From 8628cde5a64e09dffcb733eff4148d3047d45a8d Mon Sep 17 00:00:00 2001 From: Bryant Smith Date: Fri, 28 Aug 2026 13:06:47 -0600 Subject: [PATCH 1/2] Add dynamic_load trigger for msapi-microsoftteams.rules sid:5017961 -- gates on program:MicrosoftTeams (set from the O365 Management API .Workload field via the msapi json-input map), mirroring the existing msapi-azuread/exchange/onedrive/sharepoint dynamic entries. Lets dynamic_load-mode deployments load the Teams file-exfiltration rules (5017959/5017960) on demand instead of only via the static rules.yaml include. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Pm9eFi7kuG3hhfQrWVRta3 --- .last_used_sid | 2 +- dynamic.rules | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.last_used_sid b/.last_used_sid index 1fa3ae96..77bb820d 100644 --- a/.last_used_sid +++ b/.last_used_sid @@ -1,2 +1,2 @@ -Normal Rule: 5017960 +Normal Rule: 5017961 Fingerprint: 5100196 diff --git a/dynamic.rules b/dynamic.rules index 5871ba24..74a0e4b2 100644 --- a/dynamic.rules +++ b/dynamic.rules @@ -282,3 +282,4 @@ alert any any any -> any any (msg:"[DYNAMIC] Mimecast V2 Logs Detected"; program alert any any any -> any any (msg:"[DYNAMIC] Sophos Firewall Logs Detected"; program:sophos; dynamic_load: $RULE_PATH/sophos_firewall.rules; classtype:dynamic-rules; sid:5017456; rev:1;) alert any any any -> any any (msg:"[DYNAMIC] Zscaler ZIA Logs Detected"; program:Zscaler; dynamic_load: $RULE_PATH/zscaler-zia.rules; classtype:dynamic-rules; sid:5017934; rev:1;) alert any any any -> any any (msg:"[DYNAMIC] Zscaler ZPA Logs Detected"; program:Zscaler; dynamic_load: $RULE_PATH/zscaler-zpa.rules; classtype:dynamic-rules; sid:5017935; rev:1;) +alert any any any -> any any (msg:"[DYNAMIC] MSAPI-MicrosoftTeams logs detected via program"; program:MicrosoftTeams; dynamic_load: $RULE_PATH/msapi-microsoftteams.rules; classtype:dynamic-rules; sid:5017961; rev:1;) From 2559f501f250d7316d26e1910c3ad558dd01686c Mon Sep 17 00:00:00 2001 From: Bryant Smith Date: Mon, 31 Aug 2026 08:22:15 -0600 Subject: [PATCH 2/2] refactor(*): Promote zero-alert experimental rules to production sids Renumbered 24 EXPERIMENTAL rules across windows-security, msapi-azuread, sonicwall, fortinet(-aetas), and juniper(-aetas) from staging sids (9870xxx/995xx) to sequential production sids (5017962-5017985) and stripped the [EXPERIMENTAL] tag from their msg fields, per the established promotion pattern (7065f19). These 24 had zero alerts in the last 30 days per an OpenSearch alerts-index comparison against the live ruleset. Bumped .last_used_sid accordingly. Note: sid:5017982 (Juniper - Standard Web Port, formerly 9870015) stays commented out -- it was already disabled prior to this change, which is why it had zero alerts. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01YBacyjARiT72fNq9sqG3ay --- .last_used_sid | 2 +- fortinet-aetas.rules | 2 +- fortinet.rules | 6 +++--- juniper-aetas.rules | 2 +- juniper.rules | 6 +++--- msapi-azuread.rules | 6 +++--- sonicwall.rules | 8 ++++---- windows-security.rules | 18 +++++++++--------- 8 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.last_used_sid b/.last_used_sid index 77bb820d..c7672883 100644 --- a/.last_used_sid +++ b/.last_used_sid @@ -1,2 +1,2 @@ -Normal Rule: 5017961 +Normal Rule: 5017985 Fingerprint: 5100196 diff --git a/fortinet-aetas.rules b/fortinet-aetas.rules index a2759bdc..c0e21d19 100644 --- a/fortinet-aetas.rules +++ b/fortinet-aetas.rules @@ -30,4 +30,4 @@ alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[FORTINET-AETAS] Administrat alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[FORTINET-AETAS] Admin authentication access at suspicious time"; content: "38001 type="; content: "succeeded in authentication"; parse_src_ip: 1; alert_time: days $SAGAN_DAYS, hours $SAGAN_HOURS; classtype: successful-admin; sid: 5002045; rev:3;) alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[FORTINET-AETAS] SSH traffic detected at suspicious time"; content: " service=SSH "; classtype: suspicious-traffic; parse_src_ip: 1; parse_dst_ip: 2; alert_time: days $SAGAN_DAYS, hours $SAGAN_HOURS; sid: 5002046; rev:4;) -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [FORTIGATE] Suspicious - Unknown Application Activity Outside Business Hours"; content:"type=|22|traffic|22|"; content:"subtype=|22|forward|22|"; content:"app=|22|UNKNOWN|22|"; pcre:"/srcip=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; alert_time:days 12345,hours 1800-0800; threshold:type suppress,track by_src,count 3,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870022; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[FORTIGATE] Suspicious - Unknown Application Activity Outside Business Hours"; content:"type=|22|traffic|22|"; content:"subtype=|22|forward|22|"; content:"app=|22|UNKNOWN|22|"; pcre:"/srcip=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; alert_time:days 12345,hours 1800-0800; threshold:type suppress,track by_src,count 3,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017981; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) diff --git a/fortinet.rules b/fortinet.rules index b3bbdb3f..14208184 100644 --- a/fortinet.rules +++ b/fortinet.rules @@ -418,9 +418,9 @@ alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[FORTINET] VPN Brute Force f alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[FORTINET] VPN Login After Brute