gru/routeros-suricata-tzsp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

worked poc

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-14 11:33:01 +02:00
parent adfdb0b86c
commit fc3a2944b2
94 changed files with 2931 additions and 3412 deletions
Download Patch File Download Diff File Expand all files Collapse all files
suricata/local.rules
+38 -2
View File
@@ -1,2 +1,38 @@
# Local deterministic pipeline test. send_test_tzsp.py emits ICMP echo requests.
alert icmp any any -> any any (msg:"LOCAL TZSP PIPELINE TEST"; itype:8; classtype:bad-unknown; sid:1000001; rev:1;)
# RouterOS Suricata TZSP - built-in rules.
#
# SID 1000001 is reserved for the deterministic pipeline self-test. It only
# matches the marker emitted by scripts/send_test_tzsp.py, so normal ICMP/ping
# traffic cannot trigger it. The application also ignores this SID in the
# incident database by default.
alert icmp any any -> any any (msg:"LOCAL TEST TZSP PIPELINE MARKER"; itype:8; content:"routeros-suricata-tzsp-selftest"; nocase; classtype:misc-activity; priority:3; sid:1000001; rev:3;)
# Conservative production baseline. ET/Open is baked into the image as the
# vendor ruleset; these local rules add a few rate-based detections that are
# useful on a mirrored RouterOS edge without alerting on single packets.
# Repeated external SSH connection attempts against HOME_NET.
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"LOCAL PROD repeated SSH connection attempts"; flags:S; flow:stateless; threshold: type both, track by_src, count 10, seconds 60; classtype:attempted-admin; priority:1; sid:1000101; rev:1;)
# Repeated external RDP connection attempts against HOME_NET.
alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"LOCAL PROD repeated RDP connection attempts"; flags:S; flow:stateless; threshold: type both, track by_src, count 8, seconds 60; classtype:attempted-admin; priority:1; sid:1000102; rev:1;)
# Repeated access attempts to RouterOS WinBox from outside HOME_NET.
alert tcp $EXTERNAL_NET any -> $HOME_NET 8291 (msg:"LOCAL PROD repeated RouterOS WinBox connection attempts"; flags:S; flow:stateless; threshold: type both, track by_src, count 8, seconds 60; classtype:attempted-admin; priority:1; sid:1000103; rev:1;)
# High-rate SYN activity against HOME_NET. The threshold intentionally requires
# a burst to avoid treating ordinary connection setup as a scan.
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"LOCAL PROD possible TCP SYN scan"; flags:S; flow:stateless; threshold: type both, track by_src, count 40, seconds 10; classtype:attempted-recon; priority:2; sid:1000104; rev:1;)
# High-rate ICMP echo requests from one external source.
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"LOCAL PROD possible ICMP sweep"; itype:8; threshold: type both, track by_src, count 20, seconds 10; classtype:attempted-recon; priority:2; sid:1000105; rev:1;)
# Direct inbound SMB from outside HOME_NET. Rate-limited because some networks
# intentionally expose SMB over controlled tunnels or provider networks.
alert tcp $EXTERNAL_NET any -> $HOME_NET [139,445] (msg:"LOCAL PROD inbound SMB from external network"; flags:S; flow:stateless; threshold: type limit, track by_src, count 1, seconds 300; classtype:policy-violation; priority:2; sid:1000106; rev:1;)
# Very long first DNS labels can be a tunnelling/exfiltration signal. A single
# source can create at most one alert every five minutes for this local rule.
alert dns $HOME_NET any -> any 53 (msg:"LOCAL PROD unusually long DNS query label"; dns.query; pcre:"/^[A-Za-z0-9_-]{48,}\./"; threshold: type limit, track by_src, count 1, seconds 300; classtype:bad-unknown; priority:2; sid:1000107; rev:1;)
# Cleartext Telnet leaving HOME_NET. One alert per source every ten minutes.
alert tcp $HOME_NET any -> $EXTERNAL_NET 23 (msg:"LOCAL PROD outbound Telnet session"; flow:established,to_server; threshold: type limit, track by_src, count 1, seconds 600; classtype:policy-violation; priority:2; sid:1000108; rev:1;)