1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
|
FTP/FTP-DATA Keywords
=====================
.. role:: example-rule-options
ftpdata_command
---------------
Filter ftp-data channel based on command used on the FTP command channel.
Currently supported commands are RETR (get on a file) and STOR (put on a
file).
Syntax::
ftpdata_command:(retr|stor)
Signature Example:
.. container:: example-rule
alert ftp-data any any -> any any (msg:"FTP store password"; \
filestore; filename:"password"; \
:example-rule-options:`ftpdata_command:stor;` sid:3; rev:1;)
ftpbounce
---------
Detect FTP bounce attacks.
Syntax::
ftpbounce
file.name
---------
The ``file.name`` keyword can be used at the FTP application level.
Signature Example:
.. container:: example-rule
alert ftp-data any any -> any any (msg:"FTP file.name usage"; \
:example-rule-options:`file.name; content:"file.txt";` \
classtype:bad-unknown; sid:1; rev:1;)
For additional information on the ``file.name`` keyword, see :doc:`file-keywords`.
ftp.command
-----------
This keyword matches on the command name from an FTP client request. ``ftp.command``
is a sticky buffer and can be used as a fast pattern.
Syntax::
ftp.command; content: <command>;
Signature Example:
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.command; content:"PASS";` sid: 1;)
Examples of commands are:
* USER
* PASS
* PORT
* EPRT
* PASV
* RETR
ftp.command_data
----------------
This keyword matches on the command data from a FTP client request.
``ftp.command_data`` is a sticky buffer and can be used as a fast pattern.
Syntax::
ftp.command_data; content: <command_data>;
Signature Example:
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.command_data; content:"anonymous";` sid: 1;)
The ``ftp.command_data`` matches the data associated with an FTP command. Consider the following FTP command
examples::
USER anonymous
RETR temp.txt
PORT 192,168,0,13,234,10
Example rules for each of the preceding FTP commands and command data.
.. container:: example-rule
alert ftp any any -> any any (ftp.command; content: "USER"; :example-rule-options:`ftp.command_data; content:"anonymous";` sid: 1;)
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.command_data; content:"anonymous";` sid: 1;)
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.command_data; content:"temp.txt";` sid: 2;)
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.command_data; content:"192,168,0,13,234,10";` sid: 3;)
ftp.completion_code
-------------------
This keyword matches on an FTP completion code string. Note that there may be multiple reply strings for
an FTP command and hence, multiple completion code values to check. ``ftp.completion_code`` is a sticky buffer
and can be used as a fast pattern. Do not include the response string in the `content` to match upon (see examples).
Syntax::
ftp.completion_code; content: <quoted-completion-code>;
Signature Example:
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.completion_code; content:"226";` sid: 1;)
.. note ::
FTP commands can return multiple reply strings. Specify a single completion code for each ``ftp.completion_code`` keyword.
This example shows an FTP command (``RETR``) followed by an FTP reply with multiple response strings.
::
RETR temp.txt
150 Opening BINARY mode data connection for temp.txt (1164 bytes).
226 Transfer complete.
Because there are multiple completion codes and responses, the rule can match on
``ftp.reply`` and the ``ftp.completion_code``. Suricata cannot guarantee that
these come from the `same response`, however.
Signature Examples:
.. container:: example-rule
alert ftp any any -> any any (ftp.reply; content:"Opening BINARY mode data connection for temp."; \
:example-rule-options:`ftp.completion_code; content: "150";` sid: 1;)
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.completion_code; content: "226";` sid: 2;)
.. container:: example-rule
alert ftp any any -> any any (
ftp.reply; content: "Transfer complete.";
:example-rule-options:`ftp.completion_code; content: "226";` sid: 3;)
ftp.dynamic_port
----------------
This keyword matches on the dynamic port negotiated during an FTP session with
the following FTP commands:
* IPv4: ``PORT`` and ``EPRT``
* IPv6: ``PASV`` and ``EPSV``
Syntax::
ftp.dynamic_port: <port-spec>;
``port-spec`` can be one of the following:
* ``>`` (greater than)
* ``<`` (less than)
* ``>=`` (greater than or equal)
* ``<=`` (less than or equal)
* ``arg1-arg2`` (exclusive range)
Signature Example:
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.dynamic_port: 59914;` sid: 1;)
These rules are will also alert on port ``59914``:
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.dynamic_port: 59913-59915;` sid: 1;)
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.dynamic_port: =59914;` sid: 1;)
Example rules combining ``ftp.dynamic_port`` with ``ftp.command``
.. container:: example-rule
alert ftp any any -> any any (ftp.command; content: "PORT"; :example-rule-options:`ftp.dynamic_port: 59914;` sid: 1;)
.. container:: example-rule
alert ftp any any -> any any (ftp.command; content: "EPSV"; :example-rule-options:`ftp.dynamic_port: 58612;` sid: 1;)
ftp.mode
--------
This keyword matches on whether the FTP session is dynamic or passive.
In `active` mode sessions, the server establishes the data channel.
In `passive` mode, the client establishes the data channel. Active
mode sessions are established in part with the ``PORT`` (``EPRT`` for IPv6)
command; passive mode sessions use ``PASV`` (``EPSV`` for IPv6).
Syntax::
ftp.mode: active|passive;
Signature Example:
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.mode: active;` sid: 1;)
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.mode: passive;` sid: 1;)
Example rules combining ``ftp.command`` with ``ftp.mode``
.. container:: example-rule
alert ftp any any -> any any (ftp.command; content: "PORT"; :example-rule-options:`ftp.mode: active;` sid:1;)
.. container:: example-rule
alert ftp any any -> any any (ftp.command; content: "PASV"; :example-rule-options:`ftp.mode: passive;` sid:1;)
ftp.reply
---------
This keyword matches on an FTP reply string. Note that there may be multiple reply strings for
an FTP command. ``ftp.reply`` is a sticky buffer and can be used as a fast pattern. Do not
include the completion code in the `content` to match upon (see examples).
Syntax::
ftp.reply; content: <reply-string>;
.. note ::
FTP commands can return multiple reply strings. Specify a single reply for each ``ftp.reply`` keyword.
This example shows an FTP command (``RETR``) followed by an FTP reply with multiple response strings.
::
RETR temp.txt
150 Opening BINARY mode data connection for temp.txt (1164 bytes).
226 Transfer complete.
Signature Example:
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.reply; content:"Please specify the password.";` sid: 1;)
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.reply; content:"Opening BINARY mode data connection for temp.";` sid: 1;)
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.reply; content:"Transfer complete.";` sid: 2;)
ftp.reply_received
------------------
This keyword matches on whether an FTP reply string was received. EVE logs
with the FTP event_type include a field named ``reply_received``. Use this
keyword to alert when a reply is (is not) received. ``ftp.reply_received``
is not a sticky buffer and uses a different syntax to express its value.
.. note ::
Specify the match value without using quotes, e.g., use yes instead of "yes".
Syntax::
ftp.reply_received: yes|on|true|1|no|off|false|0;
Signature Example:
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.reply_received: yes;` sid: 1;)
.. container:: example-rule
alert ftp any any -> any any (:example-rule-options:`ftp.reply_received: no;` sid: 1;)
|
