New Allocation for [Leargas Security OT]

[julioliraup]

Contact Details

No response

What organization is requesting an allocation?

Leargas Security

How many sids are required?

7.019

Please provide reference links

https://github.com/LeargasSecurity/leargas-suricata-public-rules

IDS Engine

• Snort
• Suricata

Download Links

https://raw.githubusercontent.com/LeargasSecurity/leargas-suricata-public-rules/refs/heads/main/rules/enip.rules
https://raw.githubusercontent.com/LeargasSecurity/leargas-suricata-public-rules/refs/heads/main/rules/dnp3.rules
https://raw.githubusercontent.com/LeargasSecurity/leargas-suricata-public-rules/refs/heads/main/rules/modbus.rules

[julioliraup]

Range	Protocol	Notes
42000502, 42016740, 42122659–42122662	Modbus	anomaly + CVE-2017-16740 / CVE-2021-22659
42020001–42020013	DNP3	anomalies + control functions
42044000–42044999	EtherNet/IP + CIP	AA26-097A recon + external session/CIP writes (42044001–42044012)
3700000–3700999	S7comm	reserved — lives in suricata-ics-parsers

[jasonish]

A contiguous range for https://github.com/LeargasSecurity/leargas-suricata-public-rules would be better, I'll drop on note in the linked ticket.