ridzimeko / TA Suricata Ruleset

# --- SSH SCAN & BRUTEFORCE --- alert ssh any any -> $HOME_NET 22 (msg:"ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack"; flow:established,to_server; content:"SSH-"; content:"libssh"; within:20; threshold: type both, count 5, seconds 30, track by_src; classtype:attempted-admin; sid:2006546; rev:9; metadata:created_at 2010_07_30, confidence Medium, signature_severity Informational, updated_at 2019_07_26;) alert ssh any any -> $HOME_NET any (msg:"ET SCAN SSH BruteForce Tool with fake PUTTY version"; flow:established,to_server; ssh_proto; content:"PUTTY"; threshold: type limit, track by_src, count 1, seconds 30; classtype:network-scan; sid:2019876; rev:6; metadata:created_at 2014_12_05, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;) alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"SSH Brute Force Connection Pattern"; flow:to_server; flags:S,12; threshold: type both, track by_src, count 20, seconds 120; reference:url,en.wikipedia.org/wiki/Brute_force_attack; classtype:attempted-recon; sid:2001219; rev:20; metadata:created_at 2010_07_30, confidence Medium, signature_severity Informational, updated_at 2019_07_26;) # --- PORT SCANNING RULES --- # SCAN SYN (GENERAL) alert tcp any any -> $HOME_NET any (msg:"SCAN Nmap SYN scan detected"; flags:S,12; threshold: type threshold, track by_src, count 1000, seconds 10; classtype:attempted-recon; sid:1000001; rev:1;) # SCAN OS alert udp any 10000: -> $HOME_NET 10000: (msg:"ET SCAN NMAP OS Detection Probe"; dsize:300; content:"CCCCCCCCCCCCCCCCCCCC"; fast_pattern; content:"CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"; depth:255; content:"CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"; within:45; classtype:attempted-recon; sid:2018489; rev:4; metadata:created_at 2014_05_21, confidence Low, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_10_08;) # Nmap NSE alert http any any -> $HOME_NET any (msg:"ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap Scripting Engine)"; flow:to_server,established; http.user_agent; content:"Mozilla/5.0 (compatible|3b| Nmap Scripting Engine"; nocase; depth:46; classtype:web-application-attack; sid:2009358; rev:6; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, updated_at 2020_04_22;) alert http any any -> $HOME_NET any (msg:"ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap NSE)"; flow:to_server,established; http.user_agent; content:"Nmap NSE"; classtype:web-application-attack; sid:2009359; rev:5; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, updated_at 2020_05_04;) # NULL SCAN alert tcp any any -> $HOME_NET any ( msg:"POSSIBLE TCP NULL SCAN"; flow:stateless; flags:0; threshold:type threshold, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:3400041; rev:1; ) # FIN SCAN alert tcp any any -> $HOME_NET any ( msg:"POSSIBLE TCP FIN SCAN"; flow:stateless; flags:F; threshold:type threshold, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:3400042; rev:1; ) # IP PROTOCOL SCAN alert icmp any any -> $HOME_NET any ( msg:"POSSIBLE IP PROTOCOL SCAN RESPONSE"; itype:3; icode:2; threshold:type threshold, track by_dst, count 3, seconds 60; classtype:attempted-recon; sid:3400043; rev:1; ) # SYN SCAN -sS (speeds T1-T5) alert tcp any any -> $HOME_NET [21,22,23,25,53,80,88,110,135,137,138,139,143,161,389,443,445,465,514,587,636,853,993,995,1194,1433,1720,3306,3389,8080,8443,11211,27017,51820] (msg:"POSSBL PORT SCAN (NMAP -sS)"; flow:to_server,stateless; flags:S; window:1024; tcp.mss:1460; threshold:type threshold, track by_src, count 20, seconds 70; classtype:attempted-recon; sid:3400001; priority:2; rev:1;) alert tcp any any -> $HOME_NET ![21,22,23,25,53,80,88,110,135,137,138,139,143,161,389,443,445,465,514,587,636,853,993,995,1194,1433,1720,3306,3389,8080,8443,11211,27017,51820] (msg:"POSSBL PORT SCAN (NMAP -sS)"; flow:to_server,stateless; flags:S; window:1024; tcp.mss:1460; threshold:type threshold, track by_src, count 7, seconds 135; classtype:attempted-recon; sid:3400002; priority:2; rev:2;) # SYN-ACK 3-WAY SCAN -sT (speeds T2-T5) alert tcp any ![22,25,53,80,88,143,443,445,465,587,853,993,1194,8080,51820] -> any ![22,25,53,80,88,143,443,445,465,587,853,993,1194,8080,51820] (msg:"POSSBL PORT SCAN (NMAP -sT)"; flow:to_server; window:32120; flags:S; threshold:type threshold, track by_src, count 20, seconds 70; classtype:attempted-recon; sid:3400003; rev:3;) # ACK SCAN -sA (speeds T2-T5) alert tcp any ![22,25,53,80,88,143,443,445,465,587,853,993,1194,8080,51820] -> any ![22,25,53,80,88,143,443,445,465,587,853,993,1194,8080,51820] (msg:"POSSBL PORT SCAN (NMAP -sA)"; flags:A; flow:stateless; threshold:type threshold, track by_dst, count 20, seconds 70; classtype:attempted-recon; sid:3400004; priority:2; rev:5;) # CHRISTMAS TREE SCAN -sX (speeds T1-T5) alert tcp any any -> $HOME_NET any (msg:"POSSBL PORT SCAN (NMAP -sX)"; flags:FPU; flow:to_server,stateless; threshold:type threshold, track by_src, count 3, seconds 120; classtype:attempted-recon; sid:3400005; rev:2;) # FRAGMENTED SCAN -f (speeds T1-T5) alert ip any any -> $HOME_NET any (msg:"POSSBL SCAN FRAG (NMAP -f)"; fragbits:M+D; threshold:type limit, track by_src, count 3, seconds 1210; classtype:attempted-recon; sid:3400006; priority:2; rev:6;) # UDP SCAN -sU (speeds T1-T5) alert udp any any -> $HOME_NET [53,67,68,69,123,161,162,389,520,1026,1027,1028,1029,1194,1434,1900,11211,12345,27017,51820] (msg:"POSSBL PORT SCAN (NMAP -sU)"; flow:to_server,stateless; classtype:attempted-recon; sid:3400007; priority:2; rev:6; threshold:type threshold, track by_src, count 20, seconds 70; dsize:0;) alert udp any any -> $HOME_NET ![53,67,68,69,123,161,162,389,520,1026,1027,1028,1029,1194,1434,1900,11211,12345,27017,51820] (msg:"POSSBL PORT SCAN (NMAP -sU)"; flow:to_server,stateless; classtype:attempted-recon; sid:3400008; priority:2; rev:6; threshold:type threshold, track by_src, count 20, seconds 135; dsize:0;) # SQL Injection alert http any any -> $HOME_NET any ( msg:"Possible SQL Injection in URI"; flow:to_server,established; http.uri; pcre:"/(\%27|'|--|\%23|#|\bOR\b|\bAND\b).*(=|\bLIKE\b|\bUNION\b|\bSELECT\b|\bSLEEP\b|\bBENCHMARK\b)/Ui"; threshold:type limit, track by_src, count 1, seconds 60; classtype:web-application-attack; sid:1000401; rev:1; ) alert http any any -> $HOME_NET any ( msg:"Possible SQL Injection in POST Body"; flow:to_server,established; http.method; content:"POST"; http.request_body; pcre:"/(\%27|'|--|\%23|#|\bOR\b|\bAND\b).*(=|\bLIKE\b|\bUNION\b|\bSELECT\b|\bSLEEP\b|\bBENCHMARK\b)/Ui"; threshold:type limit, track by_src, count 1, seconds 60; classtype:web-application-attack; sid:1000402; rev:1; ) # Mendeteksi XSS di URL (GET parameter) alert http any any -> $HOME_NET $HTTP_PORTS (msg:"Possible XSS Attempt (Script Tag in URI)"; flow:to_server,established; http.uri; pcre:"/(%3C|<)script.*(%3E|>)/i"; classtype:web-application-attack; sid:5000001; rev:1;) # Mendeteksi XSS dari Form Data (POST Body) alert http any any -> $HOME_NET $HTTP_PORTS (msg:"Possible XSS Attempt in POST Body"; flow:to_server,established; http.request_body; pcre:"/(%3C|<)script.*(%3E|>)/i"; classtype:web-application-attack; sid:5000002; rev:1;) # Mendeteksi XSS berbasis event handler seperti onerror= atau onload= alert http any any -> $HOME_NET $HTTP_PORTS (msg:"Possible XSS Attempt (Event Handler)"; flow:to_server,established; http.uri; pcre:"/(on[a-z]+)\s*=/i"; classtype:web-application-attack; sid:5000003; rev:1;) # HTTP GET Flood (L7 DoS): Membanjiri Web Server dengan request secara ekstrim alert http any any -> $HOME_NET any ( msg:"Possible HTTP DoS - High HTTP Request Rate"; flow:to_server,established; threshold:type both, track by_src, count 100, seconds 10; classtype:attempted-dos; sid:1000202; rev:1; )