{"id":89,"date":"2022-07-22T14:45:29","date_gmt":"2022-07-22T14:45:29","guid":{"rendered":"https:\/\/idstower.com\/blog\/?p=89"},"modified":"2022-07-22T14:56:59","modified_gmt":"2022-07-22T14:56:59","slug":"configuring-suricata-ids-to-alert-on-malicious-file-hashes","status":"publish","type":"post","link":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/","title":{"rendered":"Configuring Suricata IDS to alert on Malicious Files Hashes"},"content":{"rendered":"\n<p>Continuing with our previous posts describing <a href=\"https:\/\/idstower.com\/blog\/why-you-should-use-suricata-ids-to-alert-on-iocs\/\" target=\"_blank\" rel=\"noreferrer noopener\">why<\/a> &amp; <a href=\"https:\/\/idstower.com\/blog\/alerting-on-iocs-using-suricata\/\" target=\"_blank\" rel=\"noreferrer noopener\">how to alert on Indicators of Compromise with Suricata IDS using the Dataset feature<\/a>, in this post, we will describe, how to alert on malicious files observed in the network.<\/p>\n\n\n\n<p>For that, we will use a list of Malware hashes obtained from abuse.ch <a href=\"https:\/\/threatfox.abuse.ch\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">ThreaFox API<\/a>, But first, why would you want to use hashes as IOCs knowing that attacker could easily change them?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why hashes IOCs are still relevant today?<\/h2>\n\n\n\n<p>While solely depending on Malicious Files hashes IOCs to detect attackers presence in your network wont be a solid cyber defense strategy, using them as an additional detection angle will help, and some of the reasons are:<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">1. Hashes IOCs are everywhere<\/h5>\n\n\n\n<p>Most (if not all) of the commercial &amp; free Threat Intelligence feeds providers publish Hashes IOCs in their feeds, traditionally they are integrated into EDR\/AV solutions to block malicious files on the endpoints, and with the capabilities that Suricata IDS offers, you can now do the same on the network level, which can cover endpoints\/servers\/IOT devices&#8230;etc that don&#8217;t have EDR installed on them.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">2. Not all attackers are really that advanced (the A in APT)<\/h5>\n\n\n\n<p>Once your system is on the internet, you should expect threats of all shapes and forms. <br>and while some of those might be coming from actual APT, the vast majority will be opportunistic attacks by cyber criminals.<\/p>\n\n\n\n<p>Those opportunistic attackers will reuse malware and attack tools published on the internet and won&#8217;t necessarily have the know-how to alter the hashes of those tools before using them against your systems, and that will be a detection opportunity, remember, attackers aren&#8217;t invincible &amp; we must use that to our advantage.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">3. Hashes have no false positives<\/h5>\n\n\n\n<p>Unlike IDS Signatures that can produce many false positives for various reasons, the calculated hash of a file either matches one of the hashes in the list of known bad files, or not, no more, no less, and as long as you trust your IOCs feed, you will be sure that it is indeed that same malicious file.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Suricata IDS\/IPS Detect &amp; alert on Hashes<\/h2>\n\n\n\n<p>Now that have discussed the Why, lets talk about the How.<\/p>\n\n\n\n<p>Suricata IDS <a href=\"https:\/\/suricata.readthedocs.io\/en\/latest\/rules\/intro.html?highlight=protocols#protocol\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">comes with a growing list of supported protocols<\/a>, some of these protocols (eg: HTTP) are used to download\/upload files, Suricata will extract the files exchanged over those protocols and will calculate their hashes (and store it for you if you want).<\/p>\n\n\n\n<p>The calculated file hash will be available for us to use in Rules as a keyword, namely: filemd5 or filesha1 or filesha256, your choice of hash type depends on what is the type of the hashes IOCs are available to you in your feeds, in this post <strong>we will stick to sha256 hashes<\/strong> as they are becoming the industry standard today.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Used OS &amp; Suricata Version<\/h4>\n\n\n\n<p>In this example, we will be using the latest version of Suricata (6.0.6 as of today) <a href=\"https:\/\/suricata.readthedocs.io\/en\/latest\/install.html#ubuntu\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">installed from the official Ubuntu PPA<\/a>  on an Ubuntu 20.04 (Focal) VM.