signatures.sample.yml

# TracePcap Custom Signatures — Sample File
# ==========================================
# This file contains demo rules written against demo_all_rules.pcap.
# Every rule below will trigger on that file, covering all supported match fields.
#
# To use: paste this into the Custom Detection Rules editor in the browser,
# then upload demo_all_rules.pcap to see all rules fire.
#
# Match fields (all optional; a rule fires when ALL specified fields match):
#   ip       - exact match against source OR destination IP          (e.g. "203.0.113.42")
#   cidr     - CIDR range match against source OR destination IP     (e.g. "10.0.0.0/8")
#   srcPort  - exact source port match                               (e.g. 67)
#   dstPort  - exact destination port match                          (e.g. 4444)
#   ja3      - exact match against JA3S fingerprint hash             (e.g. "82f0d8a75fa483d1cfe4b7085b784d7e")
#   hostname - exact or wildcard SNI hostname                        (e.g. "*.evil.com")
#              wildcard matches any subdomain at any depth
#   app      - case-insensitive nDPI application name                (e.g. "Telegram", "TOR", "DNS")
#   protocol - case-insensitive transport protocol                   (e.g. "TCP", "UDP", "ICMP")
#
# Top-level rule keys (alongside or instead of match):
#   payload_contains - list of byte patterns to search in packet payloads
#                      each entry is one of:
#                        ascii: "string"   - plain ASCII text  (e.g. "GET /admin")
#                        hex:   "deadbeef" - hex bytes, with optional 0x prefix or space separators
#                      multiple entries are OR-matched by default
#                      set match_all: true on the rule to AND all entries instead
#
#   payload_regex    - list of regular expressions applied to the ASCII/UTF-8 decoded payload
#                      each entry requires:
#                        pattern: "regex"          - standard regular expression
#                      optional per-entry:
#                        case_insensitive: true    - case-insensitive match (default: false)
#                      multiple entries are OR-matched by default; set match_all: true to AND
#                      payload_contains and payload_regex can coexist in the same rule (both must match)
#
# Severity colors in the UI:
#   critical -> red   | high -> orange   | medium -> amber   | low -> purple
#
# Optional device classification override:
#   device_type - pin a matched IP's device type in the Network Diagram and Conversation filters
#                 Standard values: ROUTER | MOBILE | LAPTOP_DESKTOP | SERVER | IOT | UNKNOWN
#                 Custom strings are also accepted (e.g. "CCTV Camera", "PLC")
#                 When set, ALL IPs (src + dst) involved in a matching conversation inherit this type.
# ----------------------------------------------------------------------------

signatures:

  # --- ip: exact match against a single IP address ---
  # Flags any conversation involving a known Dropbox telemetry server IP.
  - name: dropbox_telemetry_server
    description: Direct contact with a known Dropbox telemetry IP
    severity: low
    match:
      ip: "162.125.19.131"

  # --- cidr: match any IP within a subnet ---
  # Catches all traffic to Microsoft Azure's Teams/365 IP range.
  - name: microsoft_azure_traffic
    description: Traffic to/from Microsoft Azure IP range used by Teams and M365
    severity: low
    match:
      cidr: "52.114.0.0/16"

  # --- dstPort: flag connections to a specific destination port ---
  # Teams uses port 4434 for media relay — flag it for inspection.
  - name: teams_media_relay_port
    description: Connection to Teams media relay port 4434
    severity: low
    match:
      dstPort: 4434

  # --- srcPort: flag traffic originating from a specific source port ---
  # DHCP servers respond from port 67; unexpected hosts doing this may be rogue.
  - name: rogue_dhcp_server
    description: Traffic sourced from port 67 — potential rogue DHCP server
    severity: high
    match:
      srcPort: 67

  # --- hostname: exact SNI hostname match ---
  # Microsoft telemetry pipeline — flag for data-exfil awareness.
  - name: microsoft_telemetry_pipeline
    description: TLS SNI to Microsoft Aria telemetry collection endpoint
    severity: medium
    match:
      hostname: "mobile.pipe.aria.microsoft.com"

  # --- hostname: wildcard match (leading *.) ---
  # Catches any subdomain of microsoft.com for broad visibility.
  - name: microsoft_domain_traffic
    description: Any conversation with an SNI hostname under *.microsoft.com
    severity: low
    match:
      hostname: "*.microsoft.com"

  # --- app: nDPI application name match ---
  # Flag all Telegram traffic for policy enforcement.
  - name: telegram_usage
    description: Traffic identified as Telegram by nDPI deep packet inspection
    severity: medium
    match:
      app: "Telegram"

  # --- protocol: transport-layer protocol match ---
  # Flag all ICMP — useful for detecting ping sweeps or covert channels.
  - name: icmp_detected
    description: Any ICMP conversation — review for ping sweeps or tunnelling
    severity: low
    match:
      protocol: ICMP

  # --- app + protocol: combined AND condition ---
  # DNS should only run over UDP on port 53; TCP DNS may indicate zone transfers.
  - name: dns_over_tcp
    description: DNS running over TCP — possible zone transfer or DNS tunnelling
    severity: medium
    match:
      app: "DNS"
      protocol: TCP

