User-defined Rules

Scanner Rules

Types of Rules

Purpose of User-defined Rules

User-defined Rules Location

Vulnerability Rules Syntax

Master Rule Syntax

Severity Levels

Vulnerability Type Keywords

Sample Rules

User-defined Rules

Creating a User Rule

User Rules in Reports

User Rules in the NSDB

Testing Your New Rule

User-defined Rules

This appendix provides some background on Cisco Secure Scanner rules and explains how to write your own vulnerability rules.

This appendix includes the following sections:

Scanner Rules

The Scanner uses rules to scan for vulnerabilities on the network.

This section includes the following topics:

Types of Rules

The Scanner uses three types of rules to scan for vulnerabilities on the network:

Service rules
Operating System rules
Vulnerability rules (including the user-defined rules)

When a session is launched, the Scanner runs the Service rules first to identify all services on the network. The OS rules are run next. The information gained by the service rules helps the Scanner to identify the operating systems on the network. The vulnerability rules are run last, because the Scanner uses the service and OS rules to help identify vulnerabilities on the network.

The Scanner tries to match as many vulnerability rules as possible from the entire list of rules. The user-defined rules are part of the vulnerability set of rules. User rules examine port or banner data that both TCP and UDP port scans collect. The port scan data can be supplemented by nudges, which are small pieces of program code that nudge a particular port or service into providing more information beyond the simple connection banner.

Purpose of User-defined Rules

Cisco gives you the opportunity to write user-defined vulnerability rules for the Scanner. User-defined vulnerability rules offer the following:

A chance to customize certain string matches to meet your company's needs

: For example, your company may need to have a user rule that searches for a certain string to find legacy systems.

A stopgap measure to respond to new vulnerabilities until the Scanner rules updates are available

: User-defined rules help you to cope with newly discovered vulnerabilities until the Scanner rules updates are available.

Note The Scanner rules updates are posted on the Cisco web site. Cisco wants you to be able to respond to new vulnerabilities until a new set of rules can be released, and to share any rules that you write with Cisco.

Customers who have purchased the maintenance agreement can go to http://www.cisco.com/go/scanner to look for the rules updates. Follow the directions on the web site for downloading the new rules file.

Any rules that you have written between rules updates will not be overwritten when you download and install the latest vulnerability rules. Your user-defined rules are retained and processed after the Scanner runs the vulnerability rules set.

User-defined Rules Location

All user-defined rules are stored in the following directory:

./etc/rules/user.rules

The user.rules file contains the most current instructions for adding new rules. Because the Scanner rules are continuously being updated, the user.rules file will always contain embedded comments with the latest examples.

Note After a rule is placed in the user.rules file, it runs every time the Scanner is started unless you open the file and comment (using the # symbol) it out.

Vulnerability Rules Syntax

This section describes the master syntax and keywords used in user-defined vulnerability rules.

This section contains the following topics:

Master Rule Syntax

User rules consist of a left side and a right side, separated by the => ("implies") mark. Two syntax statements (scanfor, has port) can only be used on the left side of the rule. Another syntax statement (axis name) can be used on either side of the rule. The hypercube fact can only be used on the right side of the rule. The hypercube is the patent-pending multidimensional database that is the underlying force behind the Grid Browser.

The following master rules display the required syntax for both sides of a user rule:

scanfor rule
- scanfor "<text expression>" on port <port number> [using protocol tcp | udp] => <hypercube fact>
port rule
- has port <port number> [using protocol tcp | udp] => <hypercube fact>
Axis name in Grid Browser
- <axis name>:<sub-axis name> [:sub-axis name] => . . .
Hypercube fact or vulnerability rule
- => VUL:<severity level>:<vulnerability type>:<vulnerability name>:Vp | Vc:<vulnerability ID number>
where

VUL is the vulnerability keyword.

<severity level> is an integer in the range of 1-3 (see the next section "Severity Levels" for more information).

<vulnerability type> is the type of signature (user-defined or taken from the list in "Vulnerability Type Keywords").

<vulnerability name> is the name of the vulnerability (user-defined).

Vp|Vc is the keyword used to indicate to the Scanner that this VUL object is defined by a rule (potential vulnerability) rather than by the output of an active exploit module (confirmed vulnerability). Vp is the type allowed in user rules is the other type; however, Vcs require active exploitation of vulnerabilities. The Scanner does not allow user access to the resources for Vcs due to the high level of expertise required to successfully develop them.

<vulnerability ID number> is the numeric ID assigned to the rule (user-defined and must be in the range of 100000-199999, which is reserved for user rules).

Caution Make sure that you have no typos in your user rules and that the order of the elements fits the master syntax exactly.

Severity Levels

There are three severity levels in user-defined rules:

Severity 1---Applies to vulnerabilities that permit reconnaissance activities, but do not lead to unauthorized access.

Severity 2---Applies to vulnerabilities that permit some level of unauthorized data access or denial of service.

Severity 3---Applies to vulnerabilities that permit intruders to execute arbitrary commands on network servers.

Vulnerability Type Keywords

You can define your own Vulnerability Type or use one of the following keywords in the <vulnerability type> field.

Access---Indicates that the vulnerability allows some type of access to machine or data, such as remote access or a user going from normal user to super user.
Denial---Indicates that the vulnerability allows some type of denial of service, such as causing a machine to crash or tying up a mail server so that it cannot accept mail.
Recon---Indicates that the vulnerability allows an attacker to gain some type of information useful to them in future attacks.
Relay---Indicates that the vulnerability allows a machine to be used as a conduit to attack some other machine, for example, an FTP bounce attack in which traffic is relayed through an FTP server to attack a third machine.
Other---Covers all other types of vulnerabilities.
User-defined value---You can use any keyword that you want to describe your vulnerability.