Force for Same User"; content:"logid=|22|0101039424|22|"; content:"type="; content:"subtype="; parse_src_ip:2; normalize; flexbits:isset,username,brute_force; threshold:type suppress,track by_username, count 5, seconds 14400; reference:url,https://docs.fortinet.com/document/fortigate/7.6.2/fortios-log-message-reference/39424/39424-log-id-event-ssl-vpn-user-tunnel-up; content:"- - - -"; classtype:correlated-attack; sid:5017314; rev:3;) #=========================================================== -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [FORTIGATE] Suspicious - Unknown Application on Standard Web Port"; content:"type=|22|traffic|22|"; content:"subtype=|22|forward|22|"; content:"app=|22|UNKNOWN|22|"; pcre:"/dstport=(80|443)[^\d]/"; pcre:"/srcip=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870019; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[FORTIGATE] Suspicious - Unknown Application on Standard Web Port"; content:"type=|22|traffic|22|"; content:"subtype=|22|forward|22|"; content:"app=|22|UNKNOWN|22|"; pcre:"/dstport=(80|443)[^\d]/"; pcre:"/srcip=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017978; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [FORTIGATE] Suspicious - Unknown Application on High Destination Port"; content:"type=|22|traffic|22|"; content:"subtype=|22|forward|22|"; content:"app=|22|UNKNOWN|22|"; pcre:"/dstport=(1[0-9]{4,}|[2-9]\d{4,})[^\d]/"; pcre:"/srcip=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; after:track by_src,count 3,seconds 600; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870020; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[FORTIGATE] Suspicious - Unknown Application on High Destination Port"; content:"type=|22|traffic|22|"; content:"subtype=|22|forward|22|"; content:"app=|22|UNKNOWN|22|"; pcre:"/dstport=(1[0-9]{4,}|[2-9]\d{4,})[^\d]/"; pcre:"/srcip=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; after:track by_src,count 3,seconds 600; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017979; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [FORTIGATE] Suspicious - Large Outbound Data Transfer with Unknown Application"; content:"type=|22|traffic|22|"; content:"subtype=|22|forward|22|"; content:"app=|22|UNKNOWN|22|"; pcre:"/sentbyte=([5-9]\d{6}|\d{7,})[^\d]/"; pcre:"/srcip=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870021; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[FORTIGATE] Suspicious - Large Outbound Data Transfer with Unknown Application"; content:"type=|22|traffic|22|"; content:"subtype=|22|forward|22|"; content:"app=|22|UNKNOWN|22|"; pcre:"/sentbyte=([5-9]\d{6}|\d{7,})[^\d]/"; pcre:"/srcip=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017980; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[FORTIGATE] ArcheClient C2 - Unidentified TCP Beaconing on Port 9000"; content:"type=|22|traffic|22|"; content:"subtype=|22|forward|22|"; content:"proto=6"; content:"dstport=9000"; content:"sentbyte=52"; content:"rcvdbyte=0"; content:"sentpkt=1"; content:"rcvdpkt=0"; pcre:"/srcip=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; after:track by_src,count 5,seconds 3600; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017931; rev:2; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) diff --git a/juniper-aetas.rules b/juniper-aetas.rules index 8a189274..ad1f7042 100644 --- a/juniper-aetas.rules +++ b/juniper-aetas.rules @@ -29,4 +29,4 @@ alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[JUNIPER-AETAS] VPN Login at suspicious time"; program: Juniper; pcre: "/Authentication successful|Login succeeded/i"; alert_time: days $SAGAN_DAYS, hours $SAGAN_HOURS; default_proto: tcp; default_dst_port: $HTTPS_PORT; classtype: successful-user; parse_src_ip: 1; sid:5002047; rev:3;) alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[JUNIPER-AETAS] VPN Logout at suspicious time"; program: Juniper; content: "Logout from"; alert_time: days $SAGAN_DAYS, hours $SAGAN_HOURS; default_proto: tcp; default_dst_port: $HTTPS_PORT; classtype: successful-user; parse_src_ip: 1; sid:5002048; rev:3;) -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [JUNIPER] Suspicious - Unknown Application Activity Outside Business Hours"; content:"APPTRACK_SESSION_CREATE"; content:"application=|22|UNKNOWN|22|"; content:"destination-zone-name=|22|untrust|22|"; content:"source-zone-name=|22|trust|22|"; parse_src_ip:1; alert_time:days 12345,hours 1800-0800; threshold:type suppress,track by_src,count 3,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870018; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[JUNIPER] Suspicious - Unknown Application Activity Outside Business Hours"; content:"APPTRACK_SESSION_CREATE"; content:"application=|22|UNKNOWN|22|"; content:"destination-zone-name=|22|untrust|22|"; content:"source-zone-name=|22|trust|22|"; parse_src_ip:1; alert_time:days 12345,hours 1800-0800; threshold:type suppress,track by_src,count 3,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017985; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) diff --git a/juniper.rules b/juniper.rules index aa660eeb..676bd010 100644 --- a/juniper.rules +++ b/juniper.rules @@ -109,9 +109,9 @@ alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[JUNIPER] VPN - Policy viola alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[ScreenOS] Juniper ScreenOS Login for Suspicious Admin user - system"; content: "Admin user system has logged on via"; nocase; content: "00515"; parse_src_ip: 1; reference:cve,2015-7755; reference:url,kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&actp=search; default_proto: tcp; default_dst_port: $SSH_PORT; classtype:successful-admin; sid: 5002771; rev:4;) alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[ScreenOS] Juniper ScreenOS Login for Suspicious Admin user - username"; content:"Admin user"; content:"username"; content:"has logged on via"; content: "00515"; parse_src_ip: 1; reference:cve,2015-7755; reference:url,kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&actp=search; default_proto: tcp; default_dst_port: $SSH_PORT; classtype:successful-admin; sid: 5002772; rev:4;) -#alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [JUNIPER] Suspicious - Unknown Application on Standard Web Port"; content:"APPTRACK_SESSION_CREATE"; content:"application=|22|UNKNOWN|22|"; content:"destination-zone-name=|22|untrust|22|"; content:"source-zone-name=|22|trust|22|"; meta_content:"destination-port=|22|%sagan%|22|",80,443; content:!"destination-port=|22|443|22| service-name=|22|junos-https|22|"; content:!"destination-port=|22|80|22| service-name=|22|junos-http|22|"; parse_src_ip:1; parse_dst_ip:2; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870015; rev:2; metadata:created_on 2026_06_17, updated_on 2026_06_30, mitreTactic TA0011, mitreTechnique T1071.001;) +#alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[JUNIPER] Suspicious - Unknown Application on Standard Web Port"; content:"APPTRACK_SESSION_CREATE"; content:"application=|22|UNKNOWN|22|"; content:"destination-zone-name=|22|untrust|22|"; content:"source-zone-name=|22|trust|22|"; meta_content:"destination-port=|22|%sagan%|22|",80,443; content:!"destination-port=|22|443|22| service-name=|22|junos-https|22|"; content:!"destination-port=|22|80|22| service-name=|22|junos-http|22|"; parse_src_ip:1; parse_dst_ip:2; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017982; rev:2; metadata:created_on 2026_06_17, updated_on 2026_06_30, mitreTactic TA0011, mitreTechnique T1071.001;) -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [JUNIPER] Suspicious - Unknown Application on High Destination Port"; content:"APPTRACK_SESSION_CREATE"; content:"application=|22|UNKNOWN|22|"; content:"destination-zone-name=|22|untrust|22|"; content:"source-zone-name=|22|trust|22|"; pcre:"/destination-port=(1[0-9]{4,}|[2-9]\d{4,})/"; parse_src_ip:1; after:track by_src,count 3,seconds 600; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870016; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[JUNIPER] Suspicious - Unknown Application on High Destination Port"; content:"APPTRACK_SESSION_CREATE"; content:"application=|22|UNKNOWN|22|"; content:"destination-zone-name=|22|untrust|22|"; content:"source-zone-name=|22|trust|22|"; pcre:"/destination-port=(1[0-9]{4,}|[2-9]\d{4,})/"; parse_src_ip:1; after:track by_src,count 3,seconds 600; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017983; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [JUNIPER] Suspicious - Large Outbound Data Transfer with Unknown Application"; content:"APPTRACK_SESSION_VOL_UPDATE"; content:"application=|22|UNKNOWN|22|"; content:"destination-zone-name=|22|untrust|22|"; content:"source-zone-name=|22|trust|22|"; pcre:"/bytes-from-client=([5-9]\d{6}|\d{7,})/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870017; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[JUNIPER] Suspicious - Large Outbound Data Transfer with Unknown Application"; content:"APPTRACK_SESSION_VOL_UPDATE"; content:"application=|22|UNKNOWN|22|"; content:"destination-zone-name=|22|untrust|22|"; content:"source-zone-name=|22|trust|22|"; pcre:"/bytes-from-client=([5-9]\d{6}|\d{7,})/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017984; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[JUNIPER] ArcheClient C2 - Unidentified TCP Beaconing on Port 9000"; content:"APPTRACK_SESSION_VOL_UPDATE"; content:"destination-port=|22|9000|22|"; content:"source-zone-name=|22|trust|22|"; content:"destination-zone-name=|22|untrust|22|"; content:"application=|22|UNKNOWN|22|"; content:"bytes-from-client=|22|52|22|"; content:"bytes-from-server=|22|0|22|"; content:"packets-from-client=|22|1|22|"; content:"packets-from-server=|22|0|22|"; parse_src_ip:1; after:track by_src,count 5,seconds 3600; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017930; rev:3; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) diff --git a/msapi-azuread.rules b/msapi-azuread.rules index 53e60243..ff9c70bd 100644 --- a/msapi-azuread.rules +++ b/msapi-azuread.rules @@ -67,15 +67,15 @@ alert any any any -> any any (msg:"[MSAPI-AZUREAD] User Login Failed Because Ext alert any any any -> any any (msg:"[MSAPI-AZUREAD] Login Blocked by Conditional Access Policy w/ CMSI"; program:AzureActiveDirectory; json_content:".Operation","UserLoginFailed"; content:"BlockedByConditionalAccess"; content:"Cmsi:Cmsi"; json_map:"src_ip",".ClientIP"; json_map:"dest_ip",".ClientIP"; json_map:"username",".UserId"; json_map:"program",".Workload"; threshold: type suppress, track by_username&by_src, count 1, seconds 1800; classtype:suspicious-activity; priority:2; sid:5017905; rev:2; metadata:created_at 2026_05_06, updated_at 2026_06_12, mitre_tactic_id TA0001, mitre_technique_id T1078.004;) -alert any any