UTMSTACK logoUTMSTACK logo
NIDS / Suricata

Detection rules for NIDS / Suricata data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 33 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
ARP Spoofing DetectionNetwork AttackT1557.002 - Adversary-in-the-Middle: ARP Cache PoisoningC:3 / I:3 / A:2
Baby Shark C2 Communication Pattern DetectedCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:3 / A:2
Base64-Encoded DNS Query DetectedExfiltrationT1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 ProtocolC:3 / I:2 / A:1
Base64-Encoded User Agent String DetectedCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:2 / I:2 / A:1
Cobalt Strike DNS Beacon Pattern DetectedCommand and ControlT1071.004 - Application Layer Protocol: DNSC:3 / I:3 / A:2
Cobalt Strike Malleable C2 Profile DetectedCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:3 / A:2
Command and Control Traffic DetectionCommand and ControlT1095 - Non-Application Layer ProtocolC:3 / I:3 / A:2
Covert Channel DetectionExfiltrationCovert Channel CommunicationC:3 / I:2 / A:1
Cryptocurrency Mining Pool DNS Lookup DetectedResource HijackingT1496 - Resource HijackingC:1 / I:1 / A:3
DDoS Attack PatternsImpactT1498 - Network Denial of ServiceC:1 / I:2 / A:3
DNS Query to Out-of-Band Interaction DomainInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:2 / A:1
DNS TXT Record Contains Execution StringsCommand and ControlT1071.004 - Application Layer Protocol: DNSC:3 / I:3 / A:2
DNS Tunneling DetectionCommand and ControlT1071.004 - Application Layer Protocol: DNSC:2 / I:2 / A:1
Data Exfiltration Pattern DetectionExfiltrationT1048 - Exfiltration Over Alternative ProtocolC:3 / I:1 / A:1
Exploit Attempt DetectionLateral MovementT1210 - Exploitation of Remote ServicesC:3 / I:3 / A:2
Exploit Framework User Agent Detected in HTTP TrafficCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:3 / A:2
Hack Tool User Agent Detected in HTTP TrafficReconnaissanceT1595.002 - Active Scanning: Vulnerability ScanningC:2 / I:2 / A:1
ICMP Tunneling Detection via SuricataCommand and ControlT1572 - Protocol TunnelingC:3 / I:2 / A:2
IPFS-Based Credential Harvesting Page AccessCredential AccessT1056 - Input CaptureC:3 / I:2 / A:0
JA3 Fingerprint Threat Intelligence MatchCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:2 / A:1
Known Malware User Agent String DetectedCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:3 / A:2
Lateral Movement IndicatorsLateral MovementT1021 - Remote ServicesC:3 / I:3 / A:2
Malicious File Download DetectionExecutionT1105 - Ingress Tool TransferC:3 / I:3 / A:2
Malware Callback DetectionCommand and ControlT1071 - Application Layer ProtocolC:3 / I:3 / A:2
NKN Blockchain C2 Communication DetectedCommand and ControlT1071 - Application Layer ProtocolC:3 / I:3 / A:2
Port Scan DetectionDiscoveryT1046 - Network Service ScanningC:2 / I:1 / A:1
PwnDrop File Hosting Server Access DetectedCommand and ControlT1102 - Web ServiceC:2 / I:3 / A:1
Rclone Data Exfiltration Tool DetectedExfiltrationT1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud StorageC:3 / I:2 / A:1
SSH Brute Force and Tunneling DetectionLateral MovementT1021.004 - Remote Services: SSHC:3 / I:2 / A:2
TLS Certificate Anomaly DetectionDefense EvasionT1573 - Encrypted ChannelC:3 / I:2 / A:1
Threat Intelligence IOC MatchCommand and ControlCommand and ControlC:3 / I:2 / A:2
Tor Proxy/Gateway DNS Lookup DetectedCommand and ControlT1090.003 - Proxy: Multi-hop ProxyC:3 / I:2 / A:1
Tunneling DetectionCommand and ControlT1572 - Protocol TunnelingC:3 / I:2 / A:1

Rule Example

Below is an example of a rule definition for ARP Spoofing Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - suricata
name: ARP Spoofing Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Network Attack
technique: "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
adversary: origin
references:
  - https://suricata.readthedocs.io/en/latest/rules/index.html
  - https://attack.mitre.org/techniques/T1557/002/
description: |
  Detects ARP spoofing and ARP cache poisoning attacks identified by Suricata. ARP spoofing allows attackers to intercept traffic between hosts on the same network segment, enabling man-in-the-middle attacks, credential theft, and session hijacking.

