diff --git a/rules/README.md b/rules/README.md index 4251b40a15..af383b2384 100644 --- a/rules/README.md +++ b/rules/README.md @@ -1,5 +1,7 @@ # Suricata Reserved SID Allocations +See https://sidallocation.org/ for more information. + Unless otherwise noted, each component or protocol is allocated 1000 signature IDs. diff --git a/rules/app-layer-events.rules b/rules/app-layer-events.rules index 1a792d9840..c1adb02f9f 100644 --- a/rules/app-layer-events.rules +++ b/rules/app-layer-events.rules @@ -1,6 +1,6 @@ # App layer event rules # -# SID's fall in the 2260000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation +# SID's fall in the 2260000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/bittorrent-events.rules b/rules/bittorrent-events.rules index b25ff07d4f..1f071c37e6 100644 --- a/rules/bittorrent-events.rules +++ b/rules/bittorrent-events.rules @@ -1,6 +1,6 @@ # BitTorrent DHT app layer event rules # -# SID's fall in the 2243000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2243000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/decoder-events.rules b/rules/decoder-events.rules index 7688785884..fe3b0027b6 100644 --- a/rules/decoder-events.rules +++ b/rules/decoder-events.rules @@ -1,5 +1,6 @@ # Decoder event signatures for Suricata. -# SID's fall in the 2200000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation +# SID's fall in the 2200000+ range. See rules/README.md + alert pkthdr any any -> any any (msg:"SURICATA IPv4 packet too small"; decode-event:ipv4.pkt_too_small; classtype:protocol-command-decode; sid:2200000; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 header size too small"; decode-event:ipv4.hlen_too_small; classtype:protocol-command-decode; sid:2200001; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA IPv4 total length smaller than header size"; decode-event:ipv4.iplen_smaller_than_hlen; classtype:protocol-command-decode; sid:2200002; rev:2;) diff --git a/rules/dhcp-events.rules b/rules/dhcp-events.rules index c99d9816e8..05db220a34 100644 --- a/rules/dhcp-events.rules +++ b/rules/dhcp-events.rules @@ -1,6 +1,6 @@ # DHCP app-layer event rules. See # -# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# rules/README.md # for SID allocation. alert dhcp any any -> any any (msg:"SURICATA DHCP malformed options"; app-layer-event:dhcp.malformed_options; classtype:protocol-command-decode; sid:2227000; rev:1;) diff --git a/rules/dnp3-events.rules b/rules/dnp3-events.rules index a6e2d9dac8..50b2b95c50 100644 --- a/rules/dnp3-events.rules +++ b/rules/dnp3-events.rules @@ -1,7 +1,6 @@ # DNP3 application decoder event rules. # -# This SIDs fall in the 2270000+ range. See: -# http://doc.emergingthreats.net/bin/view/Main/SidAllocation +# This SIDs fall in the 2270000+ range. See rules/README.md # Flooded. alert dnp3 any any -> any any (msg:"SURICATA DNP3 Request flood detected"; \ diff --git a/rules/enip-events.rules b/rules/enip-events.rules index 6c7efd8e3c..89312bcfa7 100644 --- a/rules/enip-events.rules +++ b/rules/enip-events.rules @@ -1,6 +1,6 @@ # ENIP app layer event rules # -# SID's fall in the 2223000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2223000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/http-events.rules b/rules/http-events.rules index 0815edfee9..ccfe27306e 100644 --- a/rules/http-events.rules +++ b/rules/http-events.rules @@ -1,6 +1,6 @@ # HTTP event rules # -# SID's fall in the 2221000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation +# SID's fall in the 2221000+ range. See rules/README.md # # These sigs fire at most once per HTTP transaction. # diff --git a/rules/http2-events.rules b/rules/http2-events.rules index 74da042e97..5a4fccf51e 100644 --- a/rules/http2-events.rules +++ b/rules/http2-events.rules @@ -1,6 +1,6 @@ # HTTP2 app layer event rules # -# SID's fall in the 