  # --- dstPort + protocol: combined AND condition ---
  # HTTPS over UDP (QUIC) — flag for environments that disallow QUIC.
  - name: quic_https
    description: HTTPS traffic over UDP (likely QUIC) — may bypass TLS inspection proxies
    severity: medium
    match:
      dstPort: 443
      protocol: UDP

  # --- ja3: fingerprint match ---
  # JA3S string: 771,53, — ServerHello selecting AES-256-SHA with no extensions.
  # Matches the crafted TLS exchange in demo_all_rules.pcap.
  # In production, replace with hashes from a threat-intel feed (e.g. ja3er.com).
  - name: suspected_meterpreter_tls
    description: TLS exchange matching a suspicious JA3S fingerprint (demo)
    severity: critical
    match:
      ja3: "82f0d8a75fa483d1cfe4b7085b784d7e"

  # --- ip + dstPort: multi-field AND condition ---
  # Specific known Teams router IP on its signalling port.
  - name: teams_trouter_signalling
    description: Direct connection to a known Teams trouter relay IP on port 443
    severity: low
    match:
      ip: "52.114.252.8"
      dstPort: 443

  # --- payload_contains: ASCII string match ---
  # Flag any conversation whose payload contains an HTTP GET to /admin.
  - name: http_get_admin
    description: HTTP GET request targeting /admin path detected in payload
    severity: high
    payload_contains:
      - ascii: "GET /admin"

  # --- payload_contains: hex byte match ---
  # Detect the PDF magic bytes (%PDF-) anywhere in the payload.
  - name: pdf_in_payload
    description: PDF magic bytes (%PDF-) detected in packet payload
    severity: low
    payload_contains:
      - hex: "255044462d"   # %PDF-

  # --- payload_contains: multiple patterns (OR-matched by default) ---
  # Flag conversations that carry cleartext credentials (basic auth or plain POST password field).
  - name: cleartext_credentials
    description: Possible cleartext credentials detected in payload (Basic auth header or POST password)
    severity: critical
    payload_contains:
      - ascii: "Authorization: Basic"
      - ascii: "password="

  # --- payload_contains + match_all: all patterns must appear (AND) ---
  # Flag HTTP POST requests that also contain a JSON body with "token" — possible API key exposure.
  - name: http_post_with_token
    description: HTTP POST request with token field detected in payload
    severity: high
    match_all: true
    payload_contains:
      - ascii: "POST /"
      - ascii: "token"

  # --- payload_contains combined with match fields ---
  # Detect DNS TXT record responses (potential DNS tunnelling) by combining protocol + payload.
  - name: dns_txt_response
    description: DNS response containing TXT record type — possible DNS tunnelling or exfiltration
    severity: high
    match:
      app: "DNS"
      protocol: UDP
    payload_contains:
      - hex: "0010"   # QTYPE 16 = TXT record

  # --- payload_regex: single pattern ---
  # Detect HTTP Basic-auth credentials encoded in cleartext (case-insensitive).
  - name: http_basic_auth_regex
    description: HTTP Authorization header with Basic scheme detected via regex
    severity: critical
    payload_regex:
      - pattern: "Authorization:\\s*Basic\\s+[A-Za-z0-9+/=]+"
        case_insensitive: true

  # --- payload_regex: multiple patterns (OR-matched by default) ---
  # Flag any payload that looks like it contains an email address or a phone number.
  - name: pii_in_payload
    description: Possible PII (email address or phone number) detected in payload
    severity: high
    payload_regex:
      - pattern: "[a-zA-Z0-9._%+\\-]+@[a-zA-Z0-9.\\-]+\\.[a-zA-Z]{2,}"
      - pattern: "\\b\\d{3}[\\s.\\-]?\\d{3}[\\s.\\-]?\\d{4}\\b"

  # --- payload_regex + match_all: all patterns must appear ---
  # Flag HTTP responses that include a Set-Cookie header AND a JWT-shaped value.
  - name: jwt_set_cookie
    description: HTTP response setting a JWT token in a cookie
    severity: high
    match_all: true
    payload_regex:
      - pattern: "Set-Cookie:"
        case_insensitive: true
      - pattern: "eyJ[A-Za-z0-9_\\-]+\\.eyJ[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+"

  # --- payload_regex combined with match fields ---
  # Detect SQL injection probes on plain HTTP traffic.
  - name: sql_injection_probe
    description: Possible SQL injection string detected in HTTP payload
    severity: critical
    match:
      protocol: TCP
      dstPort: 80
    payload_regex:
      - pattern: "(?:UNION\\s+SELECT|DROP\\s+TABLE|INSERT\\s+INTO|'\\s*OR\\s*'1'\\s*=\\s*'1)"
        case_insensitive: true

  # --- device_type: pin an IP to a specific device category ---
  # Any IP communicating with 192.168.1.50 will be labelled "CCTV Camera".
  # Replace the IP and device_type with your own values.
  # - name: cctv_camera
  #   description: Known CCTV camera on the local network
  #   severity: low
  #   device_type: "CCTV Camera"
  #   match:
  #     ip: "192.168.1.50"