ridzimeko / Suricata Ruleset

0 likes
0 forks
2 files
Last active 1765242514
1 #alert tcp any any -> $HOME_NET any ( msg:"POTENSI DDoS SYN Flood"; flags:S; flow:stateless; threshold:type both, track by_dst, count 1000, seconds 10; classtype:attempted-dos; priority:2; sid:2000012; rev:1; )
2 alert arp any any -> any any ( msg:"POTENSI ARP Spoofing - ARP Reply mencurigakan"; arp_opcode:2; # opcode 2 = ARP reply detection_filter:track by_src, count 5, seconds 10; classtype:network-scan; priority:2; sid:2000013; rev:1; )
3 alert tcp !$HOME_NET any -> $HOME_NET any (flags: A; msg:"Possible ACK DoS"; flow: stateless; threshold: type both, track by_dst, count 1000, seconds 3; classtype:attempted-dos; sid:10001;rev:1;)
4 alert tcp !$HOME_NET any -> $HOME_NET any (flags: R; msg:"Possible RST DoS"; flow: stateless; threshold: type both, track by_dst, count 1000, seconds 3; classtype:attempted-dos; sid:10003;rev:1;)
5 alert tcp !$HOME_NET any -> $HOME_NET any (flags: F; msg:"Possible FIN DoS"; flow: stateless; threshold: type both, track by_dst, count 1000, seconds 3; classtype:attempted-dos; sid:10004;rev:1;)
6 alert udp !$HOME_NET any -> $HOME_NET any (msg:"Possible UDP DoS"; flow: stateless; threshold: type both, track by_dst, count 1000, seconds 3; classtype:attempted-dos; sid:10005;rev:1;)
7
8 # SYN SCAN -sS (speeds T1-T5)
9
10 alert tcp any any -> any [21,22,23,25,53,80,88,110,135,137,138,139,143,161,389,443,445,465,514,587,636,853,993,995,1194,1433,1720,3306,3389,8080,8443,11211,27017,51820] (msg:"POSSBL PORT SCAN (NMAP -sS)"; flow:to_server,stateless; flags:S; window:1024; tcp.mss:1460; threshold:type threshold, track by_src, count 20, seconds 70; classtype:attempted-recon; sid:3400001; priority:2; rev:1;)
Newer Older