Skip to content
This repository was archived by the owner on Apr 14, 2023. It is now read-only.

Commit 1c4fd93

Browse files
iadgovuser5iadgovuser5
authored
Merge pull request #7 from iadgov/3.2.1
3.2.1 updates
2 parents b1cf932 + 776fc0b commit 1c4fd93

File tree

162 files changed

+5516
-519
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

162 files changed

+5516
-519
lines changed

‎GM3/build-ant.xml

+4-4
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ where methods that are used in GRASSMARLIN are declared private).
8080
<target name="compile" depends="gensrc-Fingerprinting" description="Compile sources to .class files">
8181
<mkdir dir="${build.classes.dir}"/>
8282

83-
<javac includeantruntime="false" srcdir="${src.dir}" destdir="${build.classes.dir}" verbose="true" debug="false">
83+
<javac includeantruntime="false" srcdir="${src.dir}" destdir="${build.classes.dir}" verbose="true" debug="true">
8484
<src path="${gen.dir}"/>
8585
<classpath refid="lib.classpath"/>
8686
</javac>
@@ -226,11 +226,11 @@ where methods that are used in GRASSMARLIN are declared private).
226226
<arg value="${build.dir}\temp\grassmarlin-64.wixobj" />
227227
</exec>
228228

229-
<!-- Builds with live pcap disabled -->
229+
<!-- Build with live pcap disabled (works on 32- and 64-bit) -->
230230
<echo message="Building Windows Installer with Live PCAP Disabled..." />
231231
<exec executable="${exec.candle}">
232232
<arg value="-dStagingPath=${build.app}" />
233-
<arg value="-dLauncherFile=Installers\WindowsInstallers\GrassMarlin.bat" />
233+
<arg value="-dLauncherFile=Installers\WindowsInstallers\GrassMarlin_NoPcap.bat" />
234234
<arg value="-o" />
235235
<arg value="${build.dir}\temp\grassmarlin-nolive.wixobj" />
236236
<arg value="Installers\WindowsInstallers\Windows.wix" />
@@ -303,7 +303,7 @@ where methods that are used in GRASSMARLIN are declared private).
303303
<echo message="Building Windows ZIP without Live PCAP..." />
304304
<zip destfile="${build.dir}/GrassMarlin-Win-NoLivePcap.zip">
305305
<zipfileset dir="${build.app}" excludes="**\iadgov.csvimport.jar,**\iadgov.sessioneventtest.jar" />
306-
<zipfileset file="Installers/WindowsInstallers/GrassMarlin.bat" />
306+
<zipfileset file="Installers/WindowsInstallers/GrassMarlin_NoPcap.bat" />
307307
</zip>
308308

309309
<delete dir="${build.dir}/temp" />

‎GM3/data/fingerprint/ADA Control.xml

+9-6
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,19 @@
33
<Header>
44
<Name>ADA Control</Name>
55
<Author>Default</Author>
6-
<Description>This fingerprint looks for the evidence of ADA Control traffic.</Description>
7-
<Tag>Original</Tag>
6+
<Description>This fingerprint looks for evidence of ADA Control traffic.</Description>
87
</Header>
9-
<Filter For="default">
8+
<Filter For="ADA-CIP" Name="DstPort">
109
<DstPort>2085</DstPort>
1110
</Filter>
12-
<Payload For="default">
11+
<Payload For="ADA-CIP">
12+
<Description>TCP/UDP ADA-CIP</Description>
1313
<Always>
14-
<Return Confidence="1">
15-
<Extract Name="ADA-CIP" From="CURSOR_START" To="CURSOR_END"/>
14+
<Return Confidence="5">
15+
<Details>
16+
<Category>ICS_HOST</Category>
17+
<Detail Name="ICSProtocol">ADA-CIP</Detail>
18+
</Details>
1619
</Return>
1720
</Always>
1821
</Payload>