2290000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2290000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/ipsec-events.rules b/rules/ipsec-events.rules index 2e5eee4ba6..306dbec45e 100644 --- a/rules/ipsec-events.rules +++ b/rules/ipsec-events.rules @@ -1,6 +1,6 @@ # IPsec app layer event rules # -# SID's fall in the 2224000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2224000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/kerberos-events.rules b/rules/kerberos-events.rules index 523140d415..9e754be856 100644 --- a/rules/kerberos-events.rules +++ b/rules/kerberos-events.rules @@ -1,6 +1,6 @@ # Kerberos app layer event rules # -# SID's fall in the 2226000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2226000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/mqtt-events.rules b/rules/mqtt-events.rules index 57b5821d8b..3dcbe77b68 100644 --- a/rules/mqtt-events.rules +++ b/rules/mqtt-events.rules @@ -1,8 +1,6 @@ # MQTT app-layer event rules. # -# These SIDs fall in the 2228000+ range. See: -# http://doc.emergingthreats.net/bin/view/Main/SidAllocation and -# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# These SIDs fall in the 2228000+ range. See rules/README.md alert mqtt any any -> any any (msg:"SURICATA MQTT CONNECT not seen before CONNACK"; app-layer-event:mqtt.missing_connect; classtype:protocol-command-decode; sid:2229000; rev:1;) alert mqtt any any -> any any (msg:"SURICATA MQTT PUBLISH not seen before PUBACK/PUBREL/PUBREC/PUBCOMP"; app-layer-event:mqtt.missing_publish; classtype:protocol-command-decode; sid:2229001; rev:1;) diff --git a/rules/nfs-events.rules b/rules/nfs-events.rules index 0f86893ad4..95d0b69a3f 100644 --- a/rules/nfs-events.rules +++ b/rules/nfs-events.rules @@ -1,6 +1,6 @@ # NFS app layer event rules # -# SID's fall in the 2223000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2223000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/ntp-events.rules b/rules/ntp-events.rules index fe70337b43..090b6403d6 100644 --- a/rules/ntp-events.rules +++ b/rules/ntp-events.rules @@ -1,6 +1,6 @@ # NTP app layer event rules # -# SID's fall in the 2222000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2222000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/pop3-events.rules b/rules/pop3-events.rules index 8f3c0ba56d..4f3a343c0e 100644 --- a/rules/pop3-events.rules +++ b/rules/pop3-events.rules @@ -1,6 +1,6 @@ # POP3 app-layer event rules # -# SID's fall in the 2236000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2236000+ range. See rules/README.md # alert pop3 any any -> any any (msg:"SURICATA POP3 Too many transactions"; app-layer-event:pop3.too_many_transactions; sid:2236000; rev:1;) alert pop3 any any -> any any (msg:"SURICATA POP3 Request Too Long"; app-layer-event:pop3.request_too_long; flow:to_server; sid:2236001; rev:1;) diff --git a/rules/quic-events.rules b/rules/quic-events.rules index 2267ad6234..b554ba147e 100644 --- a/rules/quic-events.rules +++ b/rules/quic-events.rules @@ -1,8 +1,6 @@ # QUIC app-layer event rules. # -# These SIDs fall in the 2231000+ range. See: -# http://doc.emergingthreats.net/bin/view/Main/SidAllocation and -# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# These SIDs fall in the 2231000+ range. See rules/README.md alert quic any any -> any any (msg:"SURICATA QUIC failed decrypt"; app-layer-event:quic.failed_decrypt; classtype:protocol-command-decode; sid:2231000; rev:1;) alert quic any any -> any any (msg:"SURICATA QUIC error on data"; app-layer-event:quic.error_on_data; classtype:protocol-command-decode; sid:2231001; rev:1;) diff --git a/rules/rfb-events.rules b/rules/rfb-events.rules index 08bc493f42..866a23851b 100644 --- a/rules/rfb-events.rules +++ b/rules/rfb-events.rules @@ -1,8 +1,6 @@ # RFB app-layer event rules. # -# These SIDs fall in the 2233000+ range. See: -# http://doc.emergingthreats.net/bin/view/Main/SidAllocation and -# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# These