Vorlage:Suricata-rules - Versionsgeschichte

Thomas.will am 30. April 2026 um 10:45 Uhr

2026-04-30T10:45:21Z

Thomas.will am 30. April 2026 um 10:38 Uhr

2026-04-30T10:38:22Z

Thomas.will am 30. April 2026 um 10:33 Uhr

2026-04-30T10:33:01Z

Thomas.will: Die Seite wurde neu angelegt: „

 # ICMP: einfacher Ping/Traceroute (schneller Funktionstest) # Test: ping -c1  alert icmp any any -> any any (msg:"ICMP Test"; classtype:misc-activi…“

2026-04-30T10:28:28Z

Die Seite wurde neu angelegt: „<pre> # ICMP: einfacher Ping/Traceroute (schneller Funktionstest) # Test: ping -c1 <ZIEL> alert icmp any any -> any any (msg:"ICMP Test"; classtype:misc-activi…“

Neue Seite

<pre>
# ICMP: einfacher Ping/Traceroute (schneller Funktionstest)
# Test: ping -c1 <ZIEL>
alert icmp any any -> any any (msg:"ICMP Test"; classtype:misc-activity; sid:41;)

# HTTP: mögliches Command-Injection-Merkmal (Semikolon) in POST-Body
# Test: curl -X POST http://<ZIEL>/ -d "q=test%3Bls"
alert http any any -> any any (msg:"Command Injection - Semicolon in POST DATA"; classtype:web-application-attack; flow:established; content:"%3B"; nocase; http_client_body; sid:2;)

# HTTP: mögliches SQLi-Merkmal (einfaches Hochkomma) in POST-Body
# Test: curl -X POST http://<ZIEL>/login -d "u=a&p='%20OR%201=1"
alert http any any -> any any (msg:"Possible SQL Injection (singlequote in POST)"; classtype:web-application-attack; flow:established,to_server; content:"%27"; nocase; http_client_body; sid:3;)

# DNS: Policy – verbietet "google" in DNS-Queries
# Test: dig google.com @<FW>
drop dns any any -> any any (msg:"Kein Googlen"; dns.query; content:"google"; nocase; classtype:policy-violation; sid:43;)

# DoS: viele identische kurze HTTP-GETs (LOIC-ähnlich)
# Test: ab -n 1000 -c 500 http://<ZIEL>/
drop tcp any any -> any any (msg:"ET DOS Terse HTTP GET Likely LOIC"; flow:to_server,established; dsize:18; content:"GET / HTTP/1.1|0d 0a 0d 0a|"; depth:18; threshold:type both,track by_dst,count 500,seconds 60; classtype:own-dos; sid:54; rev:2; metadata:created_at 2014_10_03, confidence Medium, signature_severity Major, updated_at 2019_07_26;)

# Scan: TCP SYN-Sweep (viele SYN in kurzer Zeit)
# Test: nmap -sS -p1-100 <ZIEL>
drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN TCP SYN sweep"; flow:stateless,to_server; flags:S; detection_filter:track by_src,count 20,seconds 5; classtype:attempted-recon; sid:60; rev:1;)

# Scan: TCP NULL-Scan (keine Flags gesetzt)
# Test: nmap -sN -p1-100 <ZIEL>
drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN TCP NULL scan"; flow:stateless,to_server; flags:0; detection_filter:track by_src,count 5,seconds 10; classtype:attempted-recon; sid:61; rev:1;)

# Scan: TCP FIN-Scan (nur FIN)
# Test: nmap -sF -p1-100 <ZIEL>
drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN TCP FIN scan"; flow:stateless,to_server; flags:F; detection_filter:track by_src,count 5,seconds 10; classtype:attempted-recon; sid:62; rev:1;)

# Scan: TCP XMAS-Scan (FIN+PSH+URG)
# Test: nmap -sX -p1-100 <ZIEL>
drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN TCP XMAS scan"; flow:stateless,to_server; flags:FPU; detection_filter:track by_src,count 5,seconds 10; classtype:attempted-recon; sid:63; rev:1;)

# Scan: UDP-Sweep mit leerer Payload
# Test: nmap -sU --min-rate=1000 <ZIEL>
drop udp $EXTERNAL_NET any -> $HOME_NET 1:65535 (msg:"OWN SCAN UDP sweep (empty probes)"; flow:to_server; dsize:0; detection_filter:track by_src,count 15,seconds 10; classtype:attempted-recon; sid:64; rev:1;)

# Scan: ICMP Ping-Sweep (viele Echo-Requests)
# Test: nmap -sn <NETZ>/24
drop icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN ICMP ping sweep"; itype:8; detection_filter:track by_src,count 10,seconds 5; classtype:attempted-recon; sid:65; rev:1;)