‎GM3/data/fingerprint/AIMPP.xml

+22-10
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,34 @@
33
<Header>
44
<Name>AIMPP</Name>
55
<Author>Default</Author>
6-
<Description>This fingerprint looks for the evidence of AIMPP Hello traffic.This fingerprint looks for the evidence of AIMPP Port Req traffic.</Description>
6+
<Description>This fingerprint looks for evidence of TCP/UDP AIMPP Hello traffic. This fingerprint looks for evidence of TCP/UDP AIMPP Port Req traffic.</Description>
77
</Header>
8-
<Filter For=" Hello">
8+
<Filter For="Hello" Name="Hello 2846">
99
<DstPort>2846</DstPort>
10-
</Filter>
11-
<Filter For=" Port Req">
10+
</Filter>
11+
<Filter For="Port Req" Name="Port Req 2847">
1212
<DstPort>2847</DstPort>
1313
</Filter>
14-
<Payload For=" Hello">
14+
<Payload For="Hello">
15+
<Description>Hello AIMPP that hits on destination port</Description>
1516
<Always>
16-
<Return Confidence="1"/>
17+
<Return Direction="SOURCE" Confidence="5">
18+
<Details>
19+
<Category>ICS_HOST</Category>
20+
<Detail Name="Product">AIMPP Hello</Detail>
21+
</Details>
22+
</Return>
1723
</Always>
18-
</Payload>
19-
<Payload For=" Port Req">
24+
</Payload>
25+
<Payload For="Port Req">
26+
<Description>Port Req AIMPP that hits on destination port</Description>
2027
<Always>
21-
<Return Confidence="1"/>
28+
<Return Direction="SOURCE" Confidence="5">
29+
<Details>
30+
<Category>ICS_HOST</Category>
31+
<Detail Name="Product">AIMPP Port Req</Detail>
32+
</Details>
33+
</Return>
2234
</Always>
23-
</Payload>
35+
</Payload>
2436
</Fingerprint>

‎GM3/data/fingerprint/ANSI.xml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<Fingerprint>
3+
<Header>
4+
<Name>ANSI</Name>
5+
<Author>Default</Author>
6+
<Description>This fingerprint identifies evidenece of ANSI x3.28, z39.50, and c1222-asse traffic.</Description>
7+
</Header>
8+
<Filter For="ANSI 1" Name="z39.50">
9+
<DstPort>210</DstPort>
10+
</Filter>
11+
<Filter For="ANSI 2" Name="c1222-asse">
12+
<DstPort>1153</DstPort>
13+
</Filter>
14+
<Payload For="ANSI 1">
15+
<Description>Developed by Allen Bradley to communicate between stations and substations. Z39.50</Description>
16+
<Always>
17+
<Return Direction="SOURCE" Confidence="5">
18+
<Details>
19+
<Detail Name="ISCProtocol">ANSI</Detail>
20+
</Details>
21+
</Return>
22+
</Always>
23+
</Payload>
24+
<Payload For="ANSI 2">
25+
<Description>Developed by Allen Bradley to communicate between stations and substations. C1222-ASSE.</Description>
26+
<Always>
27+
<Return Direction="SOURCE" Confidence="5">
28+
<Details>
29+
<Detail Name="ICSProtocol">ANSI</Detail>
30+
</Details>
31+
</Return>
32+
</Always>
33+
</Payload>
34+
</Fingerprint>

‎GM3/data/fingerprint/ASP.Net.xml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<Fingerprint>
3+
<Header>
4+
<Name>ASP.Net</Name>
5+
<Author>Default</Author>
6+
<Description>This fingerprint identifies evidence of session states that stores data out of process.</Description>
7+
</Header>
8+
<Filter For="ASP.Net" Name="State Service">
9+
<DstPort>42424</DstPort>
10+
</Filter>
11+
<Payload For="ASP.Net">
12+
<Description>Payload supports asp.net state service</Description>
13+
<Always>
14+
<Return Direction="SOURCE" Confidence="5">
15+
<Details>
16+
<Detail Name="Microsoft Server Product">ASP.NET</Detail>
17+
</Details>
18+
</Return>
19+
</Always>
20+
</Payload>
21+
</Fingerprint>