  Next Steps:
  1. Identify the source MAC address involved in the ARP spoofing
  2. Locate the physical port and switch where the spoofing originates
  3. Check if the ARP responses are claiming to be the default gateway
  4. Review affected hosts for intercepted credentials or modified traffic
  5. Enable Dynamic ARP Inspection (DAI) on switches if not configured
  6. Investigate the device for attack tools (Ettercap, Bettercap, arpspoof)
where: |
  equals("log.eventType", "alert") &&
  (contains("log.alert.signature", ["ARP", "arp"]) &&
   contains("log.alert.signature", ["spoof", "poison", "duplicate", "conflict", "gratuitous"])) &&
  exists("origin.ip")
groupBy:
  - adversary.ip
  - adversary.mac

Rule Details

ARP Spoofing Detection

Detects ARP spoofing and ARP cache poisoning attacks identified by Suricata. ARP spoofing allows attackers to intercept traffic between hosts on the same network segment, enabling man-in-the-middle attacks, credential theft, and session hijacking.

Baby Shark C2 Communication Pattern Detected

Detects HTTP traffic matching the Baby Shark C2 framework URL pattern. Baby Shark is a reconnaissance tool and C2 framework used primarily by North Korean APT groups (Kimsuky/Thallium). The distinctive URL pattern 'momyshark?key=' is unique to this framework and has very low false positive rates.

Base64-Encoded DNS Query Detected

Detects DNS queries containing base64-encoded data, identified by the presence of '==' padding followed by a dot separator. This pattern is commonly used in DNS-based data exfiltration where stolen data is encoded in base64 and split across DNS query subdomains. Legitimate DNS queries almost never contain base64 padding characters.

Base64-Encoded User Agent String Detected

Detects HTTP traffic where the user agent string appears to be a base64-encoded value. Some malware families (notably YamaBot/Torisma attributed to North Korean APT Lazarus) use base64-encoded browser strings as user agents. This evasion technique attempts to bypass user agent-based detection while still being identifiable by the base64 encoding pattern.

Cobalt Strike DNS Beacon Pattern Detected

Detects DNS queries matching known Cobalt Strike DNS beacon patterns. Cobalt Strike uses specific DNS query prefixes for its DNS-based C2 channel, including 'aaa.stage.' for staging and 'post.1' for data exfiltration. These patterns are highly specific to Cobalt Strike and rarely appear in legitimate DNS traffic.

Cobalt Strike Malleable C2 Profile Detected

Detects HTTP traffic patterns matching known Cobalt Strike malleable C2 profiles. Cobalt Strike operators use malleable C2 profiles to disguise their C2 traffic as legitimate services (Amazon, OCSP, OneDrive, jQuery). This rule matches specific URI patterns, HTTP headers, and user agent combinations that are characteristic of common malleable C2 profiles.

Command and Control Traffic Detection

Detects command and control (C2) communication patterns including suspicious periodic connections, non-standard ports, encrypted channels on unusual ports, DNS tunneling, and known C2 infrastructure indicators. This rule identifies malicious communications between compromised systems and command and control servers through various techniques including signature-based detection, protocol analysis, and behavioral indicators.

Covert Channel Detection

Detects potential covert channel communication through unusual protocols, DNS tunneling, or ICMP data exfiltration patterns. This rule identifies suspicious network communications that may be used to bypass security controls and exfiltrate data through legitimate-looking traffic.

Cryptocurrency Mining Pool DNS Lookup Detected

Detects DNS queries to known cryptocurrency mining pool domains. Unauthorized mining software on corporate systems indicates compromise, as attackers deploy cryptominers for profit using stolen compute resources. This degrades system performance and increases energy costs.

DDoS Attack Patterns

Detects various DDoS attack patterns including SYN floods, UDP floods, ICMP floods, HTTP floods, and amplification attacks based on Suricata network intrusion detection system alerts and traffic patterns.

DNS Query to Out-of-Band Interaction Domain

Detects DNS queries to known out-of-band (OOB) interaction testing domains used by penetration testing tools and exploit frameworks. These domains (Burp Collaborator, interactsh, dnslog.cn, canarytokens) are almost exclusively used during active exploitation attempts such as SSRF, RCE, XXE, and Log4Shell attacks. Legitimate use is extremely rare outside of authorized security testing.

DNS TXT Record Contains Execution Strings

Detects DNS TXT record responses containing Windows command execution strings such as IEX, Invoke-Expression, cmd.exe, powershell, and other execution indicators. This technique is used for DNS-based C2 payload delivery where commands are encoded in DNS TXT records and executed by the compromised host.

DNS Tunneling Detection

Detects potential DNS tunneling activity based on abnormal DNS query patterns, including unusually long domain names, high frequency of DNS requests, or suspicious TXT record queries. DNS tunneling is a technique used by attackers to exfiltrate data or establish command and control channels by encoding data within DNS queries and responses.

Data Exfiltration Pattern Detection

Detects potential data exfiltration activities through unusual outbound traffic patterns, large data transfers, suspicious protocols, base64 encoded data, and connections to external file sharing services. This rule identifies various indicators of data theft including large uploads, connections to file sharing services, DNS tunneling, and TOR usage.

Exploit Attempt Detection

Detects potential exploit attempts based on suspicious payload patterns, buffer overflow indicators, shellcode execution attempts, and known vulnerability signatures in network traffic. This rule triggers on Suricata IDS alerts that indicate active exploitation attempts against network services.