any -> any any (msg:"[EXPERIMENTAL][MSAPI-AZUREAD] Successful User Login From UnTrusted Device To Known AITM Landing Page - Possible AITM"; program:AzureActiveDirectory; json_content:".Operation","UserLoggedIn"; json_content:".AzureActiveDirectoryEventType","1"; json_content:".UserType","0"; json_content:".ApplicationId","4765445b-32c6-49b0-83e6-1d93765276ca"; content:"Login|3a|login"; meta_content:"%sagan%",IsCompliantAndManaged|22 2c 20 22|Value|22 3a 20 22|False|22|,IsCompliantAndManaged|22 2c 22|Value|22 3a 22|False|22|"; meta_content:"%sagan%",UserAuthenticationMethod|22 2c 22|Value|22 3a 22|16|22|,UserAuthenticationMethod|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|16|5c 22|; json_map:"src_ip",".ClientIP"; json_content:!".UserId","_jit@"; json_contains; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|2|22|"; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|1|22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|2|5c 22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|1|5c 22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|2|22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|1|22|"; json_map:"src_ip",".ClientIP"; json_map:"username",".UserId"; threshold: type suppress, track by_username&by_src, count 1, seconds 3600; flexbits:isset,username,AITM_RECON; flexbits:set,AITM_LOGIN,532800; classtype:suspicious-activity; priority:1; sid:99550; rev:6; metadata: createdOn 2026_05_13, updatedOn 2026_05_28;) +alert any any any -> any any (msg:"[MSAPI-AZUREAD] Successful User Login From UnTrusted Device To Known AITM Landing Page - Possible AITM"; program:AzureActiveDirectory; json_content:".Operation","UserLoggedIn"; json_content:".AzureActiveDirectoryEventType","1"; json_content:".UserType","0"; json_content:".ApplicationId","4765445b-32c6-49b0-83e6-1d93765276ca"; content:"Login|3a|login"; meta_content:"%sagan%",IsCompliantAndManaged|22 2c 20 22|Value|22 3a 20 22|False|22|,IsCompliantAndManaged|22 2c 22|Value|22 3a 22|False|22|"; meta_content:"%sagan%",UserAuthenticationMethod|22 2c 22|Value|22 3a 22|16|22|,UserAuthenticationMethod|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|16|5c 22|; json_map:"src_ip",".ClientIP"; json_content:!".UserId","_jit@"; json_contains; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|2|22|"; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|1|22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|2|5c 22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|1|5c 22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|2|22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|1|22|"; json_map:"src_ip",".ClientIP"; json_map:"username",".UserId"; threshold: type suppress, track by_username&by_src, count 1, seconds 3600; flexbits:isset,username,AITM_RECON; flexbits:set,AITM_LOGIN,532800; classtype:suspicious-activity; priority:1; sid:5017971; rev:6; metadata: createdOn 2026_05_13, updatedOn 2026_05_28;) -alert any any any -> any any (msg:"[EXPERIMENTAL][MSAPI-AZUREAD] Successful User Login From UnTrusted Device To Known AITM Landing Page - Possible Persistence Setup Via Keep Me Signed In"; program:AzureActiveDirectory; json_content:".Operation","UserLoggedIn"; json_content:".AzureActiveDirectoryEventType","1"; json_content:".UserType","0"; json_content:".ApplicationId","4765445b-32c6-49b0-83e6-1d93765276ca"; content:"Kmsi"; meta_content:"%sagan%",IsCompliantAndManaged|22 2c 20 22|Value|22 3a 20 22|False|22|,IsCompliantAndManaged|22 2c 22|Value|22 3a 22|False|22|"; json_content:!".UserId","_jit@"; json_contains; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|2|22|"; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|1|22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|2|5c 22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|1|5c 22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|2|22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|1|22|"; json_map:"src_ip",".ClientIP"; json_map:"username",".UserId"; threshold: type suppress, track by_username&by_src, count 1, seconds 3600; flexbits:isset,username,AITM_LOGIN; classtype:suspicious-activity; priority:1; sid:99551; rev:4; metadata: createdOn 2026_05_13, updatedOn 2026_05_28;) +alert any any any -> any any (msg:"[MSAPI-AZUREAD] Successful User Login From UnTrusted Device To Known AITM Landing Page - Possible Persistence Setup Via Keep Me Signed In"; program:AzureActiveDirectory; json_content:".Operation","UserLoggedIn"; json_content:".AzureActiveDirectoryEventType","1"; json_content:".UserType","0"; json_content:".ApplicationId","4765445b-32c6-49b0-83e6-1d93765276ca"; content:"Kmsi"; meta_content:"%sagan%",IsCompliantAndManaged|22 2c 20 22|Value|22 3a 20 22|False|22|,IsCompliantAndManaged|22 2c 22|Value|22 3a 22|False|22|"; json_content:!".UserId","_jit@"; json_contains; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|2|22|"; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|1|22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|2|5c 22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|1|5c 22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|2|22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|1|22|"; json_map:"src_ip",".ClientIP"; json_map:"username",".UserId"; threshold: type suppress, track by_username&by_src, count 1, seconds 3600; flexbits:isset,username,AITM_LOGIN; classtype:suspicious-activity; priority:1; sid:5017972; rev:4; metadata: createdOn 2026_05_13, updatedOn 2026_05_28;) alert any any any -> any any (msg:"[EXPERIMENTAL][MSAPI-AZUREAD] Multiple Login Failures Over Azure CLI - Possible AITM Recon [25+/1Min]"; program:AzureActiveDirectory; json_content:".Operation","UserLoginFailed"; json_content:".AzureActiveDirectoryEventType","1"; json_content:".UserType","0"; json_content:".ApplicationId","04b07795-8ddb-461a-bbee-02f9e1bf7b46"; content:"OAuth2|3a|Token"; meta_content:"%sagan%",IsCompliantAndManaged|22 2c 20 22|Value|22 3a 20 22|False|22|,IsCompliantAndManaged|22 2c 22|Value|22 3a 22|False|22|"; json_map:"src_ip",".ClientIP"; json_content:!".UserId","_jit@"; json_contains; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|2|22|"; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|1|22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|2|5c 22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|1|5c 22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|2|22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|1|22|"; json_map:"src_ip",".ClientIP"; json_map:"username",".UserId"; after: track by_username, count 25, seconds 60; threshold: type suppress, track by_username, count 1, seconds 3600; flexbits:set,AITM_RECON,36000; classtype:suspicious-activity; priority:1; sid:99552; rev:4; metadata: createdOn 2026_05_14, updatedOn 2026_05_28;) alert any any any -> any any (msg:"[EXPERIMENTAL][MSAPI-AZUREAD] Security Threat Detected In User Login - Multiple Keep Me Signed In Events Detected For User [2+/1Min]"; program:AzureActiveDirectory; json_content:".Operation","UserLoggedIn"; json_content:".AzureActiveDirectoryEventType","1"; json_content:".UserType","0"; json_content:".ApplicationId","4765445b-32c6-49b0-83e6-1d93765276ca"; content:"Kmsi"; meta_content:"%sagan%",IsCompliantAndManaged|22 2c 20 22|Value|22 3a 20 22|False|22|,IsCompliantAndManaged|22 2c 22|Value|22 3a 22|False|22|"; json_content:!".UserId","_jit@"; json_contains; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|2|22|"; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|1|22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|2|5c 22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|1|5c 22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|2|22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|1|22|"; json_map:"src_ip",".ClientIP"; json_map:"username",".UserId"; after:track by_username, count 1, seconds 60; threshold: type suppress, track by_username, count 1, seconds 3600; classtype:suspicious-activity; priority:1; sid:99553; rev:3; metadata: createdOn 2026_05_19, updatedOn 2026_05_28, mitreTacticId TA0003, mitreTacticName Persistence, mitreTechniqueId T1078.004, mitreTechniqueName ValidAccounts_CloudAccounts;) -alert any any any -> any any (msg:"[EXPERIMENTAL][MSAPI-AZUREAD] Initial Access: Potential AiTM Token Replay via Unknown ObjectId"; program:AzureActiveDirectory; json_content:".Operation","UserLoggedIn"; json_content:".AzureActiveDirectoryEventType","1"; json_content:".UserType","0"; json_content:".ObjectId","Unknown"; json_content:".ApplicationId","4765445b-32c6-49b0-83e6-1d93765276ca"; content:"OAuth2|3a|Authorize"; meta_content:"%sagan%",IsCompliantAndManaged|22 2c 20 22|Value|22 3a 20 22|False|22|,IsCompliantAndManaged|22 2c 22|Value|22 3a 22|False|22|"; json_map:"src_ip",".ClientIP"; json_content:!".UserId","_jit@"; json_contains; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|2|22|"; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|1|22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|2|5c 22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|1|5c 22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|2|22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|1|22|"; json_map:"src_ip",".ClientIP"; json_map:"username",".UserId"; threshold: type suppress, track by_username, count 1, seconds 3600; flexbits:set,AITM_LOGIN,532800; classtype:suspicious-activity; priority:1; sid:99554; rev:3; metadata: createdOn 2026_05_19, updatedOn 2026_05_28, mitreTacticId TA0001, mitreTacticName InitialAccess, mitreTechniqueId T1078.004, mitreTechniqueName ValidAccounts_CloudAccounts;) +alert any any any -> any any (msg:"[MSAPI-AZUREAD] Initial Access: Potential AiTM Token Replay via Unknown ObjectId"; program:AzureActiveDirectory; json_content:".Operation","UserLoggedIn"; json_content:".AzureActiveDirectoryEventType","1"; json_content:".UserType","0"; json_content:".ObjectId","Unknown"; json_content:".ApplicationId","4765445b-32c6-49b0-83e6-1d93765276ca"; content:"OAuth2|3a|Authorize"; meta_content:"%sagan%",IsCompliantAndManaged|22 2c 20 22|Value|22 3a 20 22|False|22|,IsCompliantAndManaged|22 2c 22|Value|22 3a 22|False|22|"; json_map:"src_ip",".ClientIP"; json_content:!".UserId","_jit@"; json_contains; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|2|22|"; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|1|22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|2|5c 22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|1|5c 22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|2|22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|1|22|"; json_map:"src_ip",".ClientIP"; json_map:"username",".UserId"; threshold: type suppress, track by_username, count 1, seconds 3600; flexbits:set,AITM_LOGIN,532800; classtype:suspicious-activity; priority:1; sid:5017973; rev:3; metadata: createdOn 