‎GM3/data/fingerprint/Allen Bradley.xml

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<Fingerprint>
3+
<Header>
4+
<Name>Allen Bradley</Name>
5+
<Author>Default</Author>
6+
<Description>This is the response seen from a device running an Allen Bradley specific web server and providing its device description via a web page.
7+
This is evidence of some sort of Allen Bradley Intelligent Electronic Device (IED).
8+
This is the response seen from a device running an Allen Bradley specific web server. "Server: A-B WWW/0.1"
9+
This is evidence of some sort of Allen Bradley Intelligent Electronic Device (IED).
10+
This is the response seen from a device running an Allen Bradley specific web server and providing its device name via a web page.
11+
This is evidence of some sort of Allen Bradley Intelligent Electronic Device (IED).
12+
</Description>
13+
</Header>
14+
<Filter For="Bradley Web Server Device Description" Name="Server Device">
15+
<TransportProtocol>6</TransportProtocol>
16+
<Ethertype>2048</Ethertype>
17+
<SrcPort>80</SrcPort>
18+
</Filter>
19+
<Filter For="Bradley Web Server" Name="Web Server">
20+
<TransportProtocol>6</TransportProtocol>
21+
<Ethertype>2048</Ethertype>
22+
<SrcPort>80</SrcPort>
23+
</Filter>
24+
<Filter For="Bradley Web Server Device Name" Name="Server Device Name">
25+
<TransportProtocol>6</TransportProtocol>
26+
<Ethertype>2048</Ethertype>
27+
<SrcPort>80</SrcPort>
28+
</Filter>
29+
<Filter For="All newer Rockwell PLC" Name="Rockwell PLC">
30+
<TransportProtocol>6</TransportProtocol>
31+
<DstPort>44818</DstPort>
32+
</Filter>
33+
<Payload For="Bradley Web Server Device Description">
34+
<Description>Bradley Web Server Device Description</Description>
35+
<Match Offset="0" Reverse="true" NoCase="false" Depth="0" Relative="true" Within="0" MoveCursors="true">
36+
<Pattern>Description&lt;/td&gt;&lt;td&gt;</Pattern>
37+
<AndThen>
38+
<Match Offset="0" Reverse="true" NoCase="false" Depth="0" Relative="true" Within="0" MoveCursors="false">
39+
<Content Type="HEX">3C</Content>
40+
<AndThen>
41+
<Anchor Cursor="END" Position="CURSOR_MAIN" Relative="false" Offset="0"/>
42+
<Return Direction="SOURCE" Confidence="4">
43+
<Details>
44+
<Category>IED</Category>
45+
<Role>SERVER</Role>
46+
<Detail Name="ICSProtocol">Bradley Web Server Device Description</Detail>
47+
</Details>
48+
</Return>
49+
</AndThen>
50+
</Match>
51+
</AndThen>
52+
</Match>
53+
</Payload>
54+
<Payload For="Bradley Web Server">
55+
<Description>Bradley Web Server</Description>
56+
<Match Offset="17" Reverse="true" NoCase="false" Depth="0" Relative="true" Within="0" MoveCursors="true">
57+
<Content Type="HEX">5365727665723A20412D42205757572F302E310D0A</Content>
58+
<AndThen>
59+
<Return Direction="SOURCE" Confidence="4">
60+
<Details>
61+
<Category>IED</Category>
62+
<Role>SERVER</Role>
63+
<Detail Name="ICSProtocol">Bradley Web Server</Detail>
64+
</Details>
65+
</Return>
66+
</AndThen>
67+
</Match>
68+
</Payload>
69+
<Payload For="Bradley Web Server Device Name">
70+
<Description>Bradley Web Server Device Name</Description>
71+
<Match Offset="184" Reverse="true" NoCase="false" Depth="0" Relative="true" Within="0" MoveCursors="true">
72+
<Content Type="HEX">73733D52363E446576696365204E616D653C2F74643E3C74643E</Content>
73+
<AndThen>
74+
<Match Offset="0" Reverse="true" NoCase="false" Depth="0" Relative="true" Within="0" MoveCursors="false">
75+
<Content Type="HEX">3C</Content>
76+
<AndThen>
77+
<Anchor Cursor="END" Position="CURSOR_MAIN" Relative="false" Offset="0"/>
78+
<Return Direction="SOURCE" Confidence="4">
79+
<Details>
80+
<Category>IED</Category>
81+
<Role>SERVER</Role>
82+
<Detail Name="ICSProtocol">Bradely Web Server Device Name</Detail>
83+
</Details>
84+
</Return>
85+
</AndThen>
86+
</Match>
87+
</AndThen>
88+
</Match>
89+
</Payload>
90+
<Payload For="All newer Rockwell PLC">
91+
<Description>Allen Bradley Rockwell PLC</Description>
92+
<Always>
93+
<Return Direction="SOURCE" Confidence="5">
94+
<Details>
95+
<Category>PLC</Category>
96+
<Detail Name="ICSProtocol">Allen Bradley Rockwell PLC</Detail>
97+
</Details>
98+
</Return>
99+
</Always>
100+
</Payload>
101+
</Fingerprint>

