喜欢 0
派生 0

最后活跃于 1787098967

ridzimeko 修订了这个 Gist 1787098967. 跳至此修订

1 file changed, 60 insertions

gistfile1.txt(file created)

@@ -0,0 +1,60 @@
1 + # --- SSH SCAN & BRUTEFORCE ---
2 + alert ssh any any -> $HOME_NET 22 (msg:"ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack"; flow:established,to_server; content:"SSH-"; content:"libssh"; within:20; threshold: type both, count 5, seconds 30, track by_src; classtype:attempted-admin; sid:2006546; rev:9; metadata:created_at 2010_07_30, confidence Medium, signature_severity Informational, updated_at 2019_07_26;)
3 + alert ssh any any -> $HOME_NET any (msg:"ET SCAN SSH BruteForce Tool with fake PUTTY version"; flow:established,to_server; ssh_proto; content:"PUTTY"; threshold: type limit, track by_src, count 1, seconds 30; classtype:network-scan; sid:2019876; rev:6; metadata:created_at 2014_12_05, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
4 + alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"SSH Brute Force Connection Pattern"; flow:to_server; flags:S,12; threshold: type both, track by_src, count 20, seconds 120; reference:url,en.wikipedia.org/wiki/Brute_force_attack; classtype:attempted-recon; sid:2001219; rev:20; metadata:created_at 2010_07_30, confidence Medium, signature_severity Informational, updated_at 2019_07_26;)
5 +
6 + # --- PORT SCANNING RULES ---
7 + # SCAN SYN (GENERAL)
8 + alert tcp any any -> $HOME_NET any (msg:"SCAN Nmap SYN scan detected"; flags:S,12; threshold: type threshold, track by_src, count 1000, seconds 10; classtype:attempted-recon; sid:1000001; rev:1;)
9 +
10 + # SCAN OS
11 + alert udp any 10000: -> $HOME_NET 10000: (msg:"ET SCAN NMAP OS Detection Probe"; dsize:300; content:"CCCCCCCCCCCCCCCCCCCC"; fast_pattern; content:"CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"; depth:255; content:"CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"; within:45; classtype:attempted-recon; sid:2018489; rev:4; metadata:created_at 2014_05_21, confidence Low, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_10_08;)
12 +
13 + # Nmap NSE
14 + alert http any any -> $HOME_NET any (msg:"ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap Scripting Engine)"; flow:to_server,established; http.user_agent; content:"Mozilla/5.0 (compatible|3b| Nmap Scripting Engine"; nocase; depth:46; classtype:web-application-attack; sid:2009358; rev:6; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, updated_at 2020_04_22;)
15 + alert http any any -> $HOME_NET any (msg:"ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap NSE)"; flow:to_server,established; http.user_agent; content:"Nmap NSE"; classtype:web-application-attack; sid:2009359; rev:5; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, updated_at 2020_05_04;)
16 +
17 + # NULL SCAN
18 + alert tcp any any -> $HOME_NET any ( msg:"POSSIBLE TCP NULL SCAN"; flow:stateless; flags:0; threshold:type threshold, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:3400041; rev:1; )
19 +
20 + # FIN SCAN
21 + alert tcp any any -> $HOME_NET any ( msg:"POSSIBLE TCP FIN SCAN"; flow:stateless; flags:F; threshold:type threshold, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:3400042; rev:1; )
22 +
23 + # IP PROTOCOL SCAN
24 + alert icmp any any -> $HOME_NET any ( msg:"POSSIBLE IP PROTOCOL SCAN RESPONSE"; itype:3; icode:2; threshold:type threshold, track by_dst, count 3, seconds 60; classtype:attempted-recon; sid:3400043; rev:1; )
25 +
26 + # SYN SCAN -sS (speeds T1-T5)
27 + alert tcp any any -> $HOME_NET [21,22,23,25,53,80,88,110,135,137,138,139,143,161,389,443,445,465,514,587,636,853,993,995,1194,1433,1720,3306,3389,8080,8443,11211,27017,51820] (msg:"POSSBL PORT SCAN (NMAP -sS)"; flow:to_server,stateless; flags:S; window:1024; tcp.mss:1460; threshold:type threshold, track by_src, count 20, seconds 70; classtype:attempted-recon; sid:3400001; priority:2; rev:1;)
28 + alert tcp any any -> $HOME_NET ![21,22,23,25,53,80,88,110,135,137,138,139,143,161,389,443,445,465,514,587,636,853,993,995,1194,1433,1720,3306,3389,8080,8443,11211,27017,51820] (msg:"POSSBL PORT SCAN (NMAP -sS)"; flow:to_server,stateless; flags:S; window:1024; tcp.mss:1460; threshold:type threshold, track by_src, count 7, seconds 135; classtype:attempted-recon; sid:3400002; priority:2; rev:2;)
