Sigma rule for Internal Cleartext Protocol Usage

internal_cleartext_protocols.yaml

title: Internal Cleartext Protocol Usage
status: experimental
description: Detects common cleartext procotols from internal endpoints.
author: Josh Brower
logsource:
    category: firewall
    defintion: Tweak logsource to whichever logsource is used in the local environment ie Zeek Conn.
detection:
    internal_ip:
      src_ip|startswith:
        - '192.168.'
        - '10.'
        - '172.16.'
        - '172.17.'
        - '172.18.'
        - '172.19.'
        - '172.20.'
        - '172.21.'
        - '172.22.'
        - '172.23.'
        - '172.24.'
        - '172.25.'
        - '172.26.'
        - '172.27.'
        - '172.28.'
        - '172.29.'
        - '172.30.'
        - '172.31.'
    cleartext_protocol:
      dst_port:
        - 20 #FTP Data
        - 21 #FTP Control
        - 23 #Telnet
        - 161 #SNMP
        - 162 #SNMP
        - 143 #IMAP
        - 110 #POP3
        - 389 #LDAP
    condition: internal_ip and cleartext_protocol
falsepositives:
    - Unknown
fields:
    - src_ip
level: medium