research and create detectors for items from the Known Exploited Vulnerabilities Catalog

[mmguero]

Links

• Known Exploited Vulnerabilities Catalog
• CISA Known Exploited Vulnerabilities (KEV) Catalog for CISA ICS Advisories Dashboard
• ICS Advisory Project

Summary

It would be valuable for the Malcolm development team to identify ICS-focused vulnerabilities specified in the CISA KEV catalog and create detectors for them. Most likely these would be in the form of Zeek notices, although we also have Suricata, YARA, the anomaly detection plugin, potentially Sigma (see #162), or anything else at our disposal to do so.

As we identify items from the KEV catalog, we should create individual bugs for each of them that reference back to this issue.

[mmguero]

@IdahoManny our DHS lead suggested looking at "this zyxel vuln" as a good option for KEV detection

[mmguero]

This might be a resource worth looking at: https://networkforensic.dk/SNORT/

[IdahoManny]

Hello Seth,
Suricata tested rules have been created based on the Zyxel SektorCERT Report. Ran into issues with the creation of Zeek notices. I've created some, but they would not validate when testing. I will have to do more research on Zeek notices.
Tested-snort-suricata-SektorCERT-rules.txt

[mmguero]

We're going to track these individually going forward. As new detectors/rules are developed, create individual rules for the KEV/CVE.

[IdahoManny]

Hello Seth, from email, I've attached Suricata Snort rules for CVE-2023-6448.
snort_cve-2023-6448rules.txt
suricata_cve-2023-6448rules.txt