‎GM3/data/fingerprint/Automation Direct DirectNET.xml

+112
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<Fingerprint>
3+
<Header>
4+
<Name>Automation Direct DirectNET</Name>
5+
<Author>Default</Author>
6+
<Description>This fingerprint looks for evidence of Automation Direct's DirectNet protocol traffic.</Description>
7+
</Header>
8+
<Filter For="DirectNet Master TCP" Name="MASTER TCP">
9+
<TransportProtocol>6</TransportProtocol>
10+
<DstPort>3447</DstPort>
11+
</Filter>
12+
<Filter For="DirectNet Slave TCP" Name="SLAVE TCP">
13+
<TransportProtocol>17</TransportProtocol>
14+
<SrcPort>3447</SrcPort>
15+
</Filter>
16+
<Filter For="DirectNet Master UDP" Name="MASTER UDP">
17+
<TransportProtocol>17</TransportProtocol>
18+
<DstPort>3447</DstPort>
19+
</Filter>
20+
<Filter For="DirectNet Slave UDP" Name="SLAVE UDP">
21+
<TransportProtocol>17</TransportProtocol>
22+
<SrcPort>3447</SrcPort>
23+
</Filter>
24+
<Payload For="DirectNet Master TCP">
25+
<Description>DirectNet MASTER that matches the HEX pattern</Description>
26+
<Always>
27+
<Return Direction="SOURCE" Confidence="5">
28+
<Details>
29+
<Category>MTU</Category>
30+
<Role>MASTER</Role>
31+
<Detail Name="ICSProtocol">Automation Direct DirectNet</Detail>
32+
</Details>
33+
</Return>
34+
</Always>
35+
<Match Offset="0" Reverse="true" NoCase="false" Depth="0" Relative="false" Within="0" MoveCursors="true">
36+
<Content Type="HEX">4E2105</Content>
37+
<AndThen>
38+
<Return Direction="SOURCE" Confidence="5">
39+
<Details>
40+
<Detail Name="ICSProtocol">Automation Direct DirectNet</Detail>
41+
</Details>
42+
</Return>
43+
</AndThen>
44+
</Match>
45+
</Payload>
46+
<Payload For="DirectNet Slave TCP">
47+
<Description>DirectNet SLAVE that matches the HEX pattern</Description>
48+
<Always>
49+
<Return Direction="SOURCE" Confidence="5">
50+
<Details>
51+
<Category>RTU</Category>
52+
<Role>SLAVE</Role>
53+
<Detail Name="ICSProtocol">Automation Direct DirectNet</Detail>
54+
</Details>
55+
</Return>
56+
</Always>
57+
<Match Offset="0" Reverse="true" NoCase="false" Depth="0" Relative="false" Within="0" MoveCursors="true">
58+
<Content Type="HEX">4E2105</Content>
59+
<AndThen>
60+
<Return Direction="SOURCE" Confidence="5">
61+
<Details>
62+
<Detail Name="ICSProtocol">Automation Direct DirectNet</Detail>
63+
</Details>
64+
</Return>
65+
</AndThen>
66+
</Match>
67+
</Payload>
68+
<Payload For="DirectNet Master UDP">
69+
<Description>DirectNet MASTER that matches the HEX pattern</Description>
70+
<Always>
71+
<Return Direction="SOURCE" Confidence="5">
72+
<Details>
73+
<Category>MTU</Category>
74+
<Role>MASTER</Role>
75+
<Detail Name="ICSProtocol">Automation Direct DirectNet</Detail>
76+
</Details>
77+
</Return>
78+
</Always>
79+
<Match Offset="0" Reverse="true" NoCase="false" Depth="0" Relative="false" Within="0" MoveCursors="true">
80+
<Content Type="HEX">4E2105</Content>
81+
<AndThen>
82+
<Return Direction="SOURCE" Confidence="5">
83+
<Details>
84+
<Detail Name="ICSProtocol">Automation Direct DirectNet</Detail>
85+
</Details>
86+
</Return>
87+
</AndThen>
88+
</Match>
89+
</Payload>
90+
<Payload For="DirectNet Slave UDP">
91+
<Description>DirectNet SLAVE that matches the HEX pattern</Description>
92+
<Always>
93+
<Return Direction="SOURCE" Confidence="5">
94+
<Details>
95+
<Category>RTU</Category>
96+
<Role>SLAVE</Role>
97+
<Detail Name="ICSProtocol">Automation Direct DirectNet</Detail>
98+
</Details>
99+
</Return>
100+
</Always>
101+
<Match Offset="0" Reverse="true" NoCase="false" Depth="0" Relative="false" Within="0" MoveCursors="true">
102+
<Content Type="HEX">4E2105</Content>
103+
<AndThen>
104+
<Return Direction="SOURCE" Confidence="5">
105+
<Details>
106+
<Detail Name="ICSProtocol">Automation Direct DirectNet</Detail>
107+
</Details>
108+
</Return>
109+
</AndThen>
110+
</Match>
111+
</Payload>
112+
</Fingerprint>

0 commit comments

Comments
 (0)