Skip to content

detect: add keywords for LDAPDN - v4 #12620

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
AkakiAlice wants to merge 5 commits into from
Closed

detect: add keywords for LDAPDN - v4 #12620

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2cfeaa8
misc: fix name prefix in detect register functions
AkakiAlice Feb 9, 2025
8c9eb77
nit: replace 'eve' with 'EVE' in the LDAP keywords documentation
AkakiAlice Feb 18, 2025
3bc642d
nit: use the ldap protocol in rule examples in the LDAP keywords docu…
AkakiAlice Feb 19, 2025
621b109
detect: add ldap.request.dn
AkakiAlice Feb 4, 2025
d623e26
detect: add ldap.responses.dn
AkakiAlice Feb 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
112 changes: 100 additions & 12 deletions doc/userguide/rules/ldap-keywords.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ Syntax::

ldap.request.operation uses :ref:`unsigned 8-bit integer <rules-integer-keywords>`.

This keyword maps to the eve field ``ldap.request.operation``
This keyword maps to the EVE field ``ldap.request.operation``

Examples
^^^^^^^^
Expand All @@ -61,11 +61,11 @@ Example of a signatures that would alert if the packet has an LDAP bind request

.. container:: example-rule

alert tcp any any -> any any (msg:"Test LDAP bind request"; :example-rule-emphasis:`ldap.request.operation:0;` sid:1;)
alert ldap any any -> any any (msg:"Test LDAP bind request"; :example-rule-emphasis:`ldap.request.operation:0;` sid:1;)

.. container:: example-rule

alert tcp any any -> any any (msg:"Test LDAP bind request"; :example-rule-emphasis:`ldap.request.operation:bind_request;` sid:1;)
alert ldap any any -> any any (msg:"Test LDAP bind request"; :example-rule-emphasis:`ldap.request.operation:bind_request;` sid:1;)

ldap.responses.operation
------------------------
Expand All @@ -79,7 +79,7 @@ Syntax::

ldap.responses.operation uses :ref:`unsigned 8-bit integer <rules-integer-keywords>`.

This keyword maps to the eve field ``ldap.responses[].operation``
This keyword maps to the EVE field ``ldap.responses[].operation``

An LDAP request operation can receive multiple responses. By default, the ldap.responses.operation
keyword matches all indices, but it is possible to specify a particular index for matching
Expand All @@ -104,31 +104,31 @@ Example of a signatures that would alert if the packet has an LDAP bind response

.. container:: example-rule

alert tcp any any -> any any (msg:"Test LDAP bind response"; :example-rule-emphasis:`ldap.responses.operation:1;` sid:1;)
alert ldap any any -> any any (msg:"Test LDAP bind response"; :example-rule-emphasis:`ldap.responses.operation:1;` sid:1;)

.. container:: example-rule

alert tcp any any -> any any (msg:"Test LDAP bind response"; :example-rule-emphasis:`ldap.responses.operation:bind_response;` sid:1;)
alert ldap any any -> any any (msg:"Test LDAP bind response"; :example-rule-emphasis:`ldap.responses.operation:bind_response;` sid:1;)

Example of a signature that would alert if the packet has an LDAP search_result_done response operation at index 1:

.. container:: example-rule

alert tcp any any -> any any (msg:"Test LDAP search response"; :example-rule-emphasis:`ldap.responses.operation:search_result_done,1;` sid:1;)
alert ldap any any -> any any (msg:"Test LDAP search response"; :example-rule-emphasis:`ldap.responses.operation:search_result_done,1;` sid:1;)

Example of a signature that would alert if all the responses are of type search_result_entry:

.. container:: example-rule

alert tcp any any -> any any (msg:"Test LDAP search response"; :example-rule-emphasis:`ldap.responses.operation:search_result_entry,all;` sid:1;)
alert ldap any any -> any any (msg:"Test LDAP search response"; :example-rule-emphasis:`ldap.responses.operation:search_result_entry,all;` sid:1;)

The keyword ldap.responses.operation supports back to front indexing with negative numbers,
this means that -1 will represent the last index, -2 the second to last index, and so on.
This is an example of a signature that would alert if a search_result_entry response is found at the last index:

.. container:: example-rule

alert tcp any any -> any any (msg:"Test LDAP search response"; :example-rule-emphasis:`ldap.responses.operation:search_result_entry,-1;` sid:1;)
alert ldap any any -> any any (msg:"Test LDAP search response"; :example-rule-emphasis:`ldap.responses.operation:search_result_entry,-1;` sid:1;)

ldap.responses.count
--------------------
Expand All @@ -147,7 +147,7 @@ It can be matched exactly, or compared using the ``op`` setting::

ldap.responses.count uses :ref:`unsigned 32-bit integer <rules-integer-keywords>`.