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Preparing the Hashes IOCs file<\/h4>\n\n\n\n<p>Lets download the list of sha256 IOCs from ThreatFox API using the below curl request<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -X POST https:\/\/threatfox-api.abuse.ch\/api\/v1\/ -d '{ \"query\": \"get_iocs\", \"days\": 90 }' &gt; iocs_list.json\n<\/code><\/pre>\n\n\n\n<p>For the next step, we will need to us jq command to parse and filter the iocs_list.json file, it dose not come installed on Ubuntu so lets install it<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install -y jq<\/code><\/pre>\n\n\n\n<p>Then, we filter the json data for sha256 IOCs using the jq linux command<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat iocs_list.json  | jq -c -r '.data&#91;] | select( .ioc_type == \"sha256_hash\") | .ioc' &gt; sha256_iocs.list\n<\/code><\/pre>\n\n\n\n<p>now that we have our IOCs list ready in sha256_iocs.list, lets copy it to our suricata rules directory (note: <a href=\"https:\/\/suricata.readthedocs.io\/en\/latest\/install.html#ubuntu\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">please make sure you already installed Suricata<\/a>)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo cp sha256_iocs.list \/etc\/suricata\/rules\/<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Creating the Suricata IDS Rule<\/h4>\n\n\n\n<p>To alert on malicious files using hashes, we will create an IDS Rule, this rule will trigger the sha256 hash of the downloaded files to be calculated and Suricata will compare it against the list of hashes in sha256_iocs.list, generating an alert if a match is found.<\/p>\n\n\n\n<p>The rules we will use is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>alert http any any -&gt; any any (msg:\"ThreatIntel: Malicious File Downloaded over Http\"; flow: established; filesha256:\/etc\/suricata\/rules\/sha256_iocs.list; classtype: trojan-activity; sid:1; rev:1;)<\/code><\/pre>\n\n\n\n<p>In the above example, the rule will generate an alert when a file matching one of our hashes IOCs list is observed over HTTP protocol.<\/p>\n\n\n\n<p>We then place the above rule in a new rules file named iocs.rule and configure Suricata IDS to load it by adding iocs.rules to the list of rules files<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">echo 'alert http any any -&gt; any any (msg:\"ThreatIntel: Malicious File Downloaded over Http\"; flow: established; filesha256:\/etc\/suricata\/rules\/sha256_iocs.list; classtype: trojan-activity; sid:1; rev:1;)' | sudo tee \/etc\/suricata\/rules\/iocs.rules<\/pre>\n\n\n\n<p>We also need to configure Suricata IDS to load the new rules file &#8220;iocs.rules&#8221;, here is the updated suricata configuration section (from suricata.yaml) that dose that (Note: we changed the default-rule-path value)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>default-rule-path: \/etc\/suricata\/rules\n\nrule-files:\n  - suricata.rules\n  - iocs.rules<\/code><\/pre>\n\n\n\n<p>Then we proceed to run suricata and make it listen to traffic in our testing VM (note: adjust your interface name as needed)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo suricata -c \/etc\/suricata\/suricata.yaml -i enp0s3\n<\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Verifying that Alerting works<\/h5>\n\n\n\n<p>Now that we have Suricata IDS running and listening to traffic in our testing VM, we will verify that alerting against malicious hashes IOCs we obtained from ThreatFox API actually works.<\/p>\n\n\n\n<p>The issue we face here, is that ThreatFox dose note give us a direct download url that we can download from into our VM to simulate a malware binary download, but rather provide a password-protected zip file over https, this file will have a different hash, thus the alerting wont work.<\/p>\n\n\n\n<p>To overcome this, we will start a webserver in another VM that will have the malicious binary and we will download the file from there, to start lets obtain the malicious binary.