Stealth XMAS Scan Port Probe
This rule detects a Stealth XMAS Scan Port Probe. An XMAS scan is a type of port scan where the FIN, PSH, and URG flags are set in the TCP header. This type of scan attempts to determine if a port is open by exploiting the TCP RFC 793. If a port is closed, the target system should respond with an RST packet. If the port is open, no response is expected. The rule specifically looks for TCP packets with the FPU (FIN, PSH, URG) flags set, originating from any source IP and port, destined for any IP on the local network ($HOME_NET) on any port. A threshold is applied to trigger an alert if 10 such packets are observed from the same source within a 30-second window, indicating a scanning activity.
Suricata
