poc2_worked

2026-08-15 18:29:36 +02:00
parent fc3a2944b2
commit 71b6c0d86f
62 changed files with 9112 additions and 375 deletions
@@ -0,0 +1,91 @@
+%YAML 1.1
+---
+# MikroSuricata IDS telemetry profile. This file is loaded after Debian's
+# suricata.yaml so the output contract stays stable across package upgrades.
+outputs:
+  # EVE already carries alerts; avoid duplicate fast.log writes.
+  - fast:
+      enabled: no
+      filename: fast.log
+      append: yes
+
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      community-id: true
+      community-id-seed: 0
+      pcap-file: false
+      metadata: yes
+      suricata-version: yes
+      ethernet: yes
+      types:
+        - alert:
+            tagged-packets: yes
+        - anomaly:
+            enabled: yes
+        - http:
+            extended: yes
+        - http2
+        - doh2
+        - dns:
+            version: 3
+            enabled: yes
+            requests: yes
+            responses: yes
+        - mdns
+        - tls:
+            extended: yes
+        - files:
+            force-magic: no
+            force-hash: [sha256]
+        - smtp:
+            extended: yes
+        - ftp
+        - websocket
+        - rdp
+        - nfs
+        - smb
+        - tftp
+        - dcerpc
+        - krb5
+        - snmp
+        - rfb
+        - sip
+        - ldap
+        - pop3
+        - ssh
+        - arp:
+            enabled: yes
+        - quic
+        - dhcp:
+            enabled: yes
+            extended: yes
+        - ike
+        - mqtt
+        - stats:
+            totals: yes
+            threads: no
+            deltas: no
+        - flow
+
+  # Bounded forensic capture: only flows that generated an alert are kept.
+  # The eight 64 MB files cap disk use at roughly 512 MB inside /data/logs/suricata.
+  - pcap-log:
+      enabled: yes
+      filename: alert.pcap
+      limit: 64
+      max-files: 8
+      compression: none
+      mode: normal
+      use-stream-depth: no
+      honor-pass-rules: yes
+      conditional: alerts
+
+  # Runtime stats are already emitted inside EVE and consumed by the app.
+  - stats:
+      enabled: no
+      filename: stats.log
+      append: yes
+      totals: yes
+      threads: no
@@ -36,3 +36,49 @@ alert dns $HOME_NET any -> any 53 (msg:"LOCAL PROD unusually long DNS query labe

 # Cleartext Telnet leaving HOME_NET. One alert per source every ten minutes.
 alert tcp $HOME_NET any -> $EXTERNAL_NET 23 (msg:"LOCAL PROD outbound Telnet session"; flow:established,to_server; threshold: type limit, track by_src, count 1, seconds 600; classtype:policy-violation; priority:2; sid:1000108; rev:1;)
+
+# Repeated NXDOMAIN replies to a HOME_NET client. This can indicate DGA-style
+# beaconing, typo storms or broken/malicious name generation. The threshold is
+# intentionally high enough to avoid alerting on isolated failed lookups.
+alert dns any any -> $HOME_NET any (msg:"LOCAL PROD repeated DNS NXDOMAIN responses"; dns.rcode:NXDOMAIN; threshold: type both, track by_dst, count 30, seconds 60; classtype:bad-unknown; priority:2; sid:1000109; rev:1;)
+
+# High-rate DNS queries from one HOME_NET source. Combined with the long-label
+# rule this adds a rate signal for tunnelling, DGA and resolver abuse.
+alert dns $HOME_NET any -> any 53 (msg:"LOCAL PROD high-rate DNS query activity"; dns.query; pcre:"/.+/"; threshold: type both, track by_src, count 120, seconds 60; classtype:bad-unknown; priority:2; sid:1000110; rev:1;)
+
+# SMB should normally stay inside trusted networks or explicit tunnels. Direct
+# Internet SMB is a strong policy signal and is rate-limited per source.
+alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"LOCAL PROD outbound SMB to external network"; flags:S; flow:stateless; threshold: type limit, track by_src, count 1, seconds 600; classtype:policy-violation; priority:1; sid:1000111; rev:1;)
+
+# Direct SMTP from endpoints is frequently associated with compromised hosts.
+# Mail relays can suppress this SID or scope it with threshold.config.
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"LOCAL PROD direct outbound SMTP"; flags:S; flow:stateless; threshold: type limit, track by_src, count 1, seconds 600; classtype:policy-violation; priority:2; sid:1000112; rev:1;)
+
+# Cleartext FTP leaving HOME_NET. Kept as a policy alert rather than an automatic
+# block because legacy infrastructure may still require it.
+alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"LOCAL PROD outbound cleartext FTP"; flags:S; flow:to_server,stateless; threshold: type limit, track by_src, count 1, seconds 600; classtype:policy-violation; priority:2; sid:1000113; rev:2;)
+
+# Common database/search service ports should not normally be reachable directly
+# from the Internet. This detects exposure/probing without alerting on every SYN.
+alert tcp $EXTERNAL_NET any -> $HOME_NET [3306,5432,6379,9200,27017] (msg:"LOCAL PROD external access to database service"; flags:S; flow:stateless; threshold: type limit, track by_src, count 1, seconds 300; classtype:attempted-admin; priority:1; sid:1000114; rev:1;)
+
+# Burst of administrative/lateral-movement connection attempts inside HOME_NET.
+# Normal single RDP/SMB sessions do not trigger this rule.
+alert tcp $HOME_NET any -> $HOME_NET [445,3389] (msg:"LOCAL PROD possible internal lateral movement burst"; flags:S; flow:stateless; threshold: type both, track by_src, count 40, seconds 30; classtype:attempted-admin; priority:1; sid:1000115; rev:1;)
+
+# Multi-stage state tracking with Suricata 8 xbits. A scan burst marks the
+# source for ten minutes; a later hit on an administrative service becomes a
+# higher-confidence correlated alert instead of treating both events in isolation.
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"LOCAL NDR mark external scanner"; flags:S; flow:stateless; threshold: type threshold, track by_src, count 30, seconds 10; xbits:set,ms_ext_scanner,track ip_src,expire 600; noalert; sid:1000120; rev:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET [22,445,3389,8291] (msg:"LOCAL NDR scan followed by administrative service access"; flags:S; flow:stateless; xbits:isset,ms_ext_scanner,track ip_src; threshold: type limit, track by_src, count 1, seconds 300; classtype:attempted-admin; priority:1; sid:1000121; rev:1;)
+
+# The same idea for east-west traffic. This is deliberately burst-based so a
+# normal single SMB/RDP/SSH connection does not mark a workstation.
+alert tcp $HOME_NET any -> $HOME_NET any (msg:"LOCAL NDR mark internal lateral probe"; flags:S; flow:stateless; threshold: type threshold, track by_src, count 35, seconds 20; xbits:set,ms_lateral_probe,track ip_src,expire 900; noalert; sid:1000122; rev:1;)
+alert tcp $HOME_NET any -> $HOME_NET [22,445,3389,5985,5986,8291] (msg:"LOCAL NDR lateral probe followed by administrative access"; flags:S; flow:stateless; xbits:isset,ms_lateral_probe,track ip_src; threshold: type limit, track by_src, count 1, seconds 300; classtype:attempted-admin; priority:1; sid:1000123; rev:1;)
+
+
+# RouterOS API/API-SSL should normally be restricted to trusted administration
+# networks. Repeated Internet connection attempts are a MikroTik-specific
+# management-plane signal similar to WinBox probing.
+alert tcp $EXTERNAL_NET any -> $HOME_NET [8728,8729] (msg:"LOCAL PROD repeated RouterOS API connection attempts"; flags:S; flow:stateless; threshold: type both, track by_src, count 8, seconds 60; classtype:attempted-admin; priority:1; sid:1000116; rev:1;)