---

# === Modbus protocol monitoring (port 502) ===

# Любое подключение к Modbus
alert tcp any any -> $HOME_NET 502 (msg:"OT: Modbus connection detected"; sid:1000001; rev:1;)

# Modbus Write Multiple Registers - потенциально опасная команда
alert tcp any any -> $HOME_NET 502 (msg:"OT: Modbus Write Multiple Registers command"; content:"|00 00 00 00 00 06 01 10|"; depth:8; sid:1000002; rev:1;)

# Сканирование Modbus (10+ пакетов с одного IP за минуту)
alert tcp any any -> $HOME_NET 502 (msg:"OT: Modbus port scan detected"; flow:