2026_05_19, updatedOn 2026_05_28, mitreTacticId TA0001, mitreTacticName InitialAccess, mitreTechniqueId T1078.004, mitreTechniqueName ValidAccounts_CloudAccounts;) alert any any any -> any any (msg:"[EXPERIMENTAL][MSAPI-AZUREAD] Multiple Login Failures Over Azure CLI - Possible AITM Recon [5+/1Hour]"; program:AzureActiveDirectory; json_content:".Operation","UserLoginFailed"; json_content:".AzureActiveDirectoryEventType","1"; json_content:".UserType","0"; json_content:".ApplicationId","04b07795-8ddb-461a-bbee-02f9e1bf7b46"; content:"OAuth2|3a|Token"; meta_content:"%sagan%",IsCompliantAndManaged|22 2c 20 22|Value|22 3a 20 22|False|22|,IsCompliantAndManaged|22 2c 22|Value|22 3a 22|False|22|"; json_map:"src_ip",".ClientIP"; json_content:!".UserId","_jit@"; json_contains; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|2|22|"; content:!"|22|TrustType|22 2c 22|Value|22 3a 22|1|22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|2|5c 22|"; content:!"|5c 22|TrustType|5c 22 2c 5c 22|Value|5c 22 3a 5c 22|1|5c 22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|2|22|"; content:!"|22|TrustType|22 2c 20 22|Value|22 3a 20 22|1|22|"; json_map:"src_ip",".ClientIP"; json_map:"username",".UserId"; after: track by_username, count 5, seconds 3600; threshold: type suppress, track by_username, count 1, seconds 3600; flexbits:set,AITM_RECON,36000; classtype:suspicious-activity; priority:1; sid:99555; rev:1; metadata: createdOn 2026_05_18, updatedOn 2026_05_28;) diff --git a/sonicwall.rules b/sonicwall.rules index f890a3f4..44aeebcc 100644 --- a/sonicwall.rules +++ b/sonicwall.rules @@ -233,9 +233,9 @@ alert any any any -> any any (msg: "[SONICWALL] A Guest Account Was Re-Enabled o alert any any any -> any any (msg: "[SONICWALL] A Guest Account Was Re-Enabled on Appliance"; program: sonicwall; content: "|22|msgid|22 3a 20|561|2c|"; normalize; classtype: system-event; reference: url,https://www.sonicwall.com/techdocs/pdf/SonicOS-X_7.0.1_LogEvents_ReferenceGuide.pdf; sid:5015159; rev:1;) #============================================================================ -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [SONICWALL] Suspicious - Unknown Application on Standard Web Port"; content:"msg=|22|Connection Closed|22|"; content:"appName=|22|Unknown|22|"; pcre:"/proto=tcp\/(80|443)[^\d]/"; pcre:"/src=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870023; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [SONICWALL] Suspicious - Unknown Application on High Destination Port"; content:"msg=|22|Connection Closed|22|"; content:"appName=|22|Unknown|22|"; pcre:"/proto=tcp\/(1[0-9]{4,}|[2-9]\d{4,})[^\d]/"; pcre:"/src=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; after:track by_src,count 3,seconds 600; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870024; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [SONICWALL] Suspicious - Large Outbound Data Transfer with Unknown Application"; content:"msg=|22|Connection Closed|22|"; content:"appName=|22|Unknown|22|"; pcre:"/sent=([5-9]\d{6}|\d{7,})[^\d]/"; pcre:"/src=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870025; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[SONICWALL] Suspicious - Unknown Application on Standard Web Port"; content:"msg=|22|Connection Closed|22|"; content:"appName=|22|Unknown|22|"; pcre:"/proto=tcp\/(80|443)[^\d]/"; pcre:"/src=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017974; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[SONICWALL] Suspicious - Unknown Application on High Destination Port"; content:"msg=|22|Connection Closed|22|"; content:"appName=|22|Unknown|22|"; pcre:"/proto=tcp\/(1[0-9]{4,}|[2-9]\d{4,})[^\d]/"; pcre:"/src=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; after:track by_src,count 3,seconds 600; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017975; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[SONICWALL] Suspicious - Large Outbound Data Transfer with Unknown Application"; content:"msg=|22|Connection Closed|22|"; content:"appName=|22|Unknown|22|"; pcre:"/sent=([5-9]\d{6}|\d{7,})[^\d]/"; pcre:"/src=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017976; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) -alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[EXPERIMENTAL] [SONICWALL] Suspicious - Unknown Application Activity Outside Business Hours"; content:"msg=|22|Connection Closed|22|"; content:"appName=|22|Unknown|22|"; pcre:"/src=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; alert_time:days 12345,hours 1800-0800; threshold:type suppress,track by_src,count 3,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:9870026; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) +alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[SONICWALL] Suspicious - Unknown Application Activity Outside Business Hours"; content:"msg=|22|Connection Closed|22|"; content:"appName=|22|Unknown|22|"; pcre:"/src=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; alert_time:days 12345,hours 1800-0800; threshold:type suppress,track by_src,count 3,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017977; rev:1; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[SONICWALL] ArcheClient C2 - Unidentified TCP Beaconing on Port 9000"; content:"msg=|22|Connection