NF – Policy – SMB2 connection containing CISF fileshare information – Check for external IP
The rule detects an SMB2 connection containing CISF fileshare information. The rule suggests checking for an external IP address involved in the communication.
NF – POLICY – Covert iodine tunnel request
The rule detects covert iodine tunnel requests within DNS traffic. The rule helps identify potential unauthorized or covert communication channels using iodine tunnels.
NF – POLICY – Windows XP making Internet connection – IE 8 – Company Policy Violation
The rule detects instances where a host on the internal network (Windows XP) is making an Internet connection using Internet Explorer 8 (IE 8) with a User-Agent header indicating Windows NT 5.1 (Windows XP). This activity is flagged as a potential company policy violation, possibly due to security concerns related to the use of outdated software and operating systems.
NF – NTPD Kiss-o’-Death – Peer Polling Interval 10
The rule detects NTPD (Network Time Protocol Daemon) Kiss-o'-Death packets with a peer polling interval of 10. NTPD Kiss-o'-Death packets are used to signal to an NTP server that it should stop sending time updates to the client for a specified interval. The rule can help identify potential NTP-related issues or attacks involving NTP servers and clients with specific polling intervals.
NF – Host name with IP address sending exe file
The rule detects HTTP responses containing an executable file (exe file) being served from a web server with a host name that includes an IP address. This could indicate potentially suspicious or malicious activity, as legitimate web servers typically use domain names in their host names, not IP addresses.