This keyword maps to the eve field ``len(ldap.responses[])``
This keyword maps to the EVE field ``len(ldap.responses[])``

Examples
^^^^^^^^
Expand All @@ -156,10 +156,98 @@ Example of a signature that would alert if a packet has 0 LDAP responses:

.. container:: example-rule

alert ip any any -> any any (msg:"Packet has 0 LDAP responses"; :example-rule-emphasis:`ldap.responses.count:0;` sid:1;)
alert ldap any any -> any any (msg:"Packet has 0 LDAP responses"; :example-rule-emphasis:`ldap.responses.count:0;` sid:1;)

Example of a signature that would alert if a packet has more than 2 LDAP responses:

.. container:: example-rule

alert ip any any -> any any (msg:"Packet has more than 2 LDAP responses"; :example-rule-emphasis:`ldap.responses.count:>2;` sid:1;)
alert ldap any any -> any any (msg:"Packet has more than 2 LDAP responses"; :example-rule-emphasis:`ldap.responses.count:>2;` sid:1;)

ldap.request.dn
---------------

Matches on LDAP distinguished names from request operations.

Comparison is case-sensitive.

Syntax::

ldap.request.dn; content:dc=example,dc=com;

``ldap.request.dn`` is a 'sticky buffer' and can be used as a ``fast_pattern``.

This keyword maps to the EVE fields:
``ldap.request.bind_request.name``
``ldap.request.add_request.entry``
``ldap.request.search_request.base_object``
``ldap.request.modify_request.object``
``ldap.request.del_request.dn``
``ldap.request.mod_dn_request.entry``
``ldap.request.compare_request.entry``

Example
^^^^^^^

Example of a signature that would alert if a packet has the LDAP distinguished name ``uid=jdoe,ou=People,dc=example,dc=com``:

.. container:: example-rule

alert ldap any any -> any any (msg:"Test LDAPDN"; :example-rule-emphasis:`ldap.request.dn; content:"uid=jdoe,ou=People,dc=example,dc=com";` sid:1;)

It is possible to use the keyword ``ldap.request.operation`` in the same rule to
specify the operation to match.

Here is an example of a signature that would alert if a packet has an LDAP
search request operation and contains the LDAP distinguished name
``dc=example,dc=com``.

.. container:: example-rule

alert ldap any any -> any any (msg:"Test LDAPDN and operation"; :example-rule-emphasis:`ldap.request.operation:search_request; ldap.request.dn; content:"dc=example,dc=com";` sid:1;)

ldap.responses.dn
-----------------

Matches on LDAP distinguished names from response operations.

Comparison is case-sensitive.

Syntax::

ldap.responses.dn; content:dc=example,dc=com;

``ldap.responses.dn`` is a 'sticky buffer' and can be used as a ``fast_pattern``.

``ldap.responses.dn`` supports multiple buffer matching, see :doc:`multi-buffer-matching`.

This keyword maps to the EVE fields:
``ldap.responses[].search_result_entry.base_object``
``ldap.responses[].bind_response.matched_dn``
``ldap.responses[].search_result_done.matched_dn``
``ldap.responses[].modify_response.matched_dn``
``ldap.responses[].add_response.matched_dn``
``ldap.responses[].del_response.matched_dn``
``ldap.responses[].mod_dn_response.matched_dn``
``ldap.responses[].compare_response.matched_dn``
``ldap.responses[].extended_response.matched_dn``

Example
^^^^^^^

Example of a signature that would alert if a packet has the LDAP distinguished name ``dc=example,dc=com``:

.. container:: example-rule

alert ldap any any -> any any (msg:"Test LDAPDN"; :example-rule-emphasis:`ldap.responses.dn; content:"dc=example,dc=com";` sid:1;)

It is possible to use the keyword ``ldap.responses.operation`` in the same rule to
specify the operation to match.