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Downloading the malicious file to our local webserver<\/h5>\n\n\n\n<p>First lets get the first hash from our sha256_iocs.list file (note: you will probably get a different one but that is ok)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>head -n 1 \/etc\/suricata\/rules\/sha256_iocs.list\n\naf8d7c18fe97415d7ede0cba166dce004ebbe94eacd1af6f61d8d3527b015e22<\/code><\/pre>\n\n\n\n<p>The hash happened to be for NjRat malware, <a href=\"https:\/\/bazaar.abuse.ch\/browse\/\">we can obtain the sample by searching in MalwareBazaar Database<\/a>, remember to use sha256:hash syntax when searching, or simply search google.<\/p>\n\n\n\n<p>Lets download <a href=\"https:\/\/bazaar.abuse.ch\/sample\/af8d7c18fe97415d7ede0cba166dce004ebbe94eacd1af6f61d8d3527b015e22\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">our malware sample from MalwareBazar<\/a> into another VM, unzip the file, and run a simple python webserver (note: ZIP password is &#8220;infected&#8221;)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt-get install -y p7zip-full\n7z x af8d7c18fe97415d7ede0cba166dce004ebbe94eacd1af6f61d8d3527b015e22.zip\npython3 -m http.server<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Triggering the Suricata Alert<\/h5>\n\n\n\n<p> Then we will proceed to download the malware file from the Suricata IDS machine<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo wget http:\/\/192.168.3.205:8000\/af8d7c18fe97415d7ede0cba166dce004ebbe94eacd1af6f61d8d3527b015e22.exe<\/code><\/pre>\n\n\n\n<p>Viewing fast.log &amp; eve.json to check if alerts were triggered shows that everything worked as expected<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ cat \/var\/log\/suricata\/fast.log\n07\/22\/2022-13:35:25.071655  &#91;**] &#91;1:1:1] ThreatIntel: Malicious File Downloaded over Http &#91;**] &#91;Classification: A Network Trojan was detected] &#91;Priority: 1] {TCP} 192.168.3.205:8000 -&gt; 192.168.3.206:47128\n\n$ cat \/var\/log\/suricata\/eve.json | jq\n\n{\n    \"timestamp\": \"2022-07-22T13:35:25.071655+0000\",\n    \"flow_id\": 1807428129456394,\n    \"in_iface\": \"enp0s3\",\n    \"event_type\": \"alert\",\n    \"src_ip\": \"192.168.3.205\",\n    \"src_port\": 8000,\n    \"dest_ip\": \"192.168.3.206\",\n    \"dest_port\": 47128,\n    \"proto\": \"TCP\",\n    \"tx_id\": 0,\n    \"alert\": {\n        \"action\": \"allowed\",\n        \"gid\": 1,\n        \"signature_id\": 1,\n        \"rev\": 1,\n        \"signature\": \"ThreatIntel: Malicious File Downloaded over Http\",\n        \"category\": \"A Network Trojan was detected\",\n        \"severity\": 1\n    },\n    \"http\": {\n        \"hostname\": \"192.168.3.205\",\n        \"http_port\": 8000,\n        \"url\": \"\/af8d7c18fe97415d7ede0cba166dce004ebbe94eacd1af6f61d8d3527b015e22.exe\",\n        \"http_user_agent\": \"Wget\/1.20.3 (linux-gnu)\",\n        \"http_content_type\": \"application\/x-msdos-program\",\n        \"http_method\": \"GET\",\n        \"protocol\": \"HTTP\/1.1\",\n        \"status\": 200,\n        \"length\": 36864\n    },\n    \"files\": &#91;\n        {\n            \"filename\": \"\/af8d7c18fe97415d7ede0cba166dce004ebbe94eacd1af6f61d8d3527b015e22.exe\",\n            \"sid\": &#91;],\n            \"gaps\": false,\n            \"state\": \"CLOSED\",\n            \"sha256\": \"af8d7c18fe97415d7ede0cba166dce004ebbe94eacd1af6f61d8d3527b015e22\",\n            \"stored\": false,\n            \"size\": 36864,\n            \"tx_id\": 0\n        }\n    ],\n    \"app_proto\": \"http\",\n    \"flow\": {\n        \"pkts_toserver\": 17,\n        \"pkts_toclient\": 30,\n        \"bytes_toserver\": 1343,\n        \"bytes_toclient\": 39057,\n        \"start\": \"2022-07-22T13:35:25.065802+0000\"\n    }\n}<\/code><\/pre>\n\n\n\n<p>As we can see, Suricata IDS successfully captured the downloaded file and alerted on it, this feature open an opportunity to add a new detection mechanism that you can use to monitor for malicious files, hacking tools&#8230;etc being downloaded to your network.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\"><strong>How IDSTower can help?<\/strong><\/h5>\n\n\n\n<p>IDSTower not only will <a href=\"https:\/\/www.idstower.com\/threat-intelligence-feeds.html\">automatically setup &amp; configure this features in Suricata IDS<\/a>, it will also Integrate with Free &amp; Commercial Threat Intelligence Feeds to download Malicious Files Hashes IOCs and push them to Suricata IDS Hosts, all with a single click!