Closed|22|"; content:"proto=tcp/9000"; content:"sent=52"; content:"rcvd=0"; content:"spkt=1"; content:"rpkt=0"; pcre:"/src=(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+)/"; parse_src_ip:1; after:track by_src,count 5,seconds 3600; threshold:type suppress,track by_src,count 1,seconds 3600; classtype:trojan-activity; reference:url,attack.mitre.org/techniques/T1071/001; sid:5017932; rev:2; metadata:created_on 2026_06_17, updated_on 2026_06_17, mitreTactic TA0011, mitreTechnique T1071.001;) diff --git a/windows-security.rules b/windows-security.rules index 24c0314d..b41a03a2 100644 --- a/windows-security.rules +++ b/windows-security.rules @@ -688,11 +688,11 @@ alert any any any -> any any (msg:"[WINDOWS-SECURITY] Firewall Allow Rule Create ################################# alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] Authentication - Anonymous NTLM V1 Logon via NtLmSsp"; program:Security; event_id:4624; content:"ANONYMOUS LOGON"; content:"NTLM V1"; content:"NtLmSsp"; classtype:credential-access; parse_src_ip:1; json_map:"dest_ip",".xff"; threshold:type suppress, track by_dst, count 1, seconds 3600; reference:url,attack.mitre.org/techniques/T1187/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870000; rev:3;) -alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] Authentication - Anonymous NTLM V1 Logon After Brute Force"; program:Security; event_id:4624; content:"ANONYMOUS LOGON"; content:"NTLM V1"; content:"NtLmSsp"; classtype:credential-access; parse_src_ip:1; json_map:"dest_ip",".xff"; threshold:type suppress,track by_src&by_dst, count 1, seconds 3600; xbits: isset, ntlm_bruteforce, track ip_src; reference:url,attack.mitre.org/techniques/T1187/; metadata:createdOn 2026_06_16, updatedOn 2026_06_16; sid:9870001; rev:1;) +alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Authentication - Anonymous NTLM V1 Logon After Brute Force"; program:Security; event_id:4624; content:"ANONYMOUS LOGON"; content:"NTLM V1"; content:"NtLmSsp"; classtype:credential-access; parse_src_ip:1; json_map:"dest_ip",".xff"; threshold:type suppress,track by_src&by_dst, count 1, seconds 3600; xbits: isset, ntlm_bruteforce, track ip_src; reference:url,attack.mitre.org/techniques/T1187/; metadata:createdOn 2026_06_16, updatedOn 2026_06_16; sid:5017962; rev:1;) -alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] Authentication - Multiple Failed NTLM V1 Logon via NtLmSsp [3/10Mins]"; program:Security; event_id:4625; content:"NTLM V1"; content:"NtLmSsp"; classtype:credential-access; parse_src_ip:1; json_map:"dest_ip",".xff"; after:track by_src,count 3,seconds 600; threshold:type suppress,track by_src,count 1, seconds 3600; xbits: set, ntlm_bruteforce, track ip_src, expire 21600; reference:url,attack.mitre.org/techniques/T1187/; metadata:createdOn 2026_06_16, updatedOn 2026_06_16; sid:9870002; rev:2;) +alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Authentication - Multiple Failed NTLM V1 Logon via NtLmSsp [3/10Mins]"; program:Security; event_id:4625; content:"NTLM V1"; content:"NtLmSsp"; classtype:credential-access; parse_src_ip:1; json_map:"dest_ip",".xff"; after:track by_src,count 3,seconds 600; threshold:type suppress,track by_src,count 1, seconds 3600; xbits: set, ntlm_bruteforce, track ip_src, expire 21600; reference:url,attack.mitre.org/techniques/T1187/; metadata:createdOn 2026_06_16, updatedOn 2026_06_16; sid:5017963; rev:2;) -alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] SMB - Anonymous Access to IPC$ Share"; program:Security; event_id:5140; content:"ANONYMOUS LOGON"; content:"IPC|24|"; classtype:discovery; parse_src_ip:1; json_map:"dest_ip",".xff"; threshold: type suppress, track by_dst, count 1, seconds 21600; xbits:set,smb.anon.ipc,track ip_dst,expire 3600; xbits:noeve; reference:url,attack.mitre.org/techniques/T1135/; metadata:createdOn 2026_06_11, updatedOn 2026_06_30; sid:9870003; rev:2;) +alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] SMB - Anonymous Access to IPC$ Share"; program:Security; event_id:5140; content:"ANONYMOUS LOGON"; content:"IPC|24|"; classtype:discovery; parse_src_ip:1; json_map:"dest_ip",".xff"; threshold: type suppress, track by_dst, count 1, seconds 21600; xbits:set,smb.anon.ipc,track ip_dst,expire 3600; xbits:noeve; reference:url,attack.mitre.org/techniques/T1135/; metadata:createdOn 2026_06_11, updatedOn 2026_06_30; sid:5017964; rev:2;) alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] SMB - Anonymous Access Denied to ADMIN$ Share"; program:Microsoft-Windows-SMBServer/Security; event_id:1007; content:"ADMIN|24|"; classtype:lateral-movement; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1021/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870004; rev:2;) @@ -704,16 +704,16 @@ alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURI alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] Kerberos - Multiple RC4 Service Ticket Requests from Single Source (Kerberoasting)[5/5Mins]"; program:Security; event_id:4769; content:"0x17"; content:!"krbtgt"; classtype:credential-access; parse_src_ip:1; after:track by_src,count 5,seconds 300; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,adsecurity.org/?p=3458; reference:url,attack.mitre.org/techniques/T1558/003/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870008; rev:2;) -alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] Kerberos - AS-REP Roasting Attempt with RC4-Encrypted Ticket"; program:Security; event_id:4768; content:"Pre-Authentication