29 +
30 + # SYN-ACK 3-WAY SCAN -sT (speeds T2-T5)
31 + alert tcp any ![22,25,53,80,88,143,443,445,465,587,853,993,1194,8080,51820] -> any ![22,25,53,80,88,143,443,445,465,587,853,993,1194,8080,51820] (msg:"POSSBL PORT SCAN (NMAP -sT)"; flow:to_server; window:32120; flags:S; threshold:type threshold, track by_src, count 20, seconds 70; classtype:attempted-recon; sid:3400003; rev:3;)
32 +
33 + # ACK SCAN -sA (speeds T2-T5)
34 + alert tcp any ![22,25,53,80,88,143,443,445,465,587,853,993,1194,8080,51820] -> any ![22,25,53,80,88,143,443,445,465,587,853,993,1194,8080,51820] (msg:"POSSBL PORT SCAN (NMAP -sA)"; flags:A; flow:stateless; threshold:type threshold, track by_dst, count 20, seconds 70; classtype:attempted-recon; sid:3400004; priority:2; rev:5;)
35 +
36 + # CHRISTMAS TREE SCAN -sX (speeds T1-T5)
37 + alert tcp any any -> $HOME_NET any (msg:"POSSBL PORT SCAN (NMAP -sX)"; flags:FPU; flow:to_server,stateless; threshold:type threshold, track by_src, count 3, seconds 120; classtype:attempted-recon; sid:3400005; rev:2;)
38 +
39 + # FRAGMENTED SCAN -f (speeds T1-T5)
40 + alert ip any any -> $HOME_NET any (msg:"POSSBL SCAN FRAG (NMAP -f)"; fragbits:M+D; threshold:type limit, track by_src, count 3, seconds 1210; classtype:attempted-recon; sid:3400006; priority:2; rev:6;)
41 +
42 + # UDP SCAN -sU (speeds T1-T5)
43 + alert udp any any -> $HOME_NET [53,67,68,69,123,161,162,389,520,1026,1027,1028,1029,1194,1434,1900,11211,12345,27017,51820] (msg:"POSSBL PORT SCAN (NMAP -sU)"; flow:to_server,stateless; classtype:attempted-recon; sid:3400007; priority:2; rev:6; threshold:type threshold, track by_src, count 20, seconds 70; dsize:0;)
44 + alert udp any any -> $HOME_NET ![53,67,68,69,123,161,162,389,520,1026,1027,1028,1029,1194,1434,1900,11211,12345,27017,51820] (msg:"POSSBL PORT SCAN (NMAP -sU)"; flow:to_server,stateless; classtype:attempted-recon; sid:3400008; priority:2; rev:6; threshold:type threshold, track by_src, count 20, seconds 135; dsize:0;)
45 +
46 + # SQL Injection
47 + alert http any any -> $HOME_NET any ( msg:"Possible SQL Injection in URI"; flow:to_server,established; http.uri; pcre:"/(\%27|'|--|\%23|#|\bOR\b|\bAND\b).*(=|\bLIKE\b|\bUNION\b|\bSELECT\b|\bSLEEP\b|\bBENCHMARK\b)/Ui"; threshold:type limit, track by_src, count 1, seconds 60; classtype:web-application-attack; sid:1000401; rev:1; )
48 + alert http any any -> $HOME_NET any ( msg:"Possible SQL Injection in POST Body"; flow:to_server,established; http.method; content:"POST"; http.request_body; pcre:"/(\%27|'|--|\%23|#|\bOR\b|\bAND\b).*(=|\bLIKE\b|\bUNION\b|\bSELECT\b|\bSLEEP\b|\bBENCHMARK\b)/Ui"; threshold:type limit, track by_src, count 1, seconds 60; classtype:web-application-attack; sid:1000402; rev:1; )
49 +
50 + # Mendeteksi XSS di URL (GET parameter)
51 + alert http any any -> $HOME_NET $HTTP_PORTS (msg:"Possible XSS Attempt (Script Tag in URI)"; flow:to_server,established; http.uri; pcre:"/(%3C|<)script.*(%3E|>)/i"; classtype:web-application-attack; sid:5000001; rev:1;)
52 +
53 + # Mendeteksi XSS dari Form Data (POST Body)
54 + alert http any any -> $HOME_NET $HTTP_PORTS (msg:"Possible XSS Attempt in POST Body"; flow:to_server,established; http.request_body; pcre:"/(%3C|<)script.*(%3E|>)/i"; classtype:web-application-attack; sid:5000002; rev:1;)
55 +
56 + # Mendeteksi XSS berbasis event handler seperti onerror= atau onload=
57 + alert http any any -> $HOME_NET $HTTP_PORTS (msg:"Possible XSS Attempt (Event Handler)"; flow:to_server,established; http.uri; pcre:"/(on[a-z]+)\s*=/i"; classtype:web-application-attack; sid:5000003; rev:1;)
58 +
59 + # HTTP GET Flood (L7 DoS): Membanjiri Web Server dengan request secara ekstrim
60 + alert http any any -> $HOME_NET any ( msg:"Possible HTTP DoS - High HTTP Request Rate"; flow:to_server,established; threshold:type both, track by_src, count 100, seconds 10; classtype:attempted-dos; sid:1000202; rev:1; )
更新 更早

由 Opengist 强力驱动 ⋅ Load: 9ms⋅

中文