Security Onion 2.3.91 Now Available including Elastic 7.16.2 and Log4j 2.17.0!

We recently released Security Onion 2.3.90 and a few hotfixes:
https://blog.securityonion.net/2021/11/security-onion-2390-now-available.html
https://docs.securityonion.net/en/2.3/release-notes.html#hotfix-wazuh
https://docs.securityonion.net/en/2.3/release-notes.html#hotfix-airgapfix
https://docs.securityonion.net/en/2.3/release-notes.html#hotfix-20211206
https://docs.securityonion.net/en/2.3/release-notes.html#hotfix-20211210
https://docs.securityonion.net/en/2.3/release-notes.html#hotfix-20211213

Today, we are releasing Security Onion 2.3.91:
https://docs.securityonion.net/en/2.3/release-notes.html#changes

If you haven't updated recently, then you should review all links above so that you are aware of all recent changes.

Summary

Several vulnerabilities were recently announced in log4j:
https://logging.apache.org/log4j/2.x/security.html

We released an initial hotfix on 2021/12/10:
https://docs.securityonion.net/en/2.3/release-notes.html#hotfix-20211210

Elastic later released additional details:
https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476

We then released a second hotfix on 2021/12/13:
https://docs.securityonion.net/en/2.3/release-notes.html#hotfix-20211213

Today's 2.3.91 release updates to Elastic 7.16.2 which includes Log4j 2.17.0:
https://www.elastic.co/blog/new-elasticsearch-and-logstash-releases-upgrade-apache-log4j2

Known Upgrade Issues

Since we are moving from Elastic 7.15 to 7.16, please be aware that custom settings in Kibana may be overwritten during upgrade.

If soup displays the following message:

warning: setlocale: LC_CTYPE: cannot change locale (en_US.UTF-8): No such file or directory

then you may need to run the following command:

sudo locale-gen en_US.UTF-8

For more information, please see:
https://github.com/Security-Onion-Solutions/securityonion/issues/6599 

After soup completes, if you run a vulnerability scanner against the filesystem, it may find older versions of log4j in the older unused Docker images. Soup updates always keep the previous version of Docker images, so these will automatically be removed at the next Docker image update.

Internet-Connected Deployments

If your Security Onion deployment has Internet access, simply run "sudo soup" as described here:
https://docs.securityonion.net/en/2.3/soup.html

Airgap Deployments

If you have an airgap deployment, download the new ISO image from the usual location:
https://securityonion.net/download

Then follow the steps here:
https://docs.securityonion.net/en/2.3/airgap.html#security-onion-version-updates

Security Onion 16.04

If you are still running Security Onion 16.04, please note that it is past End Of Life. Please take this opportunity to upgrade to Security Onion 2:
https://docs.securityonion.net/en/2.3/appendix.html

Questions or Problems

If you have questions or problems, please see our community support forum guidelines:
https://docs.securityonion.net/en/2.3/community-support.html

You can then find the community support forum at:
https://securityonion.net/discuss

Quick Malware Analysis: Hancitor with Cobalt Strike pcap from 2021-12-16

Thanks to Brad Duncan for sharing this pcap!
https://www.malware-traffic-analysis.net/2021/12/16/index.html

We did a quick analysis of this pcap on the latest version of Security Onion via so-import-pcap:
https://docs.securityonion.net/en/2.3/so-import-pcap.html

Below are some of the interesting Suricata alerts, Zeek logs, and session transcripts.

About Security Onion

Security Onion is a versatile and scalable platform that can run on small virtual machines and can also scale up to the opposite end of the hardware spectrum to take advantage of extremely powerful server-class machines.  Security Onion can also scale horizontally, growing from a standalone single-machine deployment to a full distributed deployment with tens or hundreds of machines as dictated by your enterprise visibility needs.

To learn more about Security Onion, please see:
https://securityonion.net
https://securityonion.net/docs

More Samples

Find all of our Quick Malware posts at:
https://blog.securityonion.net/search/label/quick%20malware%20analysis

Screenshots

Quick Malware Analysis: Contact Forms IcedID with Cobalt Strike and DarkVNC pcap from 2021-12-13

Thanks to Brad Duncan for sharing this pcap!
https://www.malware-traffic-analysis.net/2021/12/13/index.html

We did a quick analysis of this pcap on the latest version of Security Onion via so-import-pcap:
https://docs.securityonion.net/en/2.3/so-import-pcap.html

Below are some of the interesting Suricata alerts, Zeek logs, and session transcripts.

About Security Onion

Security Onion is a versatile and scalable platform that can run on small virtual machines and can also scale up to the opposite end of the hardware spectrum to take advantage of extremely powerful server-class machines.  Security Onion can also scale horizontally, growing from a standalone single-machine deployment to a full distributed deployment with tens or hundreds of machines as dictated by your enterprise visibility needs.

To learn more about Security Onion, please see:
https://securityonion.net
https://securityonion.net/docs

More Samples

Find all of our Quick Malware posts at:
https://blog.securityonion.net/search/label/quick%20malware%20analysis

Screenshots

Quick Malware Analysis: Contact Forms Bazarloader with Cobalt Strike pcap from 2021-12-03

Thanks to Brad Duncan for sharing this pcap!
https://www.malware-traffic-analysis.net/2021/12/03/index.html

We did a quick analysis of this pcap on the latest version of Security Onion via so-import-pcap:
https://docs.securityonion.net/en/2.3/so-import-pcap.html

Below are some of the interesting Suricata alerts, Zeek logs, and session transcripts.

About Security Onion

Security Onion is a versatile and scalable platform that can run on small virtual machines and can also scale up to the opposite end of the hardware spectrum to take advantage of extremely powerful server-class machines.  Security Onion can also scale horizontally, growing from a standalone single-machine deployment to a full distributed deployment with tens or hundreds of machines as dictated by your enterprise visibility needs.

To learn more about Security Onion, please see:
https://securityonion.net
https://securityonion.net/docs

More Samples

Find all of our Quick Malware posts at:
https://blog.securityonion.net/search/label/quick%20malware%20analysis

Screenshots

10% Early Bird discount for 4-day Security Onion 2 Fundamentals for Analysts and Admins

We've scheduled the next public run of our 4-day Security Onion 2 Fundamentals for Analysts and Admins training class!

Use promo code earlybird by January 14, 2022 to receive 10% off!

For more details and to register, please see:
https://securityonionsolutions.com/livetraining

If you have any questions, please use the Contact link on the bottom of the Eventbrite page.

Thanks!

Quick Malware Analysis: TA551-SHATHAK-ICEDID-BOKBOT with Cobalt Strike and DarkVNC pcap from 2021-12-10

Thanks to Brad Duncan for sharing this pcap!
https://www.malware-traffic-analysis.net/2021/12/10/index.html

We did a quick analysis of this pcap on the latest version of Security Onion via so-import-pcap:
https://docs.securityonion.net/en/2.3/so-import-pcap.html

Below are some of the interesting Suricata alerts, Zeek logs, and session transcripts.

About Security Onion

Security Onion is a versatile and scalable platform that can run on small virtual machines and can also scale up to the opposite end of the hardware spectrum to take advantage of extremely powerful server-class machines.  Security Onion can also scale horizontally, growing from a standalone single-machine deployment to a full distributed deployment with tens or hundreds of machines as dictated by your enterprise visibility needs.

To learn more about Security Onion, please see:
https://securityonion.net
https://securityonion.net/docs

More Samples

Find all of our Quick Malware posts at:
https://blog.securityonion.net/search/label/quick%20malware%20analysis

Screenshots