diff --git a/doc/userguide/rules/dhcp-keywords.rst b/doc/userguide/rules/dhcp-keywords.rst index cc4ca1001e..9b7de9cac1 100644 --- a/doc/userguide/rules/dhcp-keywords.rst +++ b/doc/userguide/rules/dhcp-keywords.rst @@ -18,7 +18,7 @@ The time can be matched exactly, or compared using the _op_ setting:: dhcp.leasetime:<3 # smaller than 3 dhcp.leasetime:>=2 # greater or equal than 2 -Signature example:: +.. container:: example-rule alert dhcp any any -> any any (msg:"small DHCP lease time (<3)"; dhcp.leasetime:<3; sid:1; rev:1;) @@ -39,7 +39,7 @@ The time can be matched exactly, or compared using the _op_ setting:: dhcp.rebinding_time:<3 # smaller than 3 dhcp.rebinding_time:>=2 # greater or equal than 2 -Signature example:: +.. container:: example-rule alert dhcp any any -> any any (msg:"small DHCP rebinding time (<3)"; dhcp.rebinding_time:<3; sid:1; rev:1;) @@ -60,6 +60,6 @@ The time can be matched exactly, or compared using the _op_ setting:: dhcp.renewal_time:<3 # smaller than 3 dhcp.renewal_time:>=2 # greater or equal than 2 -Signature example:: +.. container:: example-rule alert dhcp any any -> any any (msg:"small DHCP renewal time (<3)"; dhcp.renewal_time:<3; sid:1; rev:1;) \ No newline at end of file diff --git a/doc/userguide/rules/flow-keywords.rst b/doc/userguide/rules/flow-keywords.rst index 0a2cc60c37..0f6b7f4dda 100644 --- a/doc/userguide/rules/flow-keywords.rst +++ b/doc/userguide/rules/flow-keywords.rst @@ -315,9 +315,9 @@ The time can be matched exactly, or compared using the _op_ setting:: flow.age:<3 # smaller than 3 seconds flow.age:>=2 # greater or equal than 2 seconds -Signature example:: +.. container:: example-rule - alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: onehourflow, name; sid:1; rev:1;) + alert tcp any any -> any any (msg:"Flow longer than one hour"; flow.age:>3600; flowbits: isnotset, onehourflow; flowbits: set, onehourflow; sid:1; rev:1;) In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour. @@ -348,7 +348,7 @@ The number of packets can be matched exactly, or compared using the _op_ setting flow.pkts:toserver,<3 # smaller than 3 flow.pkts:either,>=2 # greater than or equal to 2 -Signature example:: +.. container:: example-rule alert ip any any -> any any (msg:"Flow has 20 packets in toclient dir"; flow.pkts:toclient,20; sid:1;) @@ -383,7 +383,7 @@ The number of bytes can be matched exactly, or compared using the _op_ setting:: flow.bytes:toserver,<3 # smaller than 3 flow.bytes:either,>=2 # greater than or equal to 2 -Signature example:: +.. container:: example-rule alert ip any any -> any any (msg:"Flow has less than 2000 bytes in toserver dir"; flow.bytes:toserver,<2000; sid:1;) @@ -413,7 +413,7 @@ Syntax:: flow.elephant: -Signature example:: +.. container:: example-rule alert tcp any any -> any any (msg:"Flow is elephant in toserver dir"; flow.elephant:toserver; sid:1;) diff --git a/doc/userguide/rules/kerberos-keywords.rst b/doc/userguide/rules/kerberos-keywords.rst index a52ff9f4e1..5e6a7de65d 100644 --- a/doc/userguide/rules/kerberos-keywords.rst +++ b/doc/userguide/rules/kerberos-keywords.rst @@ -46,7 +46,7 @@ Syntax:: krb5_cname; content:"name"; -Signature example:: +.. container:: example-rule alert krb5 any any -> any any (msg:"Kerberos 5 des server name"; krb5_cname; content:"des"; sid:4; rev:1;) @@ -71,7 +71,7 @@ Syntax:: krb5_sname; content:"name"; -Signature example:: +.. container:: example-rule alert krb5 any any -> any any (msg:"Kerberos 5 krbtgt server name"; krb5_sname; content:"krbtgt"; sid:5; rev:1;) @@ -92,7 +92,7 @@ Syntax:: krb5_err_code: -Signature example:: +.. container:: example-rule alert krb5 any any -> any any (msg:"Kerberos 5 error C_PRINCIPAL_UNKNOWN"; krb5_err_code:6; sid:6; rev:1;) @@ -107,7 +107,7 @@ Syntax:: app-layer-event:krb5.weak_encryption -Signature example:: +.. container:: example-rule alert krb5 any any -> any any (msg:"SURICATA Kerberos 5 weak encryption parameters"; flow:to_client; app-layer-event:krb5.weak_encryption; classtype:protocol-command-decode; sid:2226001; rev:1;) @@ -120,7 +120,7 @@ Syntax:: app-layer-event:krb5.malformed_data -Signature example:: +.. container:: example-rule alert krb5 any any -> any any (msg:"SURICATA Kerberos 5 malformed request data"; flow:to_server; app-layer-event:krb5.malformed_data; classtype:protocol-command-decode; sid:2226000; rev:1;) @@ -135,8 +135,14 @@ Syntax:: krb5.ticket_encryption: (!)"weak" or (space or comma)-separated list of integer or string values for an encryption type -Signature example:: +.. container:: example-rule alert krb5 any any -> any any (krb5.ticket_encryption: weak; sid:1;) + +.. container:: example-rule + alert krb5 any any -> any any (krb5.ticket_encryption: 23; sid:2;) + +.. container:: example-rule + alert krb5 any any -> any any (krb5.ticket_encryption: rc4-hmac,rc4-hmac-exp; sid:3;) \ No newline at end of file diff --git a/doc/userguide/rules/smtp-keywords.rst b/doc/userguide/rules/smtp-keywords.rst index ecedd436ef..64814015a2 100644 --- a/doc/userguide/rules/smtp-keywords.rst +++ b/doc/userguide/rules/smtp-keywords.rst @@ -30,7 +30,7 @@ Syntax:: smtp.helo; content:"localhost"; -Signature example:: +.. container:: example-rule alert smtp any any -> any any (msg:"SMTP helo localhost"; smtp.helo; content:"localhost"; sid:2; rev:1;) @@ -49,7 +49,7 @@ Syntax:: smtp.mail_from; content:"spam"; -Signature example:: +.. container:: example-rule alert smtp any any -> any any (msg:"SMTP mail from spam"; smtp.mail_from; content:"spam"; sid:2; rev:1;) @@ -68,7 +68,7 @@ Syntax:: smtp.rcpt_to; content:"sensitive@target"; -Signature example:: +.. container:: example-rule alert smtp any any -> any any (msg:"SMTP rcpt to sensitive"; smtp.rcpt_to; content:"sensitive@target"; sid:2; rev:1;) diff --git a/doc/userguide/rules/snmp-keywords.rst b/doc/userguide/rules/snmp-keywords.rst index e6883b8f88..18be705e39 100644 --- a/doc/userguide/rules/snmp-keywords.rst +++ b/doc/userguide/rules/snmp-keywords.rst @@ -18,7 +18,7 @@ The version can be matched exactly, or compared using the _op_ setting:: snmp.version:<3 # smaller than 3 snmp.version:>=2 # greater or equal than 2 -Signature example:: +.. container:: example-rule alert snmp any any -> any any (msg:"old SNMP version (<3)"; snmp.version:<3; sid:1; rev:1;) @@ -38,7 +38,7 @@ Syntax:: snmp.community; content:"private"; -Signature example:: +.. container:: example-rule alert snmp any any -> any any (msg:"SNMP community private"; snmp.community; content:"private"; sid:2; rev:1;) @@ -58,7 +58,7 @@ Syntax:: snmp.usm; content:"admin"; -Signature example:: +.. container:: example-rule alert snmp any any -> any any (msg:"SNMP usm admin"; snmp.usm; content:"admin"; sid:2; rev:1;) @@ -93,7 +93,7 @@ Syntax:: snmp.pdu_type:(mode) -Signature example:: +.. container:: example-rule alert snmp any any -> any any (msg:"SNMP response"; snmp.pdu_type:2; sid:3; rev:1;) diff --git a/doc/userguide/rules/ssh-keywords.rst b/doc/userguide/rules/ssh-keywords.rst index dcb9f4dba2..71e01ed41b 100644 --- a/doc/userguide/rules/ssh-keywords.rst +++ b/doc/userguide/rules/ssh-keywords.rst @@ -90,7 +90,7 @@ ssh.hassh Match on hassh (md5 of hassh algorithms of client). -Example:: +.. container:: example-rule alert ssh any any -> any any (msg:"match hassh"; \ ssh.hassh; content:"ec7378c1a92f5a8dde7e8b7a1ddf33d1";\ @@ -105,7 +105,7 @@ ssh.hassh.string Match on Hassh string (hassh algorithms of client). -Example:: +.. container:: example-rule alert ssh any any -> any any (msg:"match hassh-string"; \ ssh.hassh.string; content:"none,zlib@openssh.com,zlib"; \ @@ -120,7 +120,7 @@ ssh.hassh.server Match on hassh (md5 of hassh algorithms of server). -Example:: +.. container:: example-rule alert ssh any any -> any any (msg:"match SSH hash-server"; \ ssh.hassh.server; content:"b12d2871a1189eff20364cf5333619ee"; \ @@ -135,7 +135,7 @@ ssh.hassh.server.string Match on hassh string (hassh algorithms of server). -Example:: +.. container:: example-rule alert ssh any any -> any any (msg:"match SSH hash-server-string"; \ ssh.hassh.server.string; content:"umac-64-etm@openssh.com,umac-128-etm@openssh.com"; \ diff --git a/doc/userguide/rules/tls-keywords.rst b/doc/userguide/rules/tls-keywords.rst index 8dae1a1f70..ddc1618250 100644 --- a/doc/userguide/rules/tls-keywords.rst +++ b/doc/userguide/rules/tls-keywords.rst @@ -72,10 +72,10 @@ tls.cert_serial Match on the serial number in a certificate. -Example:: +.. container:: example-rule - alert tls any any -> any any (msg:"match cert serial"; \ - tls.cert_serial; content:"5C:19:B7:B1:32:3B:1C:A1"; sid:200012;) + alert tls any any -> any any (msg:"match cert serial"; + tls.cert_serial; content:"5C:19:B7:B1:32:3B:1C:A1"; sid:200012;) ``tls.cert_serial`` is a 'sticky buffer'. @@ -90,12 +90,12 @@ tls.cert_fingerprint Match on the SHA-1 fingerprint of the certificate. -Example:: +.. container:: example-rule - alert tls any any -> any any (msg:"match cert fingerprint"; \ - tls.cert_fingerprint; \ - content:"4a:a3:66:76:82:cb:6b:23:bb:c3:58:47:23:a4:63:a7:78:a4:a1:18"; \ - sid:200023;) + alert tls any any -> any any (msg:"match cert fingerprint"; + tls.cert_fingerprint; + content:"4a:a3:66:76:82:cb:6b:23:bb:c3:58:47:23:a4:63:a7:78:a4:a1:18"; + sid:200023;) ``tls.cert_fingerprint`` is a 'sticky buffer'. @@ -143,7 +143,7 @@ tls_cert_notbefore Match on the NotBefore field in a certificate. -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"match cert NotBefore"; \ tls_cert_notbefore:1998-05-01<>2008-05-01; sid:200005;) @@ -153,7 +153,7 @@ tls_cert_notafter Match on the NotAfter field in a certificate. -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"match cert NotAfter"; \ tls_cert_notafter:>2015; sid:200006;) @@ -190,10 +190,10 @@ tls.certs Do a "raw" match on each of the certificates in the TLS certificate chain. -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"match bytes in TLS cert"; tls.certs; \ - content:"|06 09 2a 86|"; sid:200070;) + content:"\|06 09 2a 