Possible Cleartext Protocol Use (via firewall)

title: Possible Cleartext Protocol Use (via firewall)
id: b77c7281-dcf0-5950-91a2-92a567216c50
status: stable
description: This rule detects ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
references:
    - https://www.cisecurity.org/controls/cis-controls-list/
    - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
    - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
author: Huntrule Team
date: 2026-07-04
tags:
    - attack.credential-access
    - attack.t1040
logsource:
    category: firewall
detection:
    selection:
        dst_port:
            - 8080
            - 21
            - 80
            - 23
            - 50000
            - 1521
            - 27017
            - 3306
            - 1433
            - 11211
            - 15672
            - 5900
            - 5901
            - 5902
            - 5903
            - 5904
    selection_allow1:
        action:
            - forward
            - accept
            - 2
    selection_allow2:
        blocked: "false"
    condition: selection and 1 of selection_allow*
falsepositives:
    - Unknown
level: low