SIDs fall in the 2233000+ range. See rules/README.md alert rfb any any -> any any (msg:"SURICATA RFB Malformed or unknown message"; app-layer-event:rfb.malformed_message; classtype:protocol-command-decode; sid:2233000; rev:1;) alert rfb any any -> any any (msg:"SURICATA RFB Unimplemented security type"; app-layer-event:rfb.unimplemented_security_type; classtype:protocol-command-decode; sid:2233001; rev:1;) diff --git a/rules/smb-events.rules b/rules/smb-events.rules index 745c2ea2d2..3e631597c4 100644 --- a/rules/smb-events.rules +++ b/rules/smb-events.rules @@ -1,6 +1,6 @@ # SMB app layer event rules # -# SID's fall in the 2225000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2225000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/smtp-events.rules b/rules/smtp-events.rules index a68010dd60..e641e98037 100644 --- a/rules/smtp-events.rules +++ b/rules/smtp-events.rules @@ -1,6 +1,6 @@ # SMTP event rules # -# SID's fall in the 2220000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation +# SID's fall in the 2220000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/snmp-events.rules b/rules/snmp-events.rules index ed13c2136d..f6874f3064 100644 --- a/rules/snmp-events.rules +++ b/rules/snmp-events.rules @@ -1,6 +1,6 @@ # SNMP app layer event rules # -# SID's fall in the 2238000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2238000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/ssh-events.rules b/rules/ssh-events.rules index 99e199c3ad..4a689fadb8 100644 --- a/rules/ssh-events.rules +++ b/rules/ssh-events.rules @@ -1,6 +1,6 @@ # SSH app layer event rules # -# SID's fall in the 2228000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# SID's fall in the 2228000+ range. See rules/README.md # # These sigs fire at most once per connection. # diff --git a/rules/stream-events.rules b/rules/stream-events.rules index 1a7cb38414..a9f51d54eb 100644 --- a/rules/stream-events.rules +++ b/rules/stream-events.rules @@ -1,6 +1,6 @@ # Stream events -- rules for matching on TCP stream engine events. # -# SID's fall in the 2210000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation +# SID's fall in the 2210000+ range. See rules/README.md # alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake with ack in wrong dir"; stream-event:3whs_ack_in_wrong_dir; threshold:type backoff, track by_flow, count 1, multiplier 2; classtype:protocol-command-decode; sid:2210000; rev:3;) alert tcp any any -> any any (msg:"SURICATA STREAM 3way handshake async wrong sequence"; stream-event:3whs_async_wrong_seq; threshold:type backoff, track by_flow, count 1, multiplier 2; classtype:protocol-command-decode; sid:2210001; rev:3;) diff --git a/rules/tls-events.rules b/rules/tls-events.rules index c655570a1a..f7f7b7f51a 100644 --- a/rules/tls-events.rules +++ b/rules/tls-events.rules @@ -1,6 +1,6 @@ # TLS event rules # -# SID's fall in the 2230000+ range. See http://doc.emergingthreats.net/bin/view/Main/SidAllocation +# SID's fall in the 2230000+ range. # # These sigs fire at most once per connection. # diff --git a/rules/websocket-events.rules b/rules/websocket-events.rules index 3acc21132e..f26e314b5c 100644 --- a/rules/websocket-events.rules +++ b/rules/websocket-events.rules @@ -1,8 +1,6 @@ # WebSocket app-layer event rules. # -# These SIDs fall in the 2235000+ range. See: -# http://doc.emergingthreats.net/bin/view/Main/SidAllocation and -# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# These SIDs fall in the 2235000+ range. See rules/README.md alert websocket any any -> any any (msg:"SURICATA Websocket skipped end of payload"; app-layer-event:websocket.skip_end_of_payload; classtype:protocol-command-decode; sid:2235000; rev:1;) alert websocket any any -> any any (msg:"SURICATA Websocket reassembly limit reached"; app-layer-event:websocket.reassembly_limit_reached; classtype:protocol-command-decode; sid:2235001; rev:1;)