Exploit Framework User Agent Detected in HTTP Traffic

Detects HTTP traffic containing user agent strings from known C2 frameworks and exploit tools including Cobalt Strike, Metasploit, Empire, Havoc, Sliver, Brute Ratel, Mythic, and other offensive security frameworks. These user agents are strong indicators of active command and control communication or exploitation attempts.

Hack Tool User Agent Detected in HTTP Traffic

Detects HTTP traffic containing user agent strings from known offensive security and hacking tools including vulnerability scanners, brute force tools, SQL injection tools, and web application testing tools. These tools are commonly used during reconnaissance and exploitation phases of attacks.

ICMP Tunneling Detection via Suricata

Detects potential ICMP tunneling activity based on abnormal ICMP packet patterns, including oversized ICMP packets, unusual ICMP types, high payload entropy, or abnormal ICMP codes. ICMP tunneling is a covert channel technique used by attackers to bypass network security controls and establish command and control communications.

IPFS-Based Credential Harvesting Page Access

Detects HTTP access to IPFS (InterPlanetary File System) URLs containing email parameters, which is a strong indicator of credential harvesting phishing pages. Attackers host phishing pages on IPFS because the content is decentralized and extremely difficult to take down. The presence of email parameters in IPFS URLs indicates the page is pre-populated with the victim's email for credential theft.

JA3 Fingerprint Threat Intelligence Match

Detects TLS client fingerprints (JA3 hashes) matching known malicious software, C2 frameworks, or threat intelligence feeds. JA3 fingerprinting identifies unique TLS client behaviors regardless of destination IP.

Known Malware User Agent String Detected

Detects HTTP traffic containing user agent strings associated with known malware families including RATs, stealers, ransomware, and other malicious software. These user agents are hardcoded or generated by specific malware families and serve as high-confidence indicators of compromise.

Lateral Movement Indicators

Detects indicators of lateral movement within the network including SMB/RDP scanning, authentication attempts across multiple systems, suspicious remote access patterns, and administrative tool usage. This rule identifies various lateral movement techniques including PsExec usage, WMI commands, RDP brute force attempts, SMB scanning, and connections to common administrative ports.

Malicious File Download Detection

Detects downloads of potentially malicious executable files over HTTP identified by Suricata file inspection. This includes PE executables, scripts, and other suspicious file types being transferred from external sources.

Malware Callback Detection

Detects potential malware callback activities including beaconing behavior, known malicious domains, suspicious user agents, and communication patterns typical of command and control infrastructure.

NKN Blockchain C2 Communication Detected

Detects DNS queries to NKN (New Kind of Network) blockchain seed nodes. NKN is a blockchain-based overlay network that has been abused by malware as a decentralized C2 channel. The use of blockchain-based C2 makes takedown extremely difficult and provides high resilience for malware communications.

Port Scan Detection

Detects various port scanning techniques including TCP SYN scans, connect scans, UDP scans, NULL scans, FIN scans, and XMAS scans. Port scanning is a reconnaissance technique used by attackers to discover open ports and services on target systems, which can be used to identify potential attack vectors.

This rule detects port scans through multiple indicators:

PwnDrop File Hosting Server Access Detected

Detects HTTP access to PwnDrop file hosting servers. PwnDrop is a self-hosted file hosting tool designed for red teamers and attackers to serve payloads. The /pwndrop/ path in the URL is the default admin and API endpoint, and its presence in web traffic strongly indicates malicious file hosting or payload delivery.

Rclone Data Exfiltration Tool Detected

Detects HTTP traffic with the rclone user agent string. Rclone is a command-line program to manage files on cloud storage and is the most commonly used data exfiltration tool in ransomware operations. Threat groups including Conti, BlackMatter, LockBit, and many others use rclone to exfiltrate data before deploying ransomware.

SSH Brute Force and Tunneling Detection

Detects SSH-based attacks including brute force attempts, SSH tunneling indicators, and anomalous SSH traffic patterns identified by Suricata. SSH is commonly abused for lateral movement and encrypted tunneling.

TLS Certificate Anomaly Detection

Detects TLS certificate anomalies including self-signed certificates, expired certificates, certificate subject mismatches, and certificates from untrusted authorities. These anomalies are common indicators of C2 infrastructure, man-in-the-middle attacks, or phishing sites.

Threat Intelligence IOC Match

Detects network traffic matching known malicious indicators from threat intelligence feeds including malicious IPs, domains, and URLs. This rule triggers when Suricata identifies traffic involving known threat actors, command and control servers, botnet infrastructure, or other malicious network indicators based on threat intelligence data.

Tor Proxy/Gateway DNS Lookup Detected

Detects DNS lookups to known Tor proxy and gateway domains. These services allow web traffic to be routed through the Tor network without installing the Tor browser, commonly used by attackers to anonymize C2 traffic or access dark web resources from corporate networks.

Tunneling Detection

Detects various tunneling techniques including SSH tunneling, HTTP tunneling, VPN over non-standard ports, and protocol mismatches. Tunneling is used by attackers to bypass network security controls and establish covert communication channels.