synoti logosynoti logo
NIDS / Suricata

Detection rules for NIDS / Suricata Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 33 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
ARP Spoofing DetectionNetwork AttackT1557.002 - Adversary-in-the-Middle: ARP Cache PoisoningC:3 / I:3 / A:2
Baby Shark C2 Communication Pattern DetectedCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:3 / A:2
Base64-Encoded DNS Query DetectedExfiltrationT1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 ProtocolC:3 / I:2 / A:1
Base64-Encoded User Agent String DetectedCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:2 / I:2 / A:1
Cobalt Strike DNS Beacon Pattern DetectedCommand and ControlT1071.004 - Application Layer Protocol: DNSC:3 / I:3 / A:2
Cobalt Strike Malleable C2 Profile DetectedCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:3 / A:2
Command and Control Traffic DetectionCommand and ControlT1095 - Non-Application Layer ProtocolC:3 / I:3 / A:2
Covert Channel DetectionExfiltrationCovert Channel CommunicationC:3 / I:2 / A:1
Cryptocurrency Mining Pool DNS Lookup DetectedResource HijackingT1496 - Resource HijackingC:1 / I:1 / A:3
DDoS Attack PatternsImpactT1498 - Network Denial of ServiceC:1 / I:2 / A:3
DNS Query to Out-of-Band Interaction DomainInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:2 / A:1
DNS TXT Record Contains Execution StringsCommand and ControlT1071.004 - Application Layer Protocol: DNSC:3 / I:3 / A:2
DNS Tunneling DetectionCommand and ControlT1071.004 - Application Layer Protocol: DNSC:2 / I:2 / A:1
Data Exfiltration Pattern DetectionExfiltrationT1048 - Exfiltration Over Alternative ProtocolC:3 / I:1 / A:1
Exploit Attempt DetectionLateral MovementT1210 - Exploitation of Remote ServicesC:3 / I:3 / A:2
Exploit Framework User Agent Detected in HTTP TrafficCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:3 / A:2
Hack Tool User Agent Detected in HTTP TrafficReconnaissanceT1595.002 - Active Scanning: Vulnerability ScanningC:2 / I:2 / A:1
ICMP Tunneling Detection via SuricataCommand and ControlT1572 - Protocol TunnelingC:3 / I:2 / A:2
IPFS-Based Credential Harvesting Page AccessCredential AccessT1056 - Input CaptureC:3 / I:2 / A:0
JA3 Fingerprint Threat Intelligence MatchCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:2 / A:1
Known Malware User Agent String DetectedCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:3 / A:2
Lateral Movement IndicatorsLateral MovementT1021 - Remote ServicesC:3 / I:3 / A:2
Malicious File Download DetectionExecutionT1105 - Ingress Tool TransferC:3 / I:3 / A:2
Malware Callback DetectionCommand and ControlT1071 - Application Layer ProtocolC:3 / I:3 / A:2
NKN Blockchain C2 Communication DetectedCommand and ControlT1071 - Application Layer ProtocolC:3 / I:3 / A:2
Port Scan DetectionDiscoveryT1046 - Network Service ScanningC:2 / I:1 / A:1
PwnDrop File Hosting Server Access DetectedCommand and ControlT1102 - Web ServiceC:2 / I:3 / A:1
Rclone Data Exfiltration Tool DetectedExfiltrationT1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud StorageC:3 / I:2 / A:1
SSH Brute Force and Tunneling DetectionLateral MovementT1021.004 - Remote Services: SSHC:3 / I:2 / A:2
TLS Certificate Anomaly DetectionDefense EvasionT1573 - Encrypted ChannelC:3 / I:2 / A:1
Threat Intelligence IOC MatchCommand and ControlCommand and ControlC:3 / I:2 / A:2
Tor Proxy/Gateway DNS Lookup DetectedCommand and ControlT1090.003 - Proxy: Multi-hop ProxyC:3 / I:2 / A:1
Tunneling DetectionCommand and ControlT1572 - Protocol TunnelingC:3 / I:2 / A:1