<\/p>\n\n\n\n<p>If you are interested to learn more on how IDSTower can help you enhance your network security operations, please take a look at <a href=\"https:\/\/www.idstower.com\/#overview\">the Features that IDSTower offers<\/a> &amp; <a href=\"https:\/\/idstower.com\/getLicense.php?type=Standard\">Download A free license now!<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Continuing with our previous posts describing why &amp; how to alert on Indicators of Compromise with Suricata IDS using the Dataset feature, in this post, we will describe, how to alert on malicious files observed in the network. For that, we will use a list of Malware hashes obtained from abuse.ch ThreaFox API, But first, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[3],"tags":[9,11,8,7],"class_list":["post-89","post","type-post","status-publish","format-standard","hentry","category-suricata-ids","tag-iocs","tag-malicious-files","tag-suricata","tag-threat-intelligence-feeds"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Configuring Suricata IDS to alert on Malicious Files Hashes - IDSTower Blog<\/title>\n<meta name=\"description\" content=\"In this post, we will explain how to configure Suricata IDS to alert on Malicious File Hashes IOCs obtained from ThreatFox API.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"configuring-suricata-ids-to-alert-on-malicious-file-hashes\" \/>\n<meta property=\"og:description\" content=\"In this post, we will explain how to configure Suricata IDS to alert on Malicious File Hashes IOCs obtained from ThreatFox API.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/\" \/>\n<meta property=\"og:site_name\" content=\"IDSTower Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-07-22T14:45:29+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-07-22T14:56:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min.png\" \/>\n\t<meta property=\"og:image:width\" content=\"184\" \/>\n\t<meta property=\"og:image:height\" content=\"50\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"configuring-suricata-ids-to-alert-on-malicious-file-hashes\" \/>\n<meta name=\"twitter:description\" content=\"In this post, we will explain how to configure Suricata IDS to alert on Malicious File Hashes IOCs obtained from ThreatFox API.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min.png\" \/>\n<meta name=\"twitter:creator\" content=\"@IDSTower\" \/>\n<meta name=\"twitter:site\" content=\"@IDSTower\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\\\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/person\\\/de3006b0e8ec6f07ed283b57edc0137d\"},\"headline\":\"Configuring Suricata IDS to alert on Malicious Files Hashes\",\"datePublished\":\"2022-07-22T14:45:29+00:00\",\"dateModified\":\"2022-07-22T14:56:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\\\/\"},\"wordCount\":1143,\"publisher\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#organization\"},\"keywords\":[\"IOCs\",\"Malicious Files\",\"Suricata\",\"Threat Intelligence Feeds\"],\"articleSection\":[\"Suricata IDS\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\\\/\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\\\/\",\"name\":\"Configuring Suricata IDS to alert on Malicious Files Hashes - IDSTower Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#website\"},\"datePublished\":\"2022-07-22T14:45:29+00:00\",\"dateModified\":\"2022-07-22T14:56:59+00:00\",\"description\":\"In this post, we will explain how to configure Suricata IDS to alert on Malicious File Hashes IOCs obtained from ThreatFox API.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/idstower.com\\\/blog\\\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/idstower.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Configuring Suricata IDS to alert on Malicious Files Hashes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/\",\"name\":\"IDSTower Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/idstower.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#organization\",\"name\":\"IDSTower\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/logo-min-1.png\",\"contentUrl\":\"https:\\\/\\\/idstower.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/logo-min-1.png\",\"width\":184,\"height\":50,\"caption\":\"IDSTower\"},\"image\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/IDSTower\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/person\\\/de3006b0e8ec6f07ed283b57edc0137d\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"http:\\\/\\\/idstower.