[errcode: sc_err_invalid_signature(39)]

Security
1

Since I have my log viewer working again I have found another issue. This one may be bad. It says I have a trojan and the suricata rules contain cobaltstrike.ja3; classtype:command-and-control. Is this a bug or is my system compromised? Here is a section of my log file:

02:47:29 suricata: [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature “drop tls $EXTERNAL_NET any → $HOME_NET any (msg:“ET JA3 Hash - Suspected Cobalt Strike Malleable C2 (ja3s) M1”; flow:established,from_server; ja3s.hash; content:“649d6810e8392f63dc311eecb6b7098b”; tls.cert_subject; content:!“servicebus.windows.net”; flowbits:isset,ET.cobaltstrike.ja3; classtype:command-and-control; sid:2028832; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at
2019_10_15, deployment Perimeter, former_category JA3, malware_family Cobalt_Strike, signature_severity Major, updated_at 2019_10_15;)” from file /var/lib/suricata/emerging-ja3.rules at line 43
02:47:29 suricata: [ERRCODE: SC_WARN_JA3_DISABLED(309)] - ja3(s) support is not enabled

and another section:

02:47:29 suricata: [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature “alert tls $HOME_NET any → $EXTERNAL_NET any (msg:“ET JA3 Hash - Suspected Cobalt Strike Malleable C2 M1 (set)”; flow:established,to_server; ja3.hash; content:“eb88d0b3e1961a0562f006e5ce2a0b87”; ja3.string; content:“771,49192-49191-49172-49171”; flowbits:set,ET.cobaltstrike.ja3; flowbits:noalert; classtype:command-and-control; sid:2028831; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_10_15, deployment Perimeter, former_category JA3, malware_family Cobalt_Strike, signature_severity Major, updated_at 2019_10_15;)” from file /var/lib/suricata/emerging-ja3.rules at line 41.

It appears my system is compromised. If it is, how do I prevent this from happening again if I wipe and reinstall? Any answers will be greatly appreciated. This is an issue of the kind that I will need all the help I can get. Thank you in advance for any replies.

2

This part of the message is saying that suricata is having a problem parsing a signature that you have selected.

Then the following part

is saying that it comes from the emerging-ja3.rules that you have selected and that ja3 support is not enabled in IPFire.

So I don’t believe you have been compromised you just need to unselect the emerging-ja3.rules on the IPS WUI page to stop the error messages in your logs.

The lack of ja3 support has been raised as a bug.

https://bugzilla.ipfire.org/show_bug.cgi?id=12536

1 Like
3

Thank you! That was the solution. Now that I have my log files accessible I am finding all kinds of errors. I will try to fix without asking for help. My next issue is error: SERVFAIL <_adsp._domainkey.email.ea.com. TXT IN>: all the configured stu b or forward servers failed, at zone in the unbound logs. I think I can fix that one myself. I must say that this forum is one of the best for help I’ve ever experienced. Thank you again for all your help.

1 Like