Rule Example

Below is an example of a rule definition for ARP Spoofing Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - suricata
name: ARP Spoofing Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Network Attack
technique: "T1557.002 - Adversary-in-the-Middle: ARP Cache Poisoning"
adversary: origin
references:
  - https://suricata.readthedocs.io/en/latest/rules/index.html
  - https://attack.mitre.org/techniques/T1557/002/
description: |
  Detects ARP spoofing and ARP cache poisoning attacks identified by Suricata. ARP spoofing allows attackers to intercept traffic between hosts on the same network segment, enabling man-in-the-middle attacks, credential theft, and session hijacking.

  Next Steps:
  1. Identify the source MAC address involved in the ARP spoofing
  2. Locate the physical port and switch where the spoofing originates
  3. Check if the ARP responses are claiming to be the default gateway
  4. Review affected hosts for intercepted credentials or modified traffic
  5. Enable Dynamic ARP Inspection (DAI) on switches if not configured
  6. Investigate the device for attack tools (Ettercap, Bettercap, arpspoof)
where: |
  equals("log.eventType", "alert") &&
  (contains("log.alert.signature", ["ARP", "arp"]) &&
   contains("log.alert.signature", ["spoof", "poison", "duplicate", "conflict", "gratuitous"])) &&
  exists("origin.ip")
groupBy:
  - adversary.ip
  - adversary.mac

Rule Details

ARP Spoofing Detection

Identifies ARP spoofing and ARP cache poisoning attacks flagged by Suricata. Through ARP spoofing, attackers can intercept traffic among hosts on the same network segment, which facilitates man-in-the-middle attacks, credential theft, and session hijacking.

Baby Shark C2 Communication Pattern Detected

Identifies HTTP traffic that matches the Baby Shark C2 framework URL pattern. Baby Shark is a reconnaissance tool and C2 framework employed mainly by North Korean APT groups (Kimsuky/Thallium). The unique URL pattern momyshark?key= is specific to this framework and produces very few false positives.

Base64-Encoded DNS Query Detected

Identifies DNS queries that carry base64-encoded data, recognized by == padding followed by a dot separator. This pattern frequently appears in DNS-based data exfiltration, in which stolen data is base64-encoded and divided across DNS query subdomains. Genuine DNS queries almost never include base64 padding characters.

  • Category: Exfiltration

  • Technique: T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

  • Impact: C:3 / I:2 / A:1

  • Rule file: base64_dns_queries.yml

  • Reference: https://attack.mitre.org/techniques/T1048/003/

Base64-Encoded User Agent String Detected

Identifies HTTP traffic in which the user agent string looks like a base64-encoded value. Certain malware families, notably YamaBot/Torisma linked to North Korean APT Lazarus, employ base64-encoded browser strings as user agents. This evasion method seeks to avoid detection based on user agents while remaining detectable through the base64 encoding pattern.

Cobalt Strike DNS Beacon Pattern Detected

Identifies DNS queries that match known Cobalt Strike DNS beacon patterns. For its DNS-based C2 channel, Cobalt Strike uses specific DNS query prefixes, such as aaa.stage. for staging and post.1 for data exfiltration. These patterns are highly specific to Cobalt Strike and seldom occur in legitimate DNS traffic.

Cobalt Strike Malleable C2 Profile Detected

Identifies HTTP traffic patterns that match known Cobalt Strike malleable C2 profiles. Cobalt Strike operators rely on malleable C2 profiles to make their C2 traffic look like legitimate services (Amazon, OCSP, OneDrive, jQuery). This rule detects particular URI patterns, HTTP headers, and user agent combinations typical of common malleable C2 profiles.