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Configuring Suricata IDS to alert on Malicious Files Hashes - IDSTower Blog","description":"In this post, we will explain how to configure Suricata IDS to alert on Malicious File Hashes IOCs obtained from ThreatFox API.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/","og_locale":"en_US","og_type":"article","og_title":"configuring-suricata-ids-to-alert-on-malicious-file-hashes","og_description":"In this post, we will explain how to configure Suricata IDS to alert on Malicious File Hashes IOCs obtained from ThreatFox API.","og_url":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/","og_site_name":"IDSTower Blog","article_published_time":"2022-07-22T14:45:29+00:00","article_modified_time":"2022-07-22T14:56:59+00:00","og_image":[{"width":184,"height":50,"url":"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min.png","type":"image\/png"}],"author":"admin","twitter_card":"summary_large_image","twitter_title":"configuring-suricata-ids-to-alert-on-malicious-file-hashes","twitter_description":"In this post, we will explain how to configure Suricata IDS to alert on Malicious File Hashes IOCs obtained from ThreatFox API.","twitter_image":"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min.png","twitter_creator":"@IDSTower","twitter_site":"@IDSTower","twitter_misc":{"Written by":"admin","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/#article","isPartOf":{"@id":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/"},"author":{"name":"admin","@id":"https:\/\/idstower.com\/blog\/#\/schema\/person\/de3006b0e8ec6f07ed283b57edc0137d"},"headline":"Configuring Suricata IDS to alert on Malicious Files Hashes","datePublished":"2022-07-22T14:45:29+00:00","dateModified":"2022-07-22T14:56:59+00:00","mainEntityOfPage":{"@id":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/"},"wordCount":1143,"publisher":{"@id":"https:\/\/idstower.com\/blog\/#organization"},"keywords":["IOCs","Malicious Files","Suricata","Threat Intelligence Feeds"],"articleSection":["Suricata IDS"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/","url":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/","name":"Configuring Suricata IDS to alert on Malicious Files Hashes - IDSTower Blog","isPartOf":{"@id":"https:\/\/idstower.com\/blog\/#website"},"datePublished":"2022-07-22T14:45:29+00:00","dateModified":"2022-07-22T14:56:59+00:00","description":"In this post, we will explain how to configure Suricata IDS to alert on Malicious File Hashes IOCs obtained from ThreatFox API.","breadcrumb":{"@id":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/idstower.com\/blog\/configuring-suricata-ids-to-alert-on-malicious-file-hashes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/idstower.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Configuring Suricata IDS to alert on Malicious Files Hashes"}]},{"@type":"WebSite","@id":"https:\/\/idstower.com\/blog\/#website","url":"https:\/\/idstower.com\/blog\/","name":"IDSTower Blog","description":"","publisher":{"@id":"https:\/\/idstower.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/idstower.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/idstower.com\/blog\/#organization","name":"IDSTower","url":"https:\/\/idstower.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/idstower.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min-1.png","contentUrl":"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min-1.png","width":184,"height":50,"caption":"IDSTower"},"image":{"@id":"https:\/\/idstower.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/IDSTower"]},{"@type":"Person","@id":"https:\/\/idstower.com\/blog\/#\/schema\/person\/de3006b0e8ec6f07ed283b57edc0137d","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g","caption":"admin"},"sameAs":["http:\/\/idstower.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts\/89","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/comments?post=89"}],"version-history":[{"count":18,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts\/89\/revisions"}],"predecessor-version":[{"id":108,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts\/89\/revisions\/108"}],"wp:attachment":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/media?parent=89"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/categories?post=89"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/tags?post=89"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}