Friday, November 13, 2015

Win.Trojan.Boaxxe Snort Rule

Quick little run down of a Boaxxe Snort rule and why it fired. Hopefully it's useful for those researching Boaxxe as well as for those just trying to understand Snort rules. Sample pasted here.

Let's say an end user navigates to this url.

GET,279999,v,win,ie9,view5-1,0,,2 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Proxy-Connection: Keep-Alive
Pragma: no-cache

And this snort rule triggered on your IDS. You might ask why?

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Boaxxe variant outbound connection"; flow:to_server,established; urilen:485<>520; content:!"/"; offset:1; http_raw_uri; content:!"."; http_uri; content:"%2f"; http_raw_uri; content:"%2b"; http_raw_uri; content:"|20|MSIE|20|"; fast_pattern:only; http_header; content:!"Referer:"; http_header; metadata:impact_flag red, service http; reference:url,; classtype:trojan-activity; sid:30495; rev:1; )

Let's pick it apart below.


It must be tcp traffic. It must be from your internal network outbound. It must be web ports (80, 443, etc.). It must be an established connection to server (same as from client). Yep all those match so far.


Must be a very long url (between 485 and 520 characters). Yep.

content:!"/"; offset:1; http_raw_uri;

Must not contain a / (essentially a sub folder in the url).. Yep still good.

content:!"."; http_uri;

Must not contain a . (essentially a file extension like .php, .aspx, etc. in the url). Yep still good.

content:"%2f"; http_raw_uri;

Must contain an html encoded / (written exactly as %2f). Yep still good.

content:"%2b"; http_raw_uri;

Must contain an html encoded + (written exactly as %2b). Yep still good.

content:"|20|MSIE|20|"; fast_pattern:only; http_header;

Must contain MSIE in the header. This likely means Internet Explorer in the User Agent. Yep still good.

content:!"Referer:"; http_header;

Must not contain a Referrer in the header. Meaning the user did not click from a different page to this, instead it was a direct call. Yep good.

metadata:impact_flag red, service http;

The rule is over, this is just metadata used by Snort and the IDS to categorize this rule.


This is amazing documentation for this rule. I wish more snort rule developers would supply good documentation!

sid:30495; rev:1;

This is just a unique id for the snort rule, followed by the revision number. In this case it's the 1st version of this rule.

More about neonprimetime

Top Blogs of all-time
  1. ali.txt php injection walk-thru
  2. pagerank botnet sql injection walk-thru
  3. apache struts2 rce walk-thru

Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.

1 comment:

  1. Hi could you explain why the rule triggered with content:!"." but there are several "." characters in the URI? Thanks.