# Léargas OT — Modbus TCP anomaly & Rockwell MicroLogix 1400 CVE detections (Suricata)
#
# Design notes:
#   * No public PoC / pcap exists for CVE-2017-16740, so these are STRUCTURAL /
#     BEHAVIORAL detections, not exact exploit-byte signatures.
#   * MBAP header layout (Modbus TCP ADU):
#       bytes 0-1 Transaction ID | 2-3 Protocol ID (0x0000) | 4-5 Length | 6 Unit ID | 7 Function code
#     The Length field (bytes 4-5) counts Unit ID + PDU; legal max = 254 (0x00FE).
#   * Offsets below are absolute from the ADU start (single request per segment, the
#     normal OT case). Register-quantity tests are anchored `relative` to the matched
#     function code so they survive small layout shifts.
#   * SIDs use a local 42xxxxxx range; adjust to your numbering if it collides.
#
# Deploy order: start with 42000502 (informational anomaly), watch FP, then enable the
# CVE-attributed rules. Tune detection_filter counts to your environment.

# --- 1) Generic protocol anomaly: oversized MBAP length (deploy first, no CVE claim) ---
alert tcp any any -> $HOME_NET 502 ( \
    msg:"LEARGAS OT ANOMALY Modbus TCP oversized MBAP length (>254)"; \
    flow:to_server,established; \
    content:"|00 00|"; offset:2; depth:2; \
    byte_test:2,>,254,4,big; \
    classtype:protocol-command-decode; \
    reference:url,support.rockwellautomation.com/app/answers/answer_view/a_id/1070883; \
    metadata:tag OT, tag Modbus, deployment Internal, signature_severity Informational, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42000502; rev:1; \
)

# --- 2) CVE-2017-16740: REPEATED oversized Modbus TCP requests (buffer not deallocated -> DoS) ---
# Fires only after N oversized requests from the same source within the window -> the
# "repeated sending" behavior the advisory describes. Higher confidence than a single packet.
alert tcp any any -> $HOME_NET 502 ( \
    msg:"LEARGAS OT EXPLOIT Repeated oversized Modbus TCP requests - possible Rockwell MicroLogix 1400 CVE-2017-16740 DoS"; \
    flow:to_server,established; \
    content:"|00 00|"; offset:2; depth:2; \
    byte_test:2,>,254,4,big; \
    detection_filter:track by_src, count 5, seconds 60; \
    classtype:attempted-dos; \
    reference:cve,2017-16740; \
    reference:url,www.securityweek.com/rockwell-automation-patches-serious-flaw-micrologix-1400-plc/; \
    metadata:affected_product Rockwell_MicroLogix_1400, tag OT, tag Modbus, cve CVE_2017_16740, deployment Internal, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42016740; rev:2; \
)

# --- 3) CVE-2021-22659: read holding registers (FC 03) quantity beyond spec (>125) ---
alert tcp any any -> $HOME_NET 502 ( \
    msg:"LEARGAS OT EXPLOIT Modbus FC03 read-holding-registers quantity beyond spec (>125) - possible MicroLogix 1400 CVE-2021-22659"; \
    flow:to_server,established; \
    content:"|00 00|"; offset:2; depth:2; \
    content:"|03|"; offset:7; depth:1; \
    byte_test:2,>,125,2,relative,big; \
    classtype:attempted-dos; \
    reference:cve,2021-22659; \
    reference:url,www.cisa.gov/news-events/ics-advisories/icsa-21-033-01; \
    metadata:affected_product Rockwell_MicroLogix_1400, tag OT, tag Modbus, cve CVE_2021_22659, deployment Internal, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42122659; rev:1; \
)

# --- 3b) CVE-2021-22659: read input registers (FC 04) quantity beyond spec (>125) ---
alert tcp any any -> $HOME_NET 502 ( \
    msg:"LEARGAS OT EXPLOIT Modbus FC04 read-input-registers quantity beyond spec (>125) - possible MicroLogix 1400 CVE-2021-22659"; \
    flow:to_server,established; \
    content:"|00 00|"; offset:2; depth:2; \
    content:"|04|"; offset:7; depth:1; \
    byte_test:2,>,125,2,relative,big; \
    classtype:attempted-dos; \
    reference:cve,2021-22659; \
    reference:url,www.cisa.gov/news-events/ics-advisories/icsa-21-033-01; \
    metadata:affected_product Rockwell_MicroLogix_1400, tag OT, tag Modbus, cve CVE_2021_22659, deployment Internal, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42122661; rev:1; \
)

# --- 3c) CVE-2021-22659: write multiple registers (FC 16 / 0x10) count beyond spec (>123) ---
alert tcp any any -> $HOME_NET 502 ( \
    msg:"LEARGAS OT EXPLOIT Modbus FC16 write-multiple-registers count beyond spec (>123) - possible MicroLogix 1400 CVE-2021-22659"; \
    flow:to_server,established; \
    content:"|00 00|"; offset:2; depth:2; \
    content:"|10|"; offset:7; depth:1; \
    byte_test:2,>,123,2,relative,big; \
    classtype:attempted-dos; \
    reference:cve,2021-22659; \
    reference:url,www.cisa.gov/news-events/ics-advisories/icsa-21-033-01; \
    metadata:affected_product Rockwell_MicroLogix_1400, tag OT, tag Modbus, cve CVE_2021_22659, deployment Internal, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42122662; rev:1; \
)