From cff3d6417a601b310f56687dac88141b0507bfdd Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 29 Apr 2026 15:03:36 +0200 Subject: [PATCH] snmp: add snmp-events.rules file Add a file containing rules to match SNMP protocol events. Ticket: 8421 --- rules/Makefile.am | 1 + rules/README.md | 1 + rules/snmp-events.rules | 9 +++++++++ 3 files changed, 11 insertions(+) create mode 100644 rules/snmp-events.rules diff --git a/rules/Makefile.am b/rules/Makefile.am index faa85668e3..f176abb61e 100644 --- a/rules/Makefile.am +++ b/rules/Makefile.am @@ -25,6 +25,7 @@ quic-events.rules \ rfb-events.rules \ smb-events.rules \ smtp-events.rules \ +snmp-events.rules \ ssh-events.rules \ stream-events.rules \ tls-events.rules \ diff --git a/rules/README.md b/rules/README.md index a0c031256f..396ab1bacc 100644 --- a/rules/README.md +++ b/rules/README.md @@ -30,6 +30,7 @@ signature IDs. | FTP | 2232000 | 2232999 | | POP3 | 2236000 | 2236999 | | LDAP | 2237000 | 2237999 | +| SNMP | 2238000 | 2238999 | | DNS | 2240000 | 2240999 | | PGSQL | 2241000 | 2241999 | | mDNS | 2242000 | 2242999 | diff --git a/rules/snmp-events.rules b/rules/snmp-events.rules new file mode 100644 index 0000000000..ed13c2136d --- /dev/null +++ b/rules/snmp-events.rules @@ -0,0 +1,9 @@ +# SNMP app layer event rules +# +# SID's fall in the 2238000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# +# These sigs fire at most once per connection. +# +alert snmp any any -> any any (msg:"SURICATA SNMP malformed data"; app-layer-event:snmp.malformed_data; classtype:protocol-command-decode; sid:2238000; rev:1;) +alert snmp any any -> any any (msg:"SURICATA SNMP unknown security model"; app-layer-event:snmp.unknown_security_model; classtype:protocol-command-decode; sid:2238001; rev:1;) +alert snmp any any -> any any (msg:"SURICATA SNMP version mismatch"; app-layer-event:snmp.version_mismatch; classtype:protocol-command-decode; sid:2238002; rev:1;)