# Sagan nfcapd.rules
# Copyright (c) 2009-2020. Quadrant Informat.AP...curity <www.quadrantsec.com>
# All rights reserved.
#
# Please submit any custom rules or ideas to sagan-submit@quadrantsec.com or the sagan-sigs mailing list
#
#*************************************************************
#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
#  following conditions are met:
#
#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
#    disclaimer.
#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
#    following disclaimer in the documentation and/or other materials provided with the distribution.
#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
#    from this software without specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
##############################################################################
# These rules are intended for the NetFlow protocol.  This requires that your 
# system has "nfdump" tools install. In particular,  the Quadrant modified 
# "nfdump",  that allows the program "nfcapd" to receive, decode and send 
# to the Sagan FIFO.  
# 
# For more information see:
#
# https://wiki.quadrantsec.com/twiki/bin/view/Main/SaganNetflow

# Example log string sent to the FIFO from the modified "nfcapd":
# source_ip: 10.10.0.1/80, destination_ip: 173.165.207.65/16464, protocol: UDP, duration: 5.400, flags: |.AP...|, tos: 0, packets: 312, bytes: 4222451716, last_time: 2013-11-30 01:10:24, vlan_src: 32767, vlan_dst: 0

# Possible IRC traffic

#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC detected [5/5]"; program: nfcapd; normalize; content: "/6667, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6667; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001984; sid: 5001984; rev:10;)

# 6697 - IRC traffic

#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC detected [5/5]"; program: nfcapd; normalize; content: "/6697, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6697; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001985; sid: 5001985; rev:11;)

# 6660-6669, 7000

#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 6660 [5/5]"; program: nfcapd; normalize; content: "/6660, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6660; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001986; sid: 5001986; rev:8;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 6661 [5/5]"; program: nfcapd; normalize; content: "/6661, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6661; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001987; sid: 5001987; rev:8;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 6662 [5/5]"; program: nfcapd; normalize; content: "/6662, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6662; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001988; sid: 5001988; rev:8;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 6663 [5/5]"; program: nfcapd; normalize; content: "/6663, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6663; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001989; sid: 5001989; rev:8;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 6664 [5/5]"; program: nfcapd; normalize; content: "/6664, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6664; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001990; sid: 5001990; rev:8;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 6665 [5/5]"; program: nfcapd; normalize; content: "/6665, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6665; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001991; sid: 5001991; rev:8;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 6666 [5/5]"; program: nfcapd; normalize; content: "/6666, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6666; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001992; sid: 5001992; rev:8;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 6668 [5/5]"; program: nfcapd; normalize; content: "/6668, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6698; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001993; sid: 5001993; rev:8;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 6669 [5/5]"; program: nfcapd; normalize; content: "/6669, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6999; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001994; sid: 5001994; rev:8;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible IRC - Port 7000 [5/5]"; program: nfcapd; normalize; content: "/7000, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 7000; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001995; sid: 5001995; rev:8;)

# SSH 

#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] PUSH/ACK Traffic Detected [5/5]"; program: nfcapd; normalize; content: "/22, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: $SSH_PORT; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001996; sid: 5001996; rev: 8;)
alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] PUSH/ACK Traffic Detected - Port 2222 [5/5]"; program: nfcapd; normalize; content: "/2222, protocol|3a| TCP,";  content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 2222; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 20, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001997; sid: 5001997; rev: 9;)

# Telnet 

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Telnet Traffic Detected via PUSH/ACK [5/5]"; program: nfcapd; normalize; content: "/23, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: $TELNET_PORT;  classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5001998; sid: 5001998; rev:8;)



# Bittorrent traffic via nfcapd - Robert Nunley 05/08/2015

#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible BitTorrent - Port 6881 [5/5]"; program: nfcapd; normalize; content: "/6881, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6881; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002291; sid: 5002291; rev:6;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible BitTorrent - Port 6882 [5/5]"; program: nfcapd; normalize; content: "/6882, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6882; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002292; sid: 5002292; rev:6;);
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible BitTorrent - Port 6883 [5/5]"; program: nfcapd; normalize; content: "/6883, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6883; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002293; sid: 5002293; rev:6;);
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible BitTorrent - Port 6884 [5/5]"; program: nfcapd; normalize; content: "/6884, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6884; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002294; sid: 5002294; rev:6;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible BitTorrent - Port 6885 [5/5]"; program: nfcapd; normalize; content: "/6885, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6885; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002295; sid: 5002295; rev:6;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible BitTorrent - Port 6886 [5/5]"; program: nfcapd; normalize; content: "/6886, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6886; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002296; sid: 5002296; rev:6;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible BitTorrent - Port 6887 [5/5]"; program: nfcapd; normalize; content: "/6887, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6887; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002297; sid: 5002297; rev:6;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible BitTorrent - Port 6888 [5/5]"; program: nfcapd; normalize; content: "/6888, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6888; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002298; sid: 5002298; rev:6;)
#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible BitTorrent - Port 6889 [5/5]"; program: nfcapd; normalize; content: "/6889, protocol|3a| TCP,"; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 6889; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002299; sid: 5002299; rev:6;)

# Tor traffic via nfcapd - Robert Nunley 05/08/2015

#alert any $HOME_NET any -> $EXTERNAL_NET any(msg: "[NFCAPD] Possible TOR - Port 9001"; program: nfcapd; normalize; content: "/9001, protocol|3a| TCP,"; xbits: set,tor_traffic,track ip_src, expire 21600; xbits:nounified2; xbits:noeve; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 9001; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; reference: url, wiki.quadrantsec.com/bin/view/Main/5002300; reference: url, torstatus.blutmagie.de; sid: 5002300; rev:11;)

#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible TOR - Port 9030 after Port 9001"; program: nfcapd; normalize; content: "/9030, protocol|3a| TCP,"; xbits: isset,tor_traffic,track ip_src; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 9030; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002301; reference: url, torstatus.blutmagie.de; sid: 5002301; rev:8;)

#alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[NFCAPD] Possible TOR - Port 443 after Port 9001"; program: nfcapd; normalize; content: "/443, protocol|3a| TCP,"; xbits: isset,tor_traffic,track ip_src; content:"flags|3a| |7c|.AP...|7c|,"; default_proto: tcp; default_dst_port: 443; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; parse_port; threshold: type suppress, track by_src, count 5, seconds 120; after: track by_src, count 5, seconds 300; reference: url, wiki.quadrantsec.com/bin/view/Main/5002302; reference: url, torstatus.blutmagie.de; sid: 5002302; rev:8;)