Command and Control Traffic Detection

Identifies command and control (C2) communication patterns, such as suspicious periodic connections, non-standard ports, encrypted channels on unusual ports, DNS tunneling, and known C2 infrastructure indicators. This rule detects malicious communications between compromised systems and command and control servers using multiple techniques, including signature-based detection, protocol analysis, and behavioral indicators.

Covert Channel Detection

Identifies possible covert channel communication via unusual protocols, DNS tunneling, or ICMP data exfiltration patterns. This rule detects suspicious network communications that could be used to evade security controls and exfiltrate data through traffic that appears legitimate.

Cryptocurrency Mining Pool DNS Lookup Detected

Identifies DNS queries to recognized cryptocurrency mining pool domains. Unauthorized mining software on corporate systems signals a compromise, because attackers deploy cryptominers for profit using stolen compute resources. This reduces system performance and raises energy costs.

DDoS Attack Patterns

Identifies multiple DDoS attack patterns, such as SYN floods, UDP floods, ICMP floods, HTTP floods, and amplification attacks, based on Suricata network intrusion detection system alerts and traffic patterns.

DNS Query to Out-of-Band Interaction Domain

Identifies DNS queries to known out-of-band (OOB) interaction testing domains associated with penetration testing tools and exploit frameworks. These domains (Burp Collaborator, interactsh, dnslog.cn, canarytokens) are used almost exclusively during active exploitation attempts, including SSRF, RCE, XXE, and Log4Shell attacks. Legitimate use is exceedingly rare outside authorized security testing.

DNS TXT Record Contains Execution Strings

Identifies DNS TXT record responses that contain Windows command execution strings, such as IEX, Invoke-Expression, cmd.exe, powershell, and other execution indicators. This technique supports DNS-based C2 payload delivery, in which commands are encoded in DNS TXT records and executed by the compromised host.

DNS Tunneling Detection

Identifies possible DNS tunneling activity through abnormal DNS query patterns, such as unusually long domain names, a high frequency of DNS requests, or suspicious TXT record queries. Attackers use DNS tunneling to exfiltrate data or establish command and control channels by encoding data within DNS queries and responses.

Data Exfiltration Pattern Detection

Identifies possible data exfiltration activities via unusual outbound traffic patterns, large data transfers, suspicious protocols, base64 encoded data, and connections to external file sharing services. This rule detects several indicators of data theft, including large uploads, connections to file sharing services, DNS tunneling, and TOR usage.

Exploit Attempt Detection

Identifies possible exploit attempts through suspicious payload patterns, buffer overflow indicators, shellcode execution attempts, and known vulnerability signatures in network traffic. This rule triggers on Suricata IDS alerts that signal active exploitation attempts against network services.

Exploit Framework User Agent Detected in HTTP Traffic

Identifies HTTP traffic that contains user agent strings from known C2 frameworks and exploit tools, including Cobalt Strike, Metasploit, Empire, Havoc, Sliver, Brute Ratel, Mythic, and other offensive security frameworks. These user agents strongly indicate active command and control communication or exploitation attempts.

Hack Tool User Agent Detected in HTTP Traffic

Identifies HTTP traffic that contains user agent strings from known offensive security and hacking tools, including vulnerability scanners, brute force tools, SQL injection tools, and web application testing tools. These tools are often used during the reconnaissance and exploitation phases of attacks.

ICMP Tunneling Detection via Suricata

Identifies possible ICMP tunneling activity through abnormal ICMP packet patterns, such as oversized ICMP packets, unusual ICMP types, high payload entropy, or abnormal ICMP codes. ICMP tunneling is a covert channel technique that attackers use to evade network security controls and establish command and control communications.

IPFS-Based Credential Harvesting Page Access

Identifies HTTP access to IPFS (InterPlanetary File System) URLs that include email parameters, a strong sign of credential harvesting phishing pages. Attackers host phishing pages on IPFS because the content is decentralized and very hard to take down. Email parameters in IPFS URLs indicate that the page is pre-populated with the victim's email for credential theft.

