacker within a time period (2 months here, simple to
change) that had the majority of the events (>=85%) as only one or two events types,
then it might find some interesting things. seems like it does - not stealthy things,
but interesting ones.
- Any system with a total event count of under 30 is automatically discarded.
- an event consists of the 'best name' in combination of the issue name paired with
the paramvalue
- Ive taken out some of my environment-specific search restraints.. junk elimination
largely needs to be added
it creates a few temp tables while processing..
-tom
--------- SNIP ---------------
CREATE TABLE #temp (ident int identity(1,1), ct int, IntruderName varchar(255),
issuename varchar(255), paramvalue varchar(255) )
INSERT INTO #temp (ct, IntruderName, issuename, paramvalue)
SELECT count(*) as 'ct', x.IntruderName, x.issuename, x.pv
FROM (SELECT intr.bestName as 'IntruderName', ie.issuename, ISNULL(ep.paramvalue,'')
as 'pv'
FROM iceevents ie
JOIN host intr ON ie.intruderID = intr.hostID
JOIN host targ ON ie.targetID = targ.hostID
LEFT JOIN eventParameters ep ON ie.eventID = ep.eventID
WHERE ie.issueID > 50
AND ie.startTime >= dateadd(month, -2,getdate())
AND intr.networkaddress not like '0.0.0.0'
-- Add JUNK Elimination statements here
AND ie.issuename not like 'Norton Antivirus port probe'
-- The following segment parses out the secondary parameters from an event..
-- otherwise a 'probe' event would be first with a port parameter
-- and the same 'probe' event would be second with a reason parameter
-- this part needs a tad work for better accuracy
AND (ep.paramName IS null
OR ep.paramName = 'port'
OR ep.paramName = 'share'
OR ep.paramname = 'community'
OR ep.paramname = 'URL'
OR ep.paramName = 'Line'
OR ep.paramName = 'Share')) x
group by x.IntruderName, x.issuename, x.pv
ORDER by x.IntruderName, ct DESC
-index the temp table, subsequent processing is quicker
CREATE INDEX tmpinx1 ON #temp (IntruderName)
CREATE INDEX tmpinx2 ON #temp (ident)
SELECT min(t.ident) as ident, IntruderName INTO #Tempm
FROM #temp t
GROUP BY IntruderName
SELECT t.ident, t.IntruderName, t.ct, t.issuename, t.paramvalue INTO #Temp2
FROM #tempm m
JOIN #temp t ON t.ident = m.ident
SELECT t2.ident + 1 as 'ident', t2.IntruderName, t.ct, t.issuename, t.paramvalue into
#Temp3
FROM #Temp2 t2, #Temp t
WHERE T.ident = t2.ident+1 AND t2.IntruderName = t.IntruderName
SELECT sum(ct) as 'cta', IntruderName INTO #Temp4
FROM #temp
GROUP BY IntruderName
SELECT t4.cta as 'Tot Count', t4.IntruderName as 'Attacker', t2.ct as '#Issue1',
t2.issuename as 'Top Issue', t2.paramValue as 'Detail', t3.ct as '#Issue2',
t3.issuename as 'Second Issue', t3.paramValue as 'Detail'
FROM #temp t
join #Temp4 t4 on t4.IntruderName = T.IntruderName
join #Temp2 t2 ON t2.ident = t.ident
left join #Temp3 t3 on t3.IntruderName= t.IntruderName
where t4.cta*.85 <= (t2.ct + isnull(t3.ct,0))
AND t4.cta > 30
ORDER BY t4.cta DESC, t4.IntruderName
DROP INDEX #temp.tmpinx1
DROP INDEX #temp.tmpinx2
DROP TABLE #temp
DROP TABLE #temp2
DROP TABLE #temp3
DROP TABLE #temp4
DROP TABLE #tempm
--SNIP --
Note, if you run it in a proc, you can remove the drops.
-----Original Message-----
From: Rob Keown [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 24, 2002 6:35 PM
To: 'Chmielarski TOM-ATC090'; [EMAIL PROTECTED]
Subject: RE: ICE Data Mining
We do the same. Specifically we have some procs to eliminate background
"noise" and get us to the real "hand-crafted" intrusions.
Rob Keown
MAC DIRECT
-----Original Message-----
From: Chmielarski TOM-ATC090 [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 24, 2002 4:50 PM
To: [EMAIL PROTECTED]
Subject: ICE Data Mining
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
The majority of the postings to this group pertain to the RealSecure product
line. I was wondering if many subscribers use the BlackICE Sentry product
(now of ISS)? I do a lot of data analysis directly via SQL analysis scripts
and wondered what methods other people use.
Tom Chmielarski
IT Security Engineer
Motorola Information Protection Services
