dnp3-samples.rules

dnp3-sample.rules

# 1 - Function code match - either direction.
alert dnp3 any any -> any any ( \
      msg:"DNP3 Sample function code match"; \
      dnp3_func:21; \
      sid:1; rev:1;)

# 2 - Internal indicators.  Applies to client only.
#   - Providing multiple flags in one dnp3_ind option will match if any
#     of the flags are set. Use dnp3_ind multiple times to alert on a specific
#     combination of flags.
alert dnp3 any any -> any any ( \
      msg:"DNP3 Sample internal indicators match"; \
      dnp3_ind:class_1_events,class_2_events,class_3_events; \
      sid:2; rev:1;)

# 3 - Content match, any direction.
alert dnp3 any any -> any any ( \
      msg:"DNP3 Content match, any direction"; \
      dnp3_data; content:"|3c 02 06 3c 03 06 3c|"; \
      sid:3; rev:1;)