86\|"; sid:200070;) ``tls.certs`` is a 'sticky buffer'. @@ -225,14 +225,14 @@ Match version of SSL/TLS record. Supported values "sslv2", "sslv3", "tls1.0", "tls1.1", "tls1.2", "tls1.3" -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"match TLSv1.2"; \ ssl_version:tls1.2; sid:200030;) It is also possible to match on several versions at the same time. -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"match SSLv2 and SSLv3"; \ ssl_version:sslv2,sslv3; sid:200031;) @@ -275,10 +275,10 @@ tls.random Matches on the 32 bytes of the TLS random field from the client hello or server hello records. -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"TLS random test"; \ - tls.random; content:"|9b ce 7a 5e 57 5d 77 02 07 c2 9d be 24 01 cc f0 5d cd e1 d2 a5 86 9c 4a 3e ee 38 db 55 1a d9 bc|"; sid: 200074;) + tls.random; content:"\|9b ce 7a 5e 57 5d 77 02 07 c2 9d be 24 01 cc f0 5d cd e1 d2 a5 86 9c 4a 3e ee 38 db 55 1a d9 bc\|"; sid: 200074;) ``tls.random`` is a sticky buffer. @@ -287,10 +287,10 @@ tls.random_time Matches on the first 4 bytes of the TLS random field from the client hello or server hello records. -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"TLS random_time test"; \ - tls.random_time; content:"|9b ce 7a 5e|"; sid: 200075;) + tls.random_time; content:"\|9b ce 7a 5e\|"; sid: 200075;) ``tls.random_time`` is a sticky buffer. @@ -299,10 +299,10 @@ tls.random_bytes Matches on the last 28 bytes of the TLS random field from the client hello or server hello records. -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"TLS random_bytes test"; \ - tls.random_bytes; content:"|57 5d 77 02 07 c2 9d be 24 01 cc f0 5d cd e1 d2 a5 86 9c 4a 3e ee 38 db 55 1a d9 bc|"; sid: 200076;) + tls.random_bytes; content:"\|57 5d 77 02 07 c2 9d be 24 01 cc f0 5d cd e1 d2 a5 86 9c 4a 3e ee 38 db 55 1a d9 bc\|"; sid: 200076;) ``tls.random_bytes`` is a sticky buffer. @@ -315,29 +315,37 @@ tls.cert_chain_len uses an :ref:`unsigned 32-bit integer , <>, !` and using an exact value. -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"cert chain exact value"; \ - tls.cert_chain_len:1; classtype:misc-activity; sid:1; rev:1;) + tls.cert_chain_len:1; classtype:misc-activity; sid:1; rev:1;) + +.. container:: example-rule alert tls any any -> any any (msg:"cert chain less than value"; \ - tls.cert_chain_len:<2; classtype:misc-activity; sid:2; rev:1;) + tls.cert_chain_len:<2; classtype:misc-activity; sid:2; rev:1;) + +.. container:: example-rule alert tls any any -> any any (msg:"cert chain greater than value"; \ - tls.cert_chain_len:>0; classtype:misc-activity; sid:2; rev:1;) + tls.cert_chain_len:>0; classtype:misc-activity; sid:2; rev:1;) + +.. container:: example-rule alert tls any any -> any any (msg:"cert chain greater than less than value";\ - tls.cert_chain_len:0<>2; classtype:misc-activity; sid:3; rev:1;) + tls.cert_chain_len:0<>2; classtype:misc-activity; sid:3; rev:1;) + +.. container:: example-rule alert tls any any -> any any (msg:"cert chain not value"; \ - tls.cert_chain_len:!2; classtype:misc-activity; sid:4; rev:1;) + tls.cert_chain_len:!2; classtype:misc-activity; sid:4; rev:1;) tls.alpn -------- Matches on the ALPN buffers. -Example:: +.. container:: example-rule alert tls any any -> any any (msg:"TLS ALPN test"; \ tls.alpn; content:"http/1.1"; sid:1;)