Forest Global Training Partners

Cyber Risks · Cisco Talos

Using Snort fast patterns wisely for fast rules

Summary: Snort 2.8.6 introduced the fast_pattern keyword and a debug-print-fast-pattern config option, giving rule writers control over which content string Snort uses to decide whether to evaluate a rule. The article walks through examples where Snort's default choice - the longest string, such as "INVITE sip|3A|" or the URI pattern "/BUY.HTML?" - matches far more traffic than the rule actually alerts on, and shows how fast_pattern, fast_pattern:only, and http_header narrow the entry condition. Cisco's VRT said it is reviewing its entire ruleset and expects thousands of rule changes over the following weeks.

Bottom line: Every rule whose fast pattern matches common traffic forces Snort to evaluate the rest of the rule each time, and the article's own example replaces a pattern seen in all SIP invitations with "Gizmo" - a difference the author describes as orders of magnitude in how often the rule is entered. With thousands of VRT rule changes landing in a matter of weeks, the detection load on your sensors is about to shift whether or not you touch your own rules.

Read the original at Cisco Talos ↗

Topics
Malware
Related