Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... User manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-025609-01, Revision 1
Security Threat Response Manager
Category Offense Investigation Guide
Release 2008.2

2
Copyright Notice
Copyright © 2008 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper
Networks Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this
document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks
assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves
the right to change, modify, transfer, or otherwise revise this publication without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following
information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it
is not installed in accordance with NetScreen’s installation instructions, it may cause interferencewith radio and television reception. This equipment has
been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These
specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/TV
technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET
THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE
SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
Category Offense Investigation Guide
Release 2008.2
Copyright © 2008, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Revision History
June 2008—Revision 1
The information in this document is current as of the date listed in the revision history.

CONTENTS
ABOUT THIS GUIDE
Documentation Feedback 1
Requesting Support 1
1ACCESS OFFENSES
What is an Access Offense? 3
How do I Investigate an Access Offense? 4
How do I Tune an Access Offense? 7
2SIM AUDIT OFFENSES
What is SIM Audit? 9
How do I Investigate a SIM Audit Offense? 9
How do I Tune a SIM Audit Offense? 12
Tuning Using False Positive Function 12
Tuning Using Custom Rules Wizard 14
3AUTHENTICATION OFFENSES
What is an Authentication Offense? 17
How do I Investigate an Authentication Offense? 17
How do I Tune an Authentication Offense? 21
4CRE OFFENSES
What is a CRE Offense? 23
How do I Investigate a CRE Offense? 23
How do I Tune a CRE Offense? 26
5DENIAL OF SERVICE (DOS) OFFENSES
What is a DoS Offense? 27
What is a DoS Flood Attack? 27
What is a DoS Service Exploit? 28
How do I Investigate a DoS Offense? 28
How do I Tune a DoS Offense? 32
Tuning Using False Positive Function 32
Tuning Using Sentries 33
Tuning Using Custom Rules Wizard 33

How Can I Verify If STRM is Receiving Valid DoS Offenses? 34
6EXPLOIT OFFENSES
What is an Exploit Attack? 35
How do I Investigate an Exploit Offense 35
How do I Tune an Exploit Offenses? 39
How Can I Verify That STRM is Receiving Valid Exploit Offenses? 40
7MALWARE OFFENSES
What is Malware? 41
What is Malware? 41
What is a Malware Offense? 41
How do I Investigate a Malware Offense? 42
How do I Tune a Malware Offense? 45
8NETWORK ANOMALIES OFFENSES
What is an Network Anomaly Offense? 47
Policy 47
Threshold 47
Anomaly 48
Behavior 48
How do I Investigate a Network Anomaly Offense 48
How do I Tune a Network Anomaly Offense? 50
9POLICY OFFENSES
What is a Policy Offense? 51
How do I Investigate a Policy Offense? 51
How do I Tune a Policy Offense? 54
Tuning Using False Positive Function 54
Tuning Using Custom Rules Wizard 55
How Can I Verify That STRM is Receiving Valid Offenses? 55
10 POTENTIAL EXPLOIT OFFENSES
What is a Potential Exploit Offense? 57
How do I Investigate a Potential Exploit Offense? 57
How do I Tune a Potential Exploit Offense? 59
11 RECONNAISSANCE OFFENSES
What is Reconnaissance? 61
What is Network Reconnaissance? 61
What is a Reconnaissances Offense? 61
How do I Investigate a Reconnaissance Offense? 62
How do I Tune a Reconnaissance Offense? 65
Tuning Using False Positive Function 65
Tuning Using Custom Rules Wizard 67

12 SUSPICIOUS ACTIVITY OFFENSES
What is a Suspicious Attack? 69
What is Suspicious Traffic? 69
What is a Suspicious Offense? 69
How do I Investigate Suspicious Offense 70
How do I Tune a Suspicious Offenses? 73
13 SYSTEM OFFENSES
What is a System Offense? 77
How do I Investigate a System Offense? 77
How do I Tune a System Offense? 80
How Can I Verify That STRM is Receiving Valid Offenses? 81
14 USER DEFINED OFFENSES
What is a User Defined Offense? 83
How do I Investigate a User Defined Offense? 83
How do I Tune a User Defined Offense? 86

Category Offense Investigation Guide
ABOUT THIS GUIDE
This preface provides the following guidelines for using the Category Offense
Investigation Guide:
•Documentation Feedback
•Requesting Support
Documentation
Feedback We encourage you to provide feedback, comments, and suggestions so that we
can improve the documentation. Send your comments to
[e-mail], or fill out the documentation feedback form at
http://www.juniper.net/techpubs/docbug/docbugreport.html. If you are using e-mail,
be sure to include the following information with your comments:
•Document name
•Document part number
•Page number
•Software release version
Requesting
Support Open a support case using the Case Management link at http://www.juniper.net/support/
or call 1-888-314-JTAC (from the United States, Canada, or Mexico) or
1-408-745-9500 (from elsewhere).

