Skip to content

Instantly share code, notes, and snippets.

@Sy3Omda

Sy3Omda/mitm6.rules

Forked from fox-srt/mitm6.rules
Created November 17, 2022 10:42
Show Gist options
  • Save Sy3Omda/7db8b7163acb31c05b4521874237dadf to your computer and use it in GitHub Desktop.
Save Sy3Omda/7db8b7163acb31c05b4521874237dadf to your computer and use it in GitHub Desktop.
Download ZIP
MITM6 IDS Signatures
Raw
mitm6.rules
# Snort & Suricata signatures for:
# https://blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6
alert udp fe80::/12 [546,547] -> fe80::/12 [546,547] (msg:"FOX-SRT - Policy - DHCPv6 advertise"; content:"|02|"; offset:48; depth:1; reference:url,blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6/; threshold:type limit, track by_src, count 1, seconds 3600; classtype:policy-violation; sid:21002327; rev:2;)
alert udp ::/0 53 -> any any (msg:"FOX-SRT - Suspicious - WPAD DNS reponse over IPv6"; byte_test:1,&,0x7F,2; byte_test:2,>,0,6; content:"|00 04|wpad"; nocase; fast_pattern; threshold: type limit, track by_src, count 1, seconds 1800; reference:url,blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6/; classtype:attempted-admin; priority:1; sid:21002330; rev:1;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment