;COMMENT: Blacklist port scanners
;DESCRIPTION: Blacklist port scanners. Detects all common scans, including NanoProbes, half-open, full (connect), stealth (FIN), XMAS, NULL and Nessus. Default blacklisting period is 12 hours.

Trigger-RST-Blacklist
		Comment = "Outgoing RST triggers portscan detection",
		Rule-Action = Observe,
		Direction = Outgoing,
		Packet-Feature = Connection-Reset,
		Observation-Rule = "Portscan-Detection-Blacklist",

Trigger-Drop-Blacklist
		Comment = "Dropped packet triggers portscan detection",
		Rule-Action = Observe,
		Direction = Incoming,
		Packet-Feature = Dropped,
		Observation-Rule = "Portscan-Detection-Blacklist",

Portscan-Detection-Blacklist	
		Comment = "Detect incoming SYN port-scanning",
		Rule-Status = Passive,
		Rule-Action = Blacklist,
		Observation-Period = "2",
		Observe-Match-Count = 2,
		Direction = Incoming,
		Flags = "SYN -FIN -ACK",
		Port-Scan-Range = "0:65535",
		Port-Scan-Count = "> 3"

Portscan-FIN-Blacklist	
		Comment = "Detect incoming FIN port scanning",
		Rule-Action = Observe,
		Observation-Period = "2",
		Observe-Match-Count = 2,
		Direction = Incoming,
		Flags = "FIN -ACK",
		Port-Scan-Range = "0:65535",
		Port-Scan-Count = "> 3"

Portscan-XMAS-Blacklist	
		Comment = "Detect incoming XMAS port scan (all TCP flags set)",
		Rule-Action = Observe,
		Observation-Period = "2",
		Observe-Match-Count = 2,
		Direction = Incoming,
		Flags = "+SYN +FIN +URG +ACK +RST +PSH",
		Port-Scan-Range = "0:65535",
		Port-Scan-Count = "> 3"

Portscan-Null-Blacklist	
		Comment = "Detect incoming NULL port scan (all TCP flags reset)",
		Rule-Action = Observe,
		Observation-Period = "2",
		Observe-Match-Count = 2,
		Direction = Incoming,
		Flags = "-SYN -FIN -URG -ACK -RST -PSH",
		Port-Scan-Range = "0:65535",
		Port-Scan-Count = "> 3"

Nessus-404-Probe-Blacklist	
		Comment = "Warn of Nessus web-server scanning",
		Protocol = TCP,
		Destination-Port = "http",
		Rule-Action = Observe,
		Hex-String = "GET /cgi-bin/nessus_is_probing",
		Depth = 32,
		Direction = Incoming,

Nessus-DOS-Test-Blacklist	
		Comment = "Warn of DOS ARKIEA test (possible Nessus scan)",
		Protocol = TCP,
		Destination-Port = "617",
		Rule-Action = Observe,
		Packet-Size = ">1465",
		Direction = Incoming,