Type|3a| 0"; content:"Ticket Encryption Type|3a| 0x17"; classtype:credential-access; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1558/004/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870009; rev:3;) +alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Kerberos - AS-REP Roasting Attempt with RC4-Encrypted Ticket"; program:Security; event_id:4768; content:"Pre-Authentication Type|3a| 0"; content:"Ticket Encryption Type|3a| 0x17"; classtype:credential-access; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1558/004/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:5017965; rev:3;) -alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] Kerberos - AS-REP Roasting Bulk Enumeration Multiple Accounts RC4"; program:Security; event_id:4768; content:"Pre-Authentication Type|3a| 0"; content:"Ticket Encryption Type|3a| 0x17"; classtype:credential-access; parse_src_ip:1; after:track by_src,count 3,seconds 300; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1558/004/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870010; rev:2;) +alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Kerberos - AS-REP Roasting Bulk Enumeration Multiple Accounts RC4"; program:Security; event_id:4768; content:"Pre-Authentication Type|3a| 0"; content:"Ticket Encryption Type|3a| 0x17"; classtype:credential-access; parse_src_ip:1; after:track by_src,count 3,seconds 300; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1558/004/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:5017966; rev:2;) -alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] AD CS - Certificate Services Template Loaded (Possible Enumeration)"; program:Security; event_id:4898; content:"Certificate Templates"; classtype:discovery; parse_src_ip:1; after:track by_src,count 3,seconds 300; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1649/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870011; rev:2;) +alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] AD CS - Certificate Services Template Loaded (Possible Enumeration)"; program:Security; event_id:4898; content:"Certificate Templates"; classtype:discovery; parse_src_ip:1; after:track by_src,count 3,seconds 300; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1649/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:5017967; rev:2;) alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] AD CS - Certificate Request Received (Possible ESC Exploitation)"; program:Security; event_id:4886; content:"Certificate Services received a certificate request"; classtype:credential-access; parse_src_ip:1; after:track by_src,count 2,seconds 300; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1649/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870012; rev:2;) -alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] Kerberos - SPN Enumeration via setspn.exe"; program:Security; event_id:4688; content:"setspn.exe"; meta_content:"%sagan%",|2d|q,|2f|q; meta_within:10; classtype:discovery; json_map:"src_ip",".xff"; after:track by_src,count 3,seconds 300; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1558/003/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870013; rev:2;) +alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Kerberos - SPN Enumeration via setspn.exe"; program:Security; event_id:4688; content:"setspn.exe"; meta_content:"%sagan%",|2d|q,|2f|q; meta_within:10; classtype:discovery; json_map:"src_ip",".xff"; after:track by_src,count 3,seconds 300; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1558/003/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:5017968; rev:2;) -alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] Kerberos - RC4 Kerberoasting followed by AD CS Template Load"; program:Security; event_id:4898; content:"Certificate Templates"; xbits:isset,kerb.rc4.request,track ip_src; classtype:credential-access; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1649/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:9870014; rev:2;) +alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Kerberos - RC4 Kerberoasting followed by AD CS Template Load"; program:Security; event_id:4898; content:"Certificate Templates"; xbits:isset,kerb.rc4.request,track ip_src; classtype:credential-access; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 3600; reference:url,attack.mitre.org/techniques/T1649/; metadata:createdOn 2026_06_11, updatedOn 2026_06_16; sid:5017969; rev:2;) -alert any any -> $HOME_NET any (msg:"[EXPERIMENTAL][WINDOWS-SECURITY] Kerberos - RC4 Encryption Still Supported by Domain Controller"; program:Security; event_id:4768; content:"Service Name|3a| krbtgt"; content:"RC4"; distance:0; within:200; classtype:policy-violation; priority:3; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 86400; reference:url,attack.mitre.org/techniques/T1558/004/; metadata:createdOn 2026_06_30, updatedOn 2026_06_30; sid:9870027; rev:1;) +alert any any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Kerberos - RC4 Encryption Still Supported by Domain Controller"; program:Security; event_id:4768; content:"Service Name|3a| krbtgt"; content:"RC4"; distance:0; within:200; classtype:policy-violation; priority:3; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 86400; reference:url,attack.mitre.org/techniques/T1558/004/; metadata:createdOn 2026_06_30, updatedOn 2026_06_30; sid:5017970; rev:1;)