Offense Category Investigation Guide
1ACCESS OFFENSES
This chapter provides information on access offenses including:
•What is an Access Offense?
•How do I Investigate an Access Offense?
•How do I Tune an Access Offense?
What is an Access
Offense? Limiting access to your network and networked resources is an essential
component of any network security strategy. In most cases, this is accomplished
using firewalls. Monitoring the activity of the firewalls in your network is a massive
undertaking for most organizations since the amount of logs generated can be
overwhelming. STRM intelligently collects and analyzes firewall logs and then
automatically reports any abnormal and/or suspicious behavior.
STRM generates offenses based on access related behavior when a user is
attempting to gain illegal access to your network. By analyzing the firewall and
other intrusion prevention device logs, STRM determines when a particular IP
address has been denied access in a manner that requires investigation. STRM
can also detect suspicious failed access to the same destination as well as
multiple attempts across many distributed destinations.

Offense Category Investigation Guide
4ACCESS OFFENSES
How do I
Investigate an
Access Offense?
To investigate an access offense:
Step 1 Click the Offense Manager tab.
The Offense Manager window appears.
Step 2 Click By Category from the navigation menu.
The By Category view appears displaying high-level categories. The counts for
each category are accumulated from the values in the low-level categories.
Hint: Only low-level categories with associated offenses appear with an arrow.
You can click the arrow to view the associated low-level categories. If you wish to
view all categories, click Show Inactive Categories.
Step 3 To view additional low-level category information for the Access category, click the
arrow icon next to Access.
Step 4 Double-click any low-level category to view the list of associated offenses.
The list of offenses appear.

Offense Category Investigation Guide
How do I Investigate an Access Offense? 5
Step 5 Double-click the offense you wish to view.
The details panel appears.
Step 6 To investigate the attacker, view the Attacker Summary box:
•Location - Allows you to determine if the attacker is local or remote:
-Local - This field specifies the network (group) in which it is located.
-Remote - This field specifies the geographic location of the attacker, for
example, Asia. We recommend that you investigate the traffic from the
remote source IP address to make sure that your firewalls are probably
configured to block any threatening traffic. If firewall logs are being sent to

Offense Category Investigation Guide
6ACCESS OFFENSES
STRM, use the Event Viewer to investigate firewall logs to make sure it is
probably configured. For more information on the Event Viewer, see the
STRM Users Guide.
•User - If the attacker is local or a VPN user and STRM is receiving user identity
logs, this field indicates user identity information. This allows you identify the
user who is the source of the traffic. To obtain further information about the
user, right-click on the IP address in the Description field to access additional
menu options. From the menu, select use the Select Information > Asset
Profile. The Asset Profile window allows you to determine additional
information regarding the identify of the source user. You can also determine if
the user associated to the offense is a valid user on the device they are
attempting to access.
STRM generates access events when the same source IP address causes
multiple failed access attempts, such as, from a firewall. If you determine that this
is normal behavior, you can tune STRM to no longer create offenses for this
behavior. For information, see How do I Tune an Access Offense?.
Step 7 Determine if the user associated with the offense was attempting to illegally gain
access to the network or a restricted area of the network. If you determine that the
user had malicious intent:
a Click Flows to further the user’s activity to make sure that the user did not
obtain access to a restricted area of the network.
The Flow Search window appears.
b Use the Event Viewer to search for events relating to this user associated with
firewall accept messages. For more information on the Event Viewer, see Using
the Event Viewer in the STRM Users Guide.

Offense Category Investigation Guide
How do I Tune an Access Offense? 7
Step 8 Once you have determined the impact of the offense, you must perform the
necessary steps to rectify the source of the activity. If you have determined this
behavior is normal, you can tune STRM to no longer detect this activity. For more
information, see How do I Tune an Access Offense?.
Step 9 Once you are satisfied that you have resolved the offense, you can close or hide
the offense.
For more information on closing or hiding an offense, see Investigating Offenses in
the STRM Users Guide.
How do I Tune an
Access Offense? If you determine that the access activity is normal and STRM is creating false
positive offenses, you can tune STRM to make sure no more offenses are created
due to this activity.
To tune access activity using the false positive function:
Step 1 In the offense details interface, click Events.
The List of Events window appears.
Step 2 Select the event that includes the known source IP address that is reported to
produce suspicious activity.
Step 3 Click False Positive.
The False Positive window appears with information derived from the selected
event.

Offense Category Investigation Guide
8ACCESS OFFENSES
Step 4 Select the necessary event properties to tune as a false positive.
Step 5 Click Tune.
STRM will no longer create additional offense for this source IP address when this
type of activity occurs.

Category Offense Investigation Guide
2SIM AUDIT OFFENSES
This chapter provides information on SIM audit offenses including:
•What is SIM Audit?
•How do I Investigate a SIM Audit Offense?
•How do I Tune a SIM Audit Offense?
What is SIM Audit? STRM generates an records SIM audit events for system and configuration
changes occurring within the STRM deployment. This information may be required
for compliance regulations, troubleshooting, or internal tracking.
When STRM detects suspicious or unapproved SIM audit events, a SIM audit
offense is created. STRM is able to monitor SIM audit activity for many different
aspects of the STRM product. In certain situations, this data may also be combined
with other events and flows associated to the attacker, and correlated into one
offense. If an attacker does gain access to the STRM system, they may try and
de-activate certain features or turn monitoring off on certain areas of the network.
These suspicious changes would generate an offense in STRM.
How do I
Investigate a SIM
Audit Offense?
This section provides information on further investigating SIM audit offenses.
To investigate SIM audit offenses:
Step 1 Click the Offense Manager tab.
The Offense Manager window appears.
Step 2 Click By Category from the navigation menu.
The By Category view appears displaying high-level categories. The counts for
each category are accumulated from the values in the low-level categories.
Hint: Only low-level categories with associated offenses appear with an arrow.
You can click the arrow to view the associated low-level categories. If you wish to
view all categories, click Show Inactive Categories.

Category Offense Investigation Guide
10 SIM AUDIT OFFENSES
Step 3 To view additional low-level category information for the SIM Audit category, click
the arrow icon next to SIM Audit.
Step 4 Double-click any low-level category to view the list of associated offenses.
The list of offenses appear.
Step 5 Double-click the offense you wish to view.
The details panel appears.
Step 6 View the Attacker Summary box to understand the attacker:
•Location - Allows you to determine if the attacker is local or remote:
-Local - This field specifies the network (group) in which it is located.
-Remote - This field specifies the geographic location of the attacker, for
example, Asia. We recommend that you investigate the traffic from the
remote source IP address to make sure that your firewalls are probably
configured to block any threatening traffic. If firewall logs are being sent to
STRM, use the Event Viewer to investigate firewall logs to make sure it is
probably configured. For more information on the Event Viewer, see the
STRM Users Guide.

Category Offense Investigation Guide
How do I Investigate a SIM Audit Offense? 11
•User - If the attacker is local or a VPN user and STRM is receiving user identity
logs, this field indicates user identity information. This allows you identify the
user who is the source of the suspicious traffic. To obtain further information
about the user, right-click on the IP address in the Description field to access
additional menu options. From the menu, select use the Select Information >
Asset Profile. The Asset Profile window allows you to determine additional
information regarding the identify of the source user.
If the activity is normal (for example, a valid user is making approved configuration
changes to the STRM deployment), then you can use the Rules function in the
Offense Manager to tune out this activity. For more information, see How do I Tune
a SIM Audit Offense?.
Step 7 In the Attacker Summary box, place your mouse over the Description text. If the
number of offenses is greater than 1, we recommend that you investigate the
attacker to determine if the attacker is attempting to disguise his activities from
other offenses. Unauthorized changes to your STRM deployment can lead to
serious threats and attacks to the network being undetected.
Step 8 Click Events.
The List of Events appears for the selected offense.
The Device column provides the device that detected the event. If multiple devices
are reporting similar events, the credibility value for this offense increases.
Step 9 To further investigate the target, right-click on an IP address in the Source column.
The right-click menu appears.
Step 10 Select Information > Asset Profile.
The Asset Profile appears.

Category Offense Investigation Guide
12 SIM AUDIT OFFENSES
Step 11 Once you have determined the impact of the offense, you must either block the
source of the unauthorized configuration activity, then take the desired action
against the offense.
Step 12 Once you have resolved the offense, close or hide the offense.
For more information on closing or hiding an offense, see the STRM Users Guide.
How do I Tune a
SIM Audit Offense? If you determine that the SIM audit activity is normal and STRM is creating false
positive offenses, you can tune STRM to make sure no more offenses are created
due to this activity.
You can tune STRM using one of the following methods:
•Tuning Using False Positive Function
•Tuning Using Custom Rules Wizard
Tuning Using False
Positive Function To tune SIM audit activity using the false positive function:
Step 1 In the SIM audit offense details interface, click Events.
The List of Events appears for the selected offense.

Category Offense Investigation Guide
How do I Tune a SIM Audit Offense? 13
Step 2 Select the event with the source IP address known to be producing the SIM audit
activity.
Step 3 Click False Positive.
The False Positive window appears with information derived from the selected
event.
Step 4 Select the necessary event properties to tune as a false positive.
For example, in the window above, the Events with specific QID option is selected
to tune the specific IP address and the event high-level category that is creating
the false positive SIM audit event.
For additional information on using the False Positive tuning function, see the
STRM Users Guide.
Step 5 Click Tune.
STRM will no longer create additional offenses for this source IP address when
performing normal VA or network management tasks.

Category Offense Investigation Guide
14 SIM AUDIT OFFENSES
Tuning Using Custom
Rules Wizard To tune SIM audit activity using the custom rules wizard:
Step 1 In the navigation bar of the Offense Manager, click Rules.
The Rules interface appears.
Step 2 Using the Display drop-down list box, select Building Blocks.
Step 3 In the Block Name list, locate the Default-BB-HostDefinition: VA Scanner
Source IP building block.
Step 4 From the Actions drop-down list box, select Edit.
The Rules Wizard appears.
Step 5 In the Building Block section, click the IP address that appears.
A configuration window appears.