Update local.rules

Author: aleksibovellan

local.rules

@@ -1,11 +1,25 @@
-# Nmap Detection without scan port ranges:
+# Nmap Detection without port ranges - the basic Nmap scans 1000 first ports:
 
 alert tcp any any -> any any (msg:"POSSIBLE NMAP TCP (-sT,-sS)"; flow:stateless; flags:S,12; reference:arachnids,198; classtype:attempted-recon; sid:1000004; priority:5; rev:9; threshold:type threshold, track by_src, count 1000, seconds 2700;)
 alert udp any any -> any any (msg:"POSSIBLE NMAP UDP (-sU)"; flow:stateless; classtype:attempted-recon; sid:1000005; priority:5; rev:6; threshold:type threshold, track by_src, count 10, seconds 300; dsize:0;)
 alert ip any any -> any any (msg:"POSSIBLE NMAP FRAGM (-f)"; fragbits:M; threshold:type threshold, track by_src, count 1000, seconds 2700; classtype:attempted-recon; sid:1000006; rev:1;)
 
-# Nmap Detection with more specific and known scan port ranges:
+# Nmap Detection with more specific and known port ranges - tuned for slower Nmap scans:
 
-alert tcp any any -> any [20,21,22,23,25,88,110,135,137,138,139,161,389,445,465,514,587,636,995,1025,1026,1027,1028,1029,1433,1720,3306,3389,5900,8443,11211,27017] (msg:"POSSIBLE NMAP KNOWN TCP (-sT,-sS)"; flow:stateless; flags:S,12; dsize:<60; classtype:attempted-recon; sid:1000007; priority:5; rev:14; threshold:type threshold, track by_src, count 4, seconds 1200;)
-alert udp any any -> any [69,161,162,389,520,1026,1027,1028,1029,12345,11211,27017] (msg:"POSSIBLE NMAP KNOWN UDP (-sU)"; flow:stateless; classtype:attempted-recon; sid:1000008; priority:5; rev:7; threshold:type limit, track by_src, count 4, seconds 1200;)
-alert ip any any -> any any (msg:"POSSIBLE NMAP KNOWN FRAGM (-f)"; fragbits:M+D; threshold:type limit, track by_src, count 4, seconds 1200; classtype:attempted-recon; sid:1000009; rev:6;)
+alert tcp any any -> any [20,21,22,23,25,80,88,110,135,137,138,139,161,389,445,465,514,587,636,995,1025,1026,1027,1028,1029,1433,1720,3306,3389,5900,8443,11211,27017] (msg:"POSSIBLE NMAP KNOWN TCP (-sT,-sS)"; flow:stateless; flags:S,12; dsize:<60; classtype:attempted-recon; sid:1000007; priority:5; rev:14; threshold:type threshold, track by_src, count 10, seconds 30;)
+alert udp any any -> any [69,161,162,389,520,1026,1027,1028,1029,12345,11211,27017] (msg:"POSSIBLE NMAP KNOWN UDP (-sU)"; flow:stateless; classtype:attempted-recon; sid:1000008; priority:5; rev:7; threshold:type limit, track by_src, count 20, seconds 1200;)
+alert ip any any -> any any (msg:"POSSIBLE NMAP KNOWN FRAGM (-f)"; fragbits:M+D; threshold:type limit, track by_src, count 20, seconds 1200; classtype:attempted-recon; sid:1000009; rev:6;)
+
+# Metasploit / Meterpreter / Netcat commonly associated port 4444 connection warnings:
+
+# TCP source port: 4444
+alert tcp any 4444 -> any any (msg:"POSSIBLE METASPLOIT REVERSE SHELL OR TCP SCAN"; classtype:trojan-activity; sid:1000010; rev:1;)
+
+# UDP source port: 4444
+alert udp any 4444 -> any any (msg:"POSSIBLE METASPLOIT REVERSE SHELL OR UDP SCAN"; classtype:trojan-activity; sid:1000011; rev:1;)
+
+# TCP destination port: 4444
+alert tcp any any -> any 4444 (msg:"POSSIBLE METASPLOIT BIND SHELL OR TCP SCAN"; classtype:trojan-activity; sid:1000012; rev:2;)
+
+# UDP destination port: 4444
+alert udp any any -> any 4444 (msg:"POSSIBLE METASPLOIT BIND SHELL OR UDP SCAN"; classtype:trojan-activity; sid:1000013; rev:2;)