Firewall Rule Accepting Cleartext Protocol Ports
Alerts on firewall-allowed traffic to common service ports that may carry credentials over unencrypted channels.
FreeReviewedSigma · Low · v2
- Category
- firewall
- Author
- Alexandr Yampolskyi, SOC Prime, Tim Shelton (SigmaHQ), DRL 1.1
- Published
- 2019-03-26
- Updated
- 2026-07-31
What it detects
This rule flags firewall traffic where connections to common cleartext and plaintext service ports are allowed (by actions such as accept/forward or action value 2). Attackers may use these exposed ports to capture credentials, perform session interception, or interact with services without encryption. It relies on firewall logs that record destination ports and the firewall action taken for those flows.
Reporting behind it
- cisecurity.orghttps://www.cisecurity.org/controls/cis-controls-list/
- pcisecuritystandards.orghttps://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- nvlpubs.nist.govhttps://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/firewall/net_firewall_cleartext_protocols.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
firewall-logs-cleartext-protocol-traffic-to-common-service-ports-d7fb8f0e
title: Firewall Rule Accepting Cleartext Protocol Ports
id: cf113224-5bd3-4f3d-9599-b3108c6b65a1
status: stable
description: This rule flags firewall traffic where connections to common cleartext and plaintext service ports are allowed (by actions such as accept/forward or action value 2). Attackers may use these exposed ports to capture credentials, perform session interception, or interact with services without encryption. It relies on firewall logs that record destination ports and the firewall action taken for those flows.
references:
- https://www.cisecurity.org/controls/cis-controls-list/
- https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/firewall/net_firewall_cleartext_protocols.yml
author: Alexandr Yampolskyi, SOC Prime, Tim Shelton, Huntrule Team
date: 2019-03-26
modified: 2022-10-10
tags:
- attack.credential-access
logsource:
category: firewall
detection:
selection:
dst_port:
- 8080
- 21
- 80
- 23
- 50000
- 1521
- 27017
- 3306
- 1433
- 11211
- 15672
- 5900
- 5901
- 5902
- 5903
- 5904
selection_allow1:
action:
- forward
- accept
- 2
selection_allow2:
blocked: "false"
condition: selection and 1 of selection_allow*
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: d7fb8f0e-bd5f-45c2-b467-19571c490d7e
type: derived