NF – ISAKMP VPN Connection setup from host to outbound destination – Windows 7 SP2 – Windows Server 2008 / 2008 R2
The rule detects ISAKMP VPN connection setups originating from the internal network to an outbound destination (EXTERNAL_NET), with a specific ISAKMP Initiator cookie value (00 00 00 08). The rule is intended to provide visibility into ISAKMP VPN connection attempts, particularly those related to Windows 7 SP2 - Windows Server 2008 / 2008 R2 hosts, and assist in monitoring and securing VPN communication in the network.
NF – ISAKMP VPN Connection setup from host to outbound destination – Windows 2000
The rule detects ISAKMP VPN connection setups originating from the internal network to an outbound destination (EXTERNAL_NET), with a specific ISAKMP Initiator cookie value (00 00 00 02). The rule is intended to provide visibility into ISAKMP VPN connection attempts, particularly those related to Windows 2000 hosts, and assist in monitoring and securing VPN communication in the network.
NF – Echo Request Payload – Bigger than 100 bytes
The rule detects ICMP Echo Request packets with a payload size larger than 100 bytes. ICMP Echo Request packets are typically used to check the reachability of a host and a larger payload in such requests may indicate potential abnormal or suspicious behavior, which could be worth investigating.
NF – Echo Reply Payload – Bigger than 100 bytes
The rule detects ICMP Echo Reply packets with a payload size larger than 100 bytes. ICMP Echo Reply packets are typically responses to ICMP Echo (Ping) requests, and a larger payload in such responses may indicate potential abnormal or suspicious behavior, which could be worth investigating.
NF – IOC – Classic-STUN Binding Request – Used by Dyre Malware
The rule detects UDP traffic containing a "Classic-STUN Binding Request" message associated with the Dyre malware. Dyre is a trojan that targets financial institutions and is known for its credential-stealing capabilities (www.secureworks.com/cyber-threat-intelligence/threats/dyre-banking-trojan).