JA3 Fingerprint Threat Intelligence Match

Identifies TLS client fingerprints (JA3 hashes) that match known malicious software, C2 frameworks, or threat intelligence feeds. JA3 fingerprinting detects distinctive TLS client behaviors independent of destination IP.

Known Malware User Agent String Detected

Identifies HTTP traffic that carries user agent strings linked to known malware families, such as RATs, stealers, ransomware, and other malicious software. Such user agents are either hardcoded or generated by particular malware families, making them strong indicators of compromise.

Lateral Movement Indicators

Identifies signs of lateral movement inside the network, such as SMB/RDP scanning, authentication attempts against multiple systems, suspicious remote access activity, and use of administrative tools. This rule detects several lateral movement techniques, including PsExec usage, WMI commands, RDP brute force attempts, SMB scanning, and connections to common administrative ports.

Malicious File Download Detection

Identifies HTTP downloads of executable files that may be malicious, as detected through Suricata file inspection. This covers PE executables, scripts, and other suspicious file types transferred from external sources.

Malware Callback Detection

Identifies possible malware callback activity, such as beaconing behavior, known malicious domains, suspicious user agents, and communication patterns common to command and control infrastructure.

NKN Blockchain C2 Communication Detected

Identifies DNS queries directed to NKN (New Kind of Network) blockchain seed nodes. NKN is a blockchain-based overlay network that has been used abusively by malware as a decentralized C2 channel. Using blockchain-based C2 makes takedown very difficult and gives malware communications high resilience.

Port Scan Detection

Identifies multiple port scanning techniques, such as TCP SYN scans, connect scans, UDP scans, NULL scans, FIN scans, and XMAS scans. Port scanning is a reconnaissance method that attackers use to find open ports and services on target systems, which can help identify potential attack vectors.

This rule detects port scans through multiple indicators:

PwnDrop File Hosting Server Access Detected

Identifies HTTP access to PwnDrop file hosting servers. PwnDrop is a self-hosted file hosting tool built for red teamers and attackers to serve payloads. The /pwndrop/ path in the URL is the default admin and API endpoint, and when it appears in web traffic it strongly suggests malicious file hosting or payload delivery.

Rclone Data Exfiltration Tool Detected

Identifies HTTP traffic that contains the rclone user agent string. Rclone is a command-line program for managing files on cloud storage and is the most widely used data exfiltration tool in ransomware operations. Threat groups such as Conti, BlackMatter, LockBit, and many others use rclone to exfiltrate data before they deploy ransomware.

SSH Brute Force and Tunneling Detection

Identifies SSH-based attacks, such as brute force attempts, signs of SSH tunneling, and anomalous SSH traffic patterns detected by Suricata. SSH is frequently abused for lateral movement and encrypted tunneling.

TLS Certificate Anomaly Detection

Identifies TLS certificate anomalies, such as self-signed certificates, expired certificates, certificate subject mismatches, and certificates from untrusted authorities. Such anomalies commonly indicate C2 infrastructure, man-in-the-middle attacks, or phishing sites.

Threat Intelligence IOC Match

Identifies network traffic that matches known malicious indicators from threat intelligence feeds, such as malicious IPs, domains, and URLs. This rule triggers when Suricata detects traffic involving known threat actors, command and control servers, botnet infrastructure, or other malicious network indicators based on threat intelligence data.

Tor Proxy/Gateway DNS Lookup Detected

Identifies DNS lookups for known Tor proxy and gateway domains. These services let web traffic be routed through the Tor network without installing the Tor browser, and attackers commonly use them to anonymize C2 traffic or reach dark web resources from corporate networks.

Tunneling Detection

Identifies multiple tunneling techniques, such as SSH tunneling, HTTP tunneling, VPN over non-standard ports, and protocol mismatches. Attackers use tunneling to bypass network security controls and set up covert communication channels.