File indexing completed on 2024-05-12 04:02:10
0001 <!DOCTYPE html> 0002 <html><head> 0003 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> 0004 <title>test.suricata</title> 0005 <meta name="generator" content="KF5::SyntaxHighlighting - Definition (Snort/Suricata) - Theme (Breeze Light)"/> 0006 </head><body style="background-color:#ffffff;color:#1f1c1b"><pre> 0007 <span style="color:#898887"># Suricata Samples</span> 0008 <span style="color:#898887"># See: https://suricata.readthedocs.io/en/latest/rules/intro.html</span> 0009 0010 <span style="font-weight:bold">drop</span> <span style="font-weight:bold">tcp</span> <span style="font-weight:bold">$HOME_NET</span> <span style="font-weight:bold">any</span> -> <span style="font-weight:bold">$EXTERNAL_NET</span> <span style="font-weight:bold">any</span> (<span style="font-weight:bold">msg</span>:<span style="color:#bf0303">”ET TROJAN Likely Bot Nick in IRC (USA +..)”</span>; <span style="font-weight:bold">flow</span>:established,to_server; <span style="font-weight:bold">flowbits</span>:isset,is_proto_irc; <span style="font-weight:bold">content</span>:<span style="color:#bf0303">”NICK ”</span>; <span style="font-weight:bold">pcre</span>:<span style="color:#bf0303">”/NICK .*USA.*[0-9]{3,}/i”</span>; <span style="font-weight:bold">reference</span>:url,doc.emergingthreats.net/<span style="color:#b08000">2008124</span>; <span style="font-weight:bold">classtype</span>:trojan-activity; <span style="font-weight:bold">sid</span>:<span style="color:#b08000">2008124</span>; <span style="font-weight:bold">rev</span>:<span style="color:#b08000">2</span>;) 0011 0012 <span style="font-weight:bold">alert</span> <span style="font-weight:bold">tcp</span> <span style="color:#b08000">1</span>.<span style="color:#b08000">2</span>.<span style="color:#b08000">3</span>.<span style="color:#b08000">4</span> <span style="color:#b08000">1024</span> -> <span style="color:#b08000">5</span>.<span style="color:#b08000">6</span>.<span style="color:#b08000">7</span>.<span style="color:#b08000">8</span> <span style="color:#b08000">80</span> 0013 0014 <span style="font-weight:bold">alert</span> <span style="font-weight:bold">http</span> <span style="font-weight:bold">any</span> <span style="font-weight:bold">any</span> -> <span style="font-weight:bold">any</span> <span style="font-weight:bold">any</span> (<span style="font-weight:bold">content</span>:<span style="color:#bf0303">"index.php"</span>; <span style="font-weight:bold">http_uri</span>; <span style="font-weight:bold">sid</span>:<span style="color:#b08000">1</span>;) 0015 0016 <span style="font-weight:bold">alert</span> <span style="font-weight:bold">http</span> <span style="font-weight:bold">any</span> <span style="font-weight:bold">any</span> -> <span style="font-weight:bold">any</span> <span style="font-weight:bold">any</span> (http_response_line; <span style="font-weight:bold">content</span>:<span style="color:#bf0303">"403 Forbidden"</span>; <span style="font-weight:bold">sid</span>:<span style="color:#b08000">1</span>;) 0017 0018 <span style="font-weight:bold">alert</span> <span style="font-weight:bold">tcp</span> <span style="font-weight:bold">$EXTERNAL_NET</span> <span style="font-weight:bold">any</span> -> <span style="font-weight:bold">$HOME_NET</span> <span style="font-weight:bold">any</span> (<span style="font-weight:bold">msg</span>:<span style="color:#bf0303">”GPL DELETED typot trojan traffic”</span>; <span style="font-weight:bold">flow</span>:stateless; <span style="font-weight:bold">flags</span>:S,<span style="color:#b08000">12</span>; <span style="font-weight:bold">window</span>:<span style="color:#b08000">55808</span>; <span style="font-weight:bold">reference</span>:mcafee,<span style="color:#b08000">100406</span>; <span style="font-weight:bold">classtype</span>:trojan-activity; <span style="font-weight:bold">sid</span>:<span style="color:#b08000">2182</span>; <span style="font-weight:bold">rev</span>:<span style="color:#b08000">8</span>;) 0019 0020 <span style="font-weight:bold">alert</span> <span style="font-weight:bold">tcp</span> <span style="font-weight:bold">$EXTERNAL_NET</span> <span style="font-weight:bold">any</span> -> <span style="font-weight:bold">$HOME_NET</span> <span style="font-weight:bold">any</span> (<span style="font-weight:bold">flags</span>:S,<span style="color:#b08000">12</span>; <span style="font-weight:bold">tcp</span>.hdr; <span style="font-weight:bold">content</span>:<span style="color:#bf0303">”|02 04|”</span>; <span style="font-weight:bold">offset</span>:<span style="color:#b08000">20</span>; <span style="font-weight:bold">byte_test</span>:<span style="color:#b08000">2</span>,<,<span style="color:#b08000">536</span>,<span style="color:#b08000">0</span>,big,relative; <span style="font-weight:bold">sid</span>:<span style="color:#b08000">1234</span>; <span style="font-weight:bold">rev</span>:<span style="color:#b08000">5</span>;) 0021 0022 <span style="color:#898887"># Snort Samples</span> 0023 0024 <span style="font-weight:bold">alert</span> <span style="font-weight:bold">tcp</span> <span style="font-weight:bold">any</span> <span style="font-weight:bold">any</span> -> <span style="color:#b08000">192</span>.<span style="color:#b08000">168</span>.<span style="color:#b08000">1</span>.<span style="color:#b08000">0</span>/<span style="color:#b08000">24</span> <span style="color:#b08000">111</span> (<span style="font-weight:bold">content</span>:<span style="color:#bf0303">"|00 01 86 a5|"</span>; <span style="font-weight:bold">msg</span>: <span style="color:#bf0303">"mountd access"</span>;) 0025 </pre></body></html>