NMAP detection rules for Suricata in GitHub

Rules
, ,
1

Hi all,

in case anyone wants Suricata detection rules against different types of NMAP scans and scan speeds (T1-T5), I wrote a bundle into Github, which do just that. Tested in a SoHo / home environment with OPNsense:

https://github.com/aleksibovellan/opnsense-suricata-nmaps

Everyday scanning into our WAN interfaces does generate some extra log entries, somedays a lot, but at least I personally like to see who is trying to love my router without consent.

Be safe, everyone, and if you happen to like these rules, please consider to star the repository to make it worth the time. Thanks a lot.

  • Aleksi
3 Likes
2

cc @satta for GitHub - satta/awesome-suricata: A curated list of awesome things related to Suricata :wink:

1 Like
3

Thanks for the hint, added!

1 Like
4

Nice! Would be nice to include it in our index, I think:

1 Like
5

Very happy to hear the rules are found useful, and included in collections. I might do some new scan type rules in the future too. Thanks.

6

Thank you for this. it is very helpful for me.

1 Like
7

Thanks a lot for taking the time to comment, and also very happy to hear that they are helping you. Me too, I wouldn’t have a router without them anymore. :face_with_peeking_eye:

  • Aleksi