bittorrent: add bittorrent-events.rules file

Add a file containing rules to match bittorrent protocol events. Ticket: 8421
3 months ago · 42123cc8d9
parent cff3d6417a
commit 42123cc8d9
3 changed files with 9 additions and 0 deletions
--- a/rules/Makefile.am
+++ b/rules/Makefile.am
@ -2,6 +2,7 @@ ruledir = $(datadir)/suricata/rules

 dist_rule_DATA = \
 app-layer-events.rules \
+bittorrent-events.rules \
 decoder-events.rules \
 dhcp-events.rules \
 dnp3-events.rules \
--- a/rules/README.md
+++ b/rules/README.md
@ -34,6 +34,7 @@ signature IDs.
 | DNS      | 2240000 | 2240999 |
 | PGSQL    | 2241000 | 2241999 |
 | mDNS     | 2242000 | 2242999 |
+| Bittorent| 2243000 | 2243999 |
 | MODBUS   | 2250000 | 2250999 |
 | DNP3     | 2270000 | 2270999 |
 | HTTP2    | 2290000 | 2290999 |
--- a/rules/bittorrent-events.rules
+++ b/rules/bittorrent-events.rules
@ -0,0 +1,7 @@
+# BitTorrent DHT app layer event rules
+#
+# SID's fall in the 2243000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+#
+# These sigs fire at most once per connection.
+#
+alert bittorrent-dht any any -> any any (msg:"SURICATA BitTorrent DHT malformed packet"; app-layer-event:bittorrent-dht.malformed_packet; classtype:protocol-command-decode; sid:2243000; rev:1;)