Firewall Logs: Cleartext Protocol Traffic to Common Service Ports

title: "Firewall Logs: Cleartext Protocol Traffic to Common Service Ports"
id: cf113224-5bd3-4f3d-9599-b3108c6b65a1
status: stable
description: This rule flags firewall events where connections are allowed/forwarded to a set of common plaintext-capable service ports, which may indicate credentials or usernames could be transmitted without encryption. Cleartext protocols increase the chance that attackers can intercept or reuse authentication data during transit. It relies on firewall telemetry including destination port and action/blocked indicators from network access controls.
references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/firewall/net_firewall_cleartext_protocols.yml
author: Alexandr Yampolskyi, SOC Prime, Tim Shelton, Huntrule Team
date: 2019-03-26
modified: 2022-10-10
tags:
  - attack.credential-access
logsource:
  category: firewall
detection:
  selection:
    dst_port:
      - 8080
      - 21
      - 80
      - 23
      - 50000
      - 1521
      - 27017
      - 3306
      - 1433
      - 11211
      - 15672
      - 5900
      - 5901
      - 5902
      - 5903
      - 5904
  selection_allow1:
    action:
      - forward
      - accept
      - 2
  selection_allow2:
    blocked: "false"
  condition: selection and 1 of selection_allow*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d7fb8f0e-bd5f-45c2-b467-19571c490d7e
    type: derived