# Aktion: ?
drop tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"OWN SCAN SSH Brute Force"; flow:to_server,stateless; flags:S; detection_filter:track by_src,count 10,seconds 60; classtype:attempted-recon; sid:66; rev:1;)
</pre>

@@ Zeile 23: / Zeile 23: @@
 # Test: nmap -sS -p1-100 10.88.2XX.21
 drop tcp any any -> any any (msg:"OWN SCAN TCP SYN sweep"; flow:stateless,to_server; flags:S; detection_filter:track by_src,count 20,seconds 5; classtype:attempted-recon; sid:9000060; rev:1;)
 # Scan: UDP-Sweep mit leerer Payload
@@ Zeile 33: / Zeile 37: @@
 # Brute Force SSH
-# Test: hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.88.2XX.21
+# Test: hydra -l kit -P bad-passwords ssh://10.88.2XX.21
 drop tcp any any -> any 22 (msg:"OWN SSH Brute Force"; flow:to_server,stateless; flags:S; detection_filter:track by_src,count 10,seconds 60; classtype:attempted-recon; sid:9000066; rev:1;)

@@ Zeile 1: / Zeile 1: @@
 <pre>
 # ICMP: einfacher Ping/Traceroute (schneller Funktionstest)
-# Test: ping -c1 <ZIEL>
+# Test: ping -c 1 1.1.1.1
-alert icmp any any -> any any (msg:"ICMP Test"; classtype:misc-activity; sid:41;)
+alert icmp any any -> any any (msg:"ICMP Test"; classtype:misc-activity; sid:9000041;)
 # HTTP: mögliches Command-Injection-Merkmal (Semikolon) in POST-Body
-# Test: curl -X POST http://<ZIEL>/ -d "q=test%3Bls"
+# Test: curl -X POST http://www.it2XX.int/host.php --data-urlencode "fqdn=example.com;ls" -d "submit=Auflösen"
-alert http any any -> any any (msg:"Command Injection - Semicolon in POST DATA"; classtype:web-application-attack; flow:established; content:"%3B"; nocase; http_client_body; sid:2;)
+alert http any any -> any any (msg:"Command Injection - Semicolon in POST DATA"; classtype:web-application-attack; flow:established; content:"%3B"; nocase; http_client_body; sid:9000002;)
 # HTTP: mögliches SQLi-Merkmal (einfaches Hochkomma) in POST-Body
-# Test: curl -X POST http://<ZIEL>/login -d "u=a&p='%20OR%201=1"
+# Test: curl -X POST http://www.it2XX.int/sql-classic.php --data-urlencode "username=' OR '1'='1' --"
-alert http any any -> any any (msg:"Possible SQL Injection (singlequote in POST)"; classtype:web-application-attack; flow:established,to_server; content:"%27"; nocase; http_client_body; sid:3;)
+alert http any any -> any any (msg:"Possible SQL Injection (singlequote in POST)"; classtype:web-application-attack; flow:established,to_server; content:"%27"; nocase; http_client_body; sid:9000003;)
-# DNS: Policy – verbietet "google" in DNS-Queries
+# DNS: Policy - verbietet "google" in DNS-Queries
-# Test: dig google.com @<FW>
+# Test: host google.de
-drop dns any any -> any any (msg:"Kein Googlen"; dns.query; content:"google"; nocase; classtype:policy-violation; sid:43;)
+drop dns any any -> any any (msg:"Kein Googlen"; dns.query; content:"google"; nocase; classtype:policy-violation; sid:9000043;)
 # DoS: viele identische kurze HTTP-GETs (LOIC-ähnlich)
-# Test: ab -n 1000 -c 500 http://<ZIEL>/
+# Test: ab -n 1000 -c 500 http://www.it2XX.int/
-drop tcp any any -> any any (msg:"ET DOS Terse HTTP GET Likely LOIC"; flow:to_server,established; dsize:18; content:"GET / HTTP/1.1|0d 0a 0d 0a|"; depth:18; threshold:type both,track by_dst,count 500,seconds 60; classtype:own-dos; sid:54; rev:2; metadata:created_at 2014_10_03, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
+drop tcp any any -> any any (msg:"ET DOS Terse HTTP GET Likely LOIC"; flow:to_server,established; dsize:18; content:"GET / HTTP/1.1|0d 0a 0d 0a|"; depth:18; threshold:type both,track by_dst,count 500,seconds 60; classtype:own-dos; sid:9000054; rev:2;)
 # Scan: TCP SYN-Sweep (viele SYN in kurzer Zeit)
-# Test: nmap -sS -p1-100 <ZIEL>
+# Test: nmap -sS -p1-100 10.88.2XX.21
-drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN TCP SYN sweep"; flow:stateless,to_server; flags:S; detection_filter:track by_src,count 20,seconds 5; classtype:attempted-recon; sid:60; rev:1;)
+drop tcp any any -> any any (msg:"OWN SCAN TCP SYN sweep"; flow:stateless,to_server; flags:S; detection_filter:track by_src,count 20,seconds 5; classtype:attempted-recon; sid:9000060; rev:1;)
-# Scan: TCP NULL-Scan (keine Flags gesetzt)
+# Scan: UDP-Sweep mit leerer Payload
-# Test: nmap -sN -p1-100 <ZIEL>
+# Test: nmap -sU --min-rate=1000 10.88.2XX.21
-drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN TCP NULL scan"; flow:stateless,to_server; flags:0; detection_filter:track by_src,count 5,seconds 10; classtype:attempted-recon; sid:61; rev:1;)
+drop udp any any -> any any (msg:"OWN SCAN UDP sweep (empty probes)"; flow:to_server; dsize:0; detection_filter:track by_src,count 15,seconds 10; classtype:attempted-recon; sid:9000064; rev:1;)
-# Scan: TCP FIN-Scan (nur FIN)
+# Scan: ICMP Ping-Sweep (viele Echo-Requests)
-# Test: nmap -sF -p1-100 <ZIEL>
+# Test: nmap -sn 10.88.2XX.0/24
-drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN TCP FIN scan"; flow:stateless,to_server; flags:F; detection_filter:track by_src,count 5,seconds 10; classtype:attempted-recon; sid:62; rev:1;)
+drop icmp any any -> any any (msg:"OWN SCAN ICMP ping sweep"; itype:8; detection_filter:track by_src,count 10,seconds 5; classtype:attempted-recon; sid:9000065; rev:1;)
-# Scan: TCP XMAS-Scan (FIN+PSH+URG)
+# Brute Force SSH
-# Test: nmap -sX -p1-100 <ZIEL>
+# Test: hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.88.2XX.21
-drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN TCP XMAS scan"; flow:stateless,to_server; flags:FPU; detection_filter:track by_src,count 5,seconds 10; classtype:attempted-recon; sid:63; rev:1;)
+drop tcp any any -> any 22 (msg:"OWN SSH Brute Force"; flow:to_server,stateless; flags:S; detection_filter:track by_src,count 10,seconds 60; classtype:attempted-recon; sid:9000066; rev:1;)
-# Scan: UDP-Sweep mit leerer Payload
+# HTTP: sqlmap User-Agent erkennen
-# Test: nmap -sU --min-rate=1000 <ZIEL>
+# Test: sqlmap -u "http://www.it2XX.int/sql-classic.php" --data "username=test"
-drop udp $EXTERNAL_NET any -> $HOME_NET 1:65535 (msg:"OWN SCAN UDP sweep (empty probes)"; flow:to_server; dsize:0; detection_filter:track by_src,count 15,seconds 10; classtype:attempted-recon; sid:64; rev:1;)
+alert http any any -> any any (msg:"SQLmap Scanner detected"; http.user_agent; content:"sqlmap"; nocase; classtype:web-application-attack; sid:9000070; rev:1;)
-# Scan: ICMP Ping-Sweep (viele Echo-Requests)
+# HTTP: curl User-Agent erkennen
-# Test: nmap -sn <NETZ>/24
+# Test: curl http://www.it2XX.int/host.php
-drop icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"OWN SCAN ICMP ping sweep"; itype:8; detection_filter:track by_src,count 10,seconds 5; classtype:attempted-recon; sid:65; rev:1;)
+alert http any any -> any any (msg:"curl User-Agent detected"; http.user_agent; content:"curl"; nocase; classtype:policy-violation; sid:9000071; rev:1;)
-# Aktion: ?
+# ICMP Tunnel - großes Payload
-drop tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"OWN SCAN SSH Brute Force"; flow:to_server,stateless; flags:S; detection_filter:track by_src,count 10,seconds 60; classtype:attempted-recon; sid:66; rev:1;)
+# Test: ping -c 5 -s 500 10.88.2XX.21
-# --- TCP SYN Flood (Sehr häufiger DDos-Typ) ---
+# TCP SYN Flood
-alert tcp any any -> $HOME_NET any (flags:S; msg:"TCP SYN Flood Potential Detected"; threshold: type both, track by_dst, count 150, seconds 10; sid:1000003; rev:1;)
+# Test: hping3 -S --flood -V -p 80 10.88.2XX.21
-# --- (Optional) Einfacher "Hello World" Treffer für Tests ---
+# SSH Connection Attempt
-alert tcp any any -> $HOME_NET any (msg:"TEST - SSH Connection Attempt"; content:"SSH"; nocase; sid:1000006; rev:1;)
+# Test: ssh root@10.88.2XX.21
 </pre>