snmp: add snmp-events.rules file

Add a file containing rules to match SNMP protocol events.

Ticket: 8421
(cherry picked from commit cff3d6417a)

rules/Makefile.am

@@ -26,6 +26,7 @@ quic-events.rules \
 rfb-events.rules \
 smb-events.rules \
 smtp-events.rules \
+snmp-events.rules \
 ssh-events.rules \
 stream-events.rules \
 tls-events.rules \

rules/README.md

@@ -30,6 +30,7 @@ signature IDs.
 | FTP      | 2232000 | 2232999 |
 | POP3     | 2236000 | 2236999 |
 | LDAP     | 2237000 | 2237999 |
+| SNMP     | 2238000 | 2238999 |
 | DNS      | 2240000 | 2240999 |
 | PGSQL    | 2241000 | 2241999 |
 | mDNS     | 2242000 | 2242999 |

rules/snmp-events.rules

@@ -0,0 +1,9 @@
+# SNMP app layer event rules
+#
+# SID's fall in the 2238000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+#
+# These sigs fire at most once per connection.
+#
+alert snmp any any -> any any (msg:"SURICATA SNMP malformed data"; app-layer-event:snmp.malformed_data; classtype:protocol-command-decode; sid:2238000; rev:1;)
+alert snmp any any -> any any (msg:"SURICATA SNMP unknown security model"; app-layer-event:snmp.unknown_security_model; classtype:protocol-command-decode; sid:2238001; rev:1;)
+alert snmp any any -> any any (msg:"SURICATA SNMP version mismatch"; app-layer-event:snmp.version_mismatch; classtype:protocol-command-decode; sid:2238002; rev:1;)