# Léargas OT — DNP3 anomaly & control-function detections (Suricata)
#
# DNP3 over TCP, default port 20000. Uses Suricata's native DNP3 app-layer parser
# (app-layer-event + dnp3_func) rather than byte offsets.
#
# Note on "oversized": DNP3's data-link Length is a single byte (max 255), so there
# is no MBAP-style oversize. The malformed-length case is the parser event
# `dnp3.len_too_small`; volumetric abuse is `dnp3.flooded`. Control-function rules
# below add the high-value OT behavior (operate / restart).
#
# SIDs use a local 4202xxxx range; adjust to your numbering if it collides.

# --- Protocol anomalies / DoS (parser events) ---
alert dnp3 any any -> $HOME_NET 20000 ( \
    msg:"LEARGAS OT ANOMALY DNP3 malformed link-layer length (len_too_small)"; \
    app-layer-event:dnp3.len_too_small; \
    classtype:protocol-command-decode; \
    metadata:tag OT, tag DNP3, deployment Internal, signature_severity Informational, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42020001; rev:1; \
)

alert dnp3 any any -> $HOME_NET 20000 ( \
    msg:"LEARGAS OT DoS DNP3 request flood"; \
    app-layer-event:dnp3.flooded; \
    classtype:attempted-dos; \
    metadata:tag OT, tag DNP3, deployment Internal, mitre_attack_technique T0814, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42020002; rev:1; \
)

alert dnp3 any any -> $HOME_NET 20000 ( \
    msg:"LEARGAS OT ANOMALY DNP3 bad link-layer CRC"; \
    app-layer-event:dnp3.bad_link_crc; \
    classtype:protocol-command-decode; \
    metadata:tag OT, tag DNP3, deployment Internal, signature_severity Informational, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42020003; rev:1; \
)

# --- Control-plane function codes (behavioral OT detections) ---
# DNP3 application function codes: 3=SELECT 4=OPERATE 5=DIRECT_OPERATE
# 6=DIRECT_OPERATE_NR 13=COLD_RESTART 14=WARM_RESTART
alert dnp3 any any -> $HOME_NET 20000 ( \
    msg:"LEARGAS OT DNP3 Operate command (control action)"; \
    dnp3_func:4; \
    classtype:attempted-admin; \
    metadata:tag OT, tag DNP3, deployment Internal, mitre_attack_technique T0855, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42020010; rev:1; \
)

alert dnp3 any any -> $HOME_NET 20000 ( \
    msg:"LEARGAS OT DNP3 Direct Operate command (control action)"; \
    dnp3_func:5; \
    classtype:attempted-admin; \
    metadata:tag OT, tag DNP3, deployment Internal, mitre_attack_technique T0855, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42020011; rev:1; \
)

alert dnp3 any any -> $HOME_NET 20000 ( \
    msg:"LEARGAS OT DNP3 Cold Restart command (device restart/shutdown)"; \
    dnp3_func:13; \
    classtype:attempted-dos; \
    metadata:tag OT, tag DNP3, deployment Internal, mitre_attack_technique T0816, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42020012; rev:1; \
)

alert dnp3 any any -> $HOME_NET 20000 ( \
    msg:"LEARGAS OT DNP3 Warm Restart command (device restart/shutdown)"; \
    dnp3_func:14; \
    classtype:attempted-dos; \
    metadata:tag OT, tag DNP3, deployment Internal, mitre_attack_technique T0816, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42020013; rev:1; \
)