perdition (imap/pop3 proxy) rule

[gkissand]

This decoder and rule will monitor perdition connections and create a level 10 alert on multiple connections from same source ip

For maintainers: PCI tags, descriptions etc were copied from pure-ftp decoders/rules. It successfully detected DoS attacks (tested live)

[Zenidd]

Hello @gkissand,

Thanks for your contribution. We will review it and if possible, it will be added to Wazuh-Ruleset.



Best regards,

Juan Pablo Sáez

[Lopuiz]

Hello @gkissand,

First, thanks for your contribution to the Ruleset project.
Rules and decoders work fine.
We will merge it as soon as possible.

Regards, Eva

[chemamartinez]

Hi, rule IDs greater than 100000 are reserved for custom rules. Please change these IDs to others less than 100000.

Thanks.

[gkissand]

Hi,
Should I do the rule id changes?
If so, is there an inventory of rule ids not to use an id that is already in use?

Thank you
George

[chemamartinez]

Hi @gkissand,

First of all, thanks for your contribution to the project.

I think the best solution here is to add this group of rules to the syslog dedicated file: https://github.com/wazuh/wazuh-ruleset/blob/3.10/rules/0020-syslog_rules.xml

That way we are not creating a new file for three rules related to syslog. You can continue the rule IDs account for that file. I would use IDs 2961-2963.

Regards.

[gkissand]

I added perdition rules in the syslog file as recommended
Thank you for your help

[chemamartinez]

I added perdition rules in the syslog file as recommended
Thank you for your help

Hi @gkissand,

I cannot see any change in the Syslog rules file. Have you pushed your last changes?

Regards.

[gkissand]

As you might have realized I am not very familiar with github/git. I think I managed this time. If it's not problem, feel free to do any changes needed for merging to master

thank you

[chemamartinez]

As you might have realized I am not very familiar with github/git. I think I managed this time. If it's not problem, feel free to do any changes needed for merging to master

thank you

Now I see the rules duplicated, don't worry about it, I'll fix it while merging. Thanks again for the contribution and for applying the requested changes. It will be available in the next minor version (3.10.0).

Regards.