Here is an example of a signature that would alert if a packet has an LDAP
search result entry operation at index 1 on the responses array,
and contains the LDAP distinguished name ``dc=example,dc=com``.

.. container:: example-rule

alert ldap any any -> any any (msg:"Test LDAPDN and operation"; :example-rule-emphasis:`ldap.responses.operation:search_result_entry,1; ldap.responses.dn; content:"dc=example,dc=com";` sid:1;)
94 changes: 94 additions & 0 deletions doc/userguide/suricatactl-filestore.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,94 @@
.\" Man page generated from reStructuredText.
Copy link
Contributor

@catenacyber catenacyber Feb 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should not have added these files

.
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "SURICATACTL-FILESTORE" "1" "2025-02-11" "8.0.0-dev" "Suricata"
.SH NAME
suricatactl-filestore \- Perform actions on filestore
.SH SYNOPSIS
.sp
\fBsuricatactl filestore\fP [\-h] <command> [<args>]
.SH DESCRIPTION
.sp
This command lets you perform certain operations on Suricata filestore.
.SH OPTIONS
.INDENT 0.0
.TP
.B \-h
.UNINDENT
.sp
Get help about the available commands.
.SH COMMANDS
.sp
\fBprune [\-h|\-\-help] [\-n|\-\-dry\-run] [\-v|verbose] [\-q|\-\-quiet] \-d <DIRECTORY>
\-\-age <AGE>\fP
.sp
Prune files older than a given age.
.sp
\-d <DIRECTORY> | \-\-directory <DIRECTORY> is a required argument which tells
that user must provide the suricata filestore directory on which all the
specified operations are to be performed.
.sp
\-\-age <AGE> is a required argument asking the age of the files. Files older
than the age mentioned with this option shall be pruned.
.sp
\-h | \-\-help is an optional argument with which you can ask for help about the
command usage.
.sp
\-n | \-\-dry\-run is an optional argument which makes the utility print only what
would happen
.sp
\-v | \-\-verbose is an optional argument to increase the verbosity of command.
.sp
\-q | \-\-quiet is an optional argument that helps log errors and warnings only
and keep silent about everything else.
.SH BUGS
.sp
Please visit Suricata\(aqs support page for information about submitting
bugs or feature requests.
.SH NOTES
.INDENT 0.0
.IP \(bu 2
Suricata Home Page
.INDENT 2.0
.INDENT 3.5
\fI\%https://suricata.io/\fP
.UNINDENT
.UNINDENT
.IP \(bu 2
Suricata Support Page
.INDENT 2.0
.INDENT 3.5
\fI\%https://suricata.io/support/\fP
.UNINDENT
.UNINDENT
.UNINDENT
.SH COPYRIGHT
2016-2025, OISF
.\" Generated by docutils manpage writer.
.
73 changes: 73 additions & 0 deletions doc/userguide/suricatactl.1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
.\" Man page generated from reStructuredText.
.
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "SURICATACTL" "1" "2025-02-11" "8.0.0-dev" "Suricata"
.SH NAME
suricatactl \- Suricata Control
.SH SYNOPSIS
.sp
\fBsuricatactl\fP [\-h] <command> [<args>]
.SH DESCRIPTION
.sp
This tool helps control Suricata\(aqs features.
.SH OPTIONS
.INDENT 0.0
.TP
.B \-h
.UNINDENT
.sp
Get help about the available commands.
.SH COMMANDS
.sp
\fBsuricatactl\-filestore(1)\fP
.SH BUGS
.sp
Please visit Suricata\(aqs support page for information about submitting
bugs or feature requests.
.SH NOTES
.INDENT 0.0
.IP \(bu 2
Suricata Home Page
.INDENT 2.0
.INDENT 3.5
\fI\%https://suricata.io/\fP
.UNINDENT
.UNINDENT
.IP \(bu 2
Suricata Support Page
.INDENT 2.0
.INDENT 3.5
\fI\%https://suricata.io/support/\fP
.UNINDENT
.UNINDENT
.UNINDENT
.SH COPYRIGHT
2016-2025, OISF
.\" Generated by docutils manpage writer.
.
Loading
Loading