Suricata 规则classtype和规则文件分类说明

分手后的思念是犯贱 2022-03-28 04:11 336阅读 0赞

**文件名为:classification.config**  
config classification: not-suspicious,Not Suspicious Traffic,3 \#不可疑的流量？  
config classification: unknown,Unknown Traffic,3 \#未知流量  
config classification: bad-unknown,Potentially Bad Traffic, 2 \#潜在的危险流量，例如：msg:“ET DNS Query for a Suspicious \*.noc.su domain”;  
config classification: attempted-recon,Attempted Information Leak,2 \#尝试侦查信息 例如:msg:“GPL DNS named version attempt”;  
config classification: successful-recon-limited,Information Leak,2 \#小范围信息泄露 例如:msg:“ET WEB\_SERVER Successful DD-WRT Information Disclosure”  
config classification: successful-recon-largescale,Large Scale Information Leak,2 \#大规模信息泄露 例如:msg:“ET WEB\_SPECIFIC\_APPS WordPress DB XML dump successful leakage”  
config classification: attempted-dos,Attempted Denial of Service,2 \#尝试dos攻击  
config classification: successful-dos,Denial of Service,2 \#成功dos攻击  
config classification: attempted-user,Attempted User Privilege Gain,1 \#尝试获取用户权限  
config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1 \#未成功获取用户权限 例如:msg:“GPL MISC Invalid PCAnywhere Login”  
config classification: successful-user,Successful User Privilege Gain,1 \#成功获取用户权限  
config classification: attempted-admin,Attempted Administrator Privilege Gain,1 \#尝试获取管理员权限  
config classification: successful-admin,Successful Administrator Privilege Gain,1 \#成功获取管理员权限

\# NEW CLASSIFICATIONS  
config classification: rpc-portmap-decode,Decode of an RPC Query,2 \#RPC解析 例如:msg:“GPL EXPLOIT portmap proxy integer overflow attempt UDP”  
config classification: shellcode-detect,Executable code was detected,1 \#shellcode检测  
config classification: string-detect,A suspicious string was detected,3 \#可疑字符串检测  
config classification: suspicious-filename-detect,A suspicious filename was detected,2 \#可疑文件名检测  
config classification: suspicious-login,An attempted login using a suspicious username was detected,2 \#登录检测  
config classification: system-call-detect,A system call was detected,2 \#系统命令检测  
config classification: tcp-connection,A TCP connection was detected,4 \#TCP链接检测  
config classification: trojan-activity,A Network Trojan was detected, 1 \#特洛伊病毒检测  
config classification: unusual-client-port-connection,A client was using an unusual port,2 \#不常使用端口检测  
config classification: network-scan,Detection of a Network Scan,3 \#地址扫描  
config classification: denial-of-service,Detection of a Denial of Service Attack,2 \#检测dos攻击  
config classification: non-standard-protocol,Detection of a non-standard protocol or event,2 \#检测使用非标准协议  
config classification: protocol-command-decode,Generic Protocol Command Decode,3 \#正常协议解析  
config classification: web-application-activity,access to a potentially vulnerable web application,2 \#访问可能易受攻击的Web应用程序，例如:msg:“GPL EXPLOIT formmail access”  
config classification: web-application-attack,Web Application Attack,1 \#Web应用程序攻击  
config classification: misc-activity,Misc activity,3 \#混杂(指各种协议，事件，应用等等)操作，例如:msg:“ET CHAT IRC PING command”;  
config classification: misc-attack,Misc Attack,2 \#混杂攻击  
config classification: icmp-event,Generic ICMP event,3 \#ICMP协议事件  
config classification: kickass-porn,SCORE! Get the lotion!,1 \#色情  
config classification: policy-violation,Potential Corporate Privacy Violation,1 \#隐私侵犯  
config classification: default-login-attempt,Attempt to login by a default username and password,2 \#尝试使用默认账户登录

\# Update  
config classification: targeted-activity,Targeted Malicious Activity was Detected,1 \#已经检测到的有针对性行为  
config classification: exploit-kit,Exploit Kit Activity Detected,1 \#检测到使用漏洞工具  
config classification: external-ip-check,Device Retrieving External IP Address Detected,2 \#检测设备检索外部IP  
config classification: domain-c2,Domain Observed Used for C2 Detected,1 \#检测domain-c2  
config classification: pup-activity,Possibly Unwanted Program Detected,2 \#检测可能不需要的程序在运行  
config classification: credential-theft,Successful Credential Theft Detected,1 \#成功检测到盗窃凭证  
config classification: social-engineering,Possible Social Engineering Attempted,2 \#尝试社区工程连接 例如:msg:“ET CURRENT\_EVENTS HoeflerText Chrome Popup DriveBy Download Attempt 2”  
config classification: coin-mining,Crypto Currency Mining Activity Detected,2 \#检测挖矿

规则中的各个文件分类，可以查看此链接:[Suricata默认规则集的目的与用途][Suricata]

[Suricata]: https://www.jianshu.com/p/d81db4c352af