;COMMENT: Log incoming port scanners
;DESCRIPTION: Port scanners are logged in the Security Event Log. Detects all common scans, including NanoProbes, half-open, full (connect), stealth (FIN), XMAS, NULL and Nessus.

Trigger-RST-Log
		Comment = "Outgoing RST triggers portscan detection",
		Rule-Action = Observe,
		Direction = Outgoing,
		Packet-Feature = Connection-Reset,
		Observation-Rule = "Portscan-Detection-Log",

Trigger-Drop-Log
		Comment = "Dropped packet triggers portscan detection",
		Rule-Action = Observe,
		Direction = Incoming,
		Packet-Feature = Dropped,
		Observation-Rule = "Portscan-Detection-Log",

Portscan-Detection-Log	
		Comment = "Detect incoming SYN port-scanning",
		Rule-Status = Passive,
		Rule-Action = Log,
		Log-Control = Enabled,
		Log-Message = "Detected full/half-open port scan.",
		Log-Details = "Port scanning is a method for discovering open TCP ports. The technique probes a number of ports and then keep track of the ones that are useful to the hacker. The half port scan sends only a packet with the SYN bit, while the full port scan establish real connections with your machine.",
		Log-Severity = Medium,
		Observation-Period = "2",
		Observe-Match-Count = 2,
		Direction = Incoming,
		Flags = "SYN -FIN -ACK",
		Port-Scan-Range = "0:65535",
		Port-Scan-Count = "> 3"

Portscan-FIN-Log	
		Comment = "Detect incoming FIN port scanning",
		Rule-Action = Observe,
		Alternate-Action = Observe,
		Dynamic-Alternate-Action = Log,
		Log-Control = Enabled,
		Log-Message = "Detected stealth (TCP FIN) port scan",
		Log-Details = "Port scanning is a method for discovering open TCP ports. The Stealth TCP FIN scan is designed to bypass the traditional firewall protection against SYN based scanning. The technique relies on the fact that closed ports reply to FIN packets with RST, while open ports ignore the FIN packet. Only very few IP stacks can effectively be scanned using this approach.",
		Log-Severity = Medium,
		Observation-Period = "2",
		Observe-Match-Count = 2,
		Direction = Incoming,
		Flags = "FIN -ACK",
		Security-Level = 99,
		Port-Scan-Range = "0:65535",
		Port-Scan-Count = "> 3"

Portscan-XMAS-Log	
		Comment = "Detect incoming port scan based all TCP flags being on (XMAS scan)",
		Rule-Action = Observe,
		Alternate-Action = Observe,
		Dynamic-Alternate-Action = Log,
		Log-Control = Enabled,
		Log-Message = "xmas portscan detected",
		Log-Severity = Medium,
		Log-Details = "Port scanning is a method for discovering open TCP ports. The technique probes a number of ports and then keep track of the ones that are useful to the hacker. The XMAS portscan sends TCP packets with all flags set. This type of scanning is extremely rare and not very effective, but it does indicate that someone is testing your Internet security.",
		Observation-Period = "2",
		Observe-Match-Count = 2,
		Direction = Incoming,
		Flags = "+SYN +FIN +URG +ACK +RST +PSH",
		Security-Level = 99,
		Port-Scan-Range = "0:65535",
		Port-Scan-Count = "> 3"

Portscan-Null-Log	
		Comment = "Detect incoming port scan based all TCP flags being off (NULL scan)",
		Rule-Action = Observe,
		Alternate-Action = Observe,
		Dynamic-Alternate-Action = Log,
		Log-Control = Enabled,
		Log-Message = "NULL portscan detected",
		Log-Severity = Medium,
		Log-Details = "Port scanning is a method for discovering open TCP ports. The technique probes a number of ports and then keep track of the ones that are useful to the hacker. The NULL portscan sends TCP packets with no flags set. This type of scanning is extremely rare and not very effective, but it does indicate that someone is testing your Internet security.",
		Observation-Period = "2",
		Observe-Match-Count = 2,
		Direction = Incoming,
		Flags = "-SYN -FIN -URG -ACK -RST -PSH",
		Security-Level = 99,
		Port-Scan-Range = "0:65535",
		Port-Scan-Count = "> 3"

Nessus-404-Probe-Log	
		Comment = "Warn of Nessus web-server scanning",
		Protocol = TCP,
		Destination-Port = "http",
		Rule-Action = Observe,
		Alternate-Action = Observe,
		Dynamic-Alternate-Action = Log,
		Log-Control = Enabled,
		Log-Message = "Nessus 404 probes detected",
		Log-Severity = Medium,
		Log-Details = "The firewall has detected a Nessus web-server scan. Nessus is one of the leading vulnerability checkers, used both by hackers and security experts. The scan itself will generally not harm the system, but it may reveal information (such as your Operating System).",
		Hex-String = "GET /cgi-bin/nessus_is_probing",
		Depth = 32,
		Direction = Incoming,
		Security-Level = 99

Nessus-DOS-Test-Log	
		Comment = "Warn of DOS ARKIEA test (possible Nessus scan)",
		Protocol = TCP,
		Destination-Port = "617",
		Rule-Action = Observe,
		Alternate-Action = Observe,
		Dynamic-Alternate-Action = Log,
		Log-Control = Enabled,
		Log-Message = "DOS ARKIEA test (possible Nessus scan)",
		Log-Severity = High,
		Log-Details = "The firewall has detected a DOS ARKIEA scan. Nessus is one of the leading vulnerability checkers, used both by hackers and security experts. The scan itself will generally not harm the system, but it may reveal information (such as your Operating System).",
		Packet-Size = ">1465",
		Direction = Incoming,
		Security-Level = 99