Sample Rules

The following sample rules can be found in the user.rules text file in C:\Program Files\Cisco Systems\Cisco Secure Scanner\etc\rules\user.rules.

Here is an example of a scanfor rule:

scanfor "UNIX" on port 23 => VUL:1:OS:UNIX:Vp:100006

: This rule looks for the word UNIX in the banner from port 23 and then runs a vulnerability rule, which states that this Vp exists and adds it to the Grid Browser.

port 23 using protocol tcp => Service:Remote-Access:my_telnet

: This rule looks for port 23 tcp protocol and if the port exists, adds the service rule to the Grid Browser.

To have your new rule show up in the report or in the NSDB, you must create HTML files for the rule. See the section "Creating a User Rule" for the procedure.

User-defined Rules

Use the following procedures to create a user-defined rule, to add it to the user-rules file so that the Scanner can scan for it, and to have it appear in reports and in the NSDB.

This section contains the following topics:

Creating a User Rule

To create a user rule, follow these steps:

Step 1 Determine what kind of user rule you need.

For example, you can write a service, scanfor, port, or vulnerability rule.

Note

Step 2 Write the rule in WordPad using the correct syntax (see "Master Rule Syntax" for more information):

Example: scanfor "UNIX" on port 23 => VUL:1:OS:UNIX:Vp:100006

Step 3 Copy the rule and paste it at the end of the user.rules file found in the following directory:

./etc/rules/user.rules

Note

Step 4 Save the user.rules file.

The Scanner will now scan for your new rule.

Tips If you have any problems with getting your rule to show up in the proper places, go to the files that you have modified, and check the syntax and spelling of all the rules that you have written.

User Rules in Reports

You must create an HTML file so that your new rule will show up in your reports.

To have your user rule show up in reports, follow these steps:

Step 1 In WordPad, open the rep_vul_0.html template found in ./ReportComponents/Templates.

Step 2 Provide a description of your vulnerability by editing the following fields in the file:

Vulnerability Description
Consequences
Countermeasure
Severity Level
Affected Systems
Affected Program
Advisory/Related Info Links
Fix/Patch/Upgrade Links
Exploit Links

Step 3 Save the file as rep_vul_<vulnerability ID number>.html:

Example: rep_vul_100006.html

Step 4 Copy the file into the following directory:

./ReportComponents/Templates

Step 5 Create a TEMPLATES rule in WordPad using the following syntax:

rep_vul_<vulnerability ID number>.html TEMPLATES VUL:<severity level>:<vulnerability type>:<vulnerability name>:Vp:<vulnerability ID number>

Example: rep_vul_100006.html TEMPLATES VUL:1:OS:UNIX:Vp:100006

Note

Step 6 Copy the TEMPLATES rule and paste at the end of the user.rules file found in the following directory:

./etc/rules/user.rules

Step 7 Save the user.rules file.

Your new rule will now show up in the Scanner reports.

User Rules in the NSDB

To have your rule show up as an NSDB entry that maps to your vulnerability and that will be linkable from the Grid Browser, you must create an HTML file.

To create an HTML file for your rule, follow these steps.

Step 1 Open the vul_0.html file found in the following directory:

./Cisco Secure Scanner/html

Step 2 Save the file as vul_<vulnerability ID number>.html:

Example: note_100006.html

Step 3 Provide a description of your vulnerability by editing the following fields in the file:

Vulnerability Description
Alias
ID Number
Severity Level
Vulnerability Type
Affected Systems
Affected Programs
Consequences
Countermeasure
Advisory/Related Info Links
Fix/Patch/Upgrade Links
Exploit Links
User Notes

Step 4 Copy the file to the following directory:

./Cisco Secure Scanner/html

Step 5 Create a DOCUMENTS rule in WordPad using the following syntax:

vul_<vulnerability ID number>.html DOCUMENTS VUL:<severity level>:<vulnerability type>:vulnerability name:Vp:<vulnerability ID number>

Example: vul_100006.html DOCUMENTS VUL:1:OS:UNIX:Vp:100006

Note

Step 6 Copy the DOCUMENTS rule (after the VUL rule) into the user.rules file found in the following directory:

./etc/rules/user.rules

Your new rule and description will now show up in the NSDB.

Testing Your New Rule

To make sure that your new rule shows up in all the correct places, follow these steps:

Step 1 Create and run a session.

See Chapter 6, "Creating Sessions" for the procedure for creating sessions.

Step 2 Create a grid of the data.

See Chapter 7, "Viewing Data Results" for more information on creating grids.

Step 3 Check to see that your rule appears as a vulnerability in the grid.

Step 4 Create a report of the data.

See Chapter 9, "Generating Reports" for more information on creating reports.

Step 5 View the report and check to see that your rule appears in the report.

Step 6 Drill down to the host level and click the link to the NSDB to make sure that your new user-defined rule appears in the NSDB.

See Chapter 10, "Network Security Database" for more information on using the NSDB.

Tips If you have any problems getting your rule to show up in the proper places, go to the files that you have modified, and check the syntax and spelling of all the rules that you have written. The syntax must be exact, that is, in the correct order and with no typos.

Table of Contents

User-defined Rules