Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SID generated by this script aren't always unique: #6

Open
sporkmonger opened this issue Apr 21, 2017 · 1 comment
Open

SID generated by this script aren't always unique: #6

sporkmonger opened this issue Apr 21, 2017 · 1 comment

Comments

@sporkmonger
Copy link

e.g.

alert http any any -> $HOME_NET any (msg:"OTX - FILE MD5 from pulse Inside the spyware campaign against Argentine troublemakers";  filemd5:55d79cc967db8c7bb8cb5a72.txt; reference: url, otx.alienvault.com/pulse/55d79cc967db8c7bb8cb5a72; sid:414932; rev:1;)
alert http any any -> $HOME_NET any (msg:"OTX - FILE MD5 from pulse Macro Downloaders (Aga Dell)";  filemd5:58c69a109c4484412c9d2a3b.txt; reference: url, otx.alienvault.com/pulse/58c69a109c4484412c9d2a3b; sid:414932; rev:1;)
@Kolano
Copy link

Kolano commented Mar 17, 2020

Doesn't seem like this tool is ever going to be updated to account for this.

Here's a script I'm using to revise duplicate SIDs...

#Loop over duplicate SIDs
for sid in $(grep -P -o "(?<=sid:)\d*" /etc/suricata/rules/otx_file_rules.rules | sort | uniq -d); do
	increment=0
	#Loop over lines with duplicate SIDs, stripping out first match
	grep "$sid" /etc/suricata/rules/otx_file_rules.rules | sed 1d | while read -r line ; do
		#Increment the incrementor
		increment=$((increment+1))
		#Get unique non-sid match
		filemd5=$(echo $line | sed 's/.*filemd5:\([^;]*\).*/\1/')
		#Postfix each sid with incrementor to hopefully generate unique IDs
		sed -i "s/\($filemd5.*sid:[^;]*\)/\1$increment/" /etc/suricata/rules/otx_file_rules.rules
	done
done

It might be better to insert a GID on each duplicate to make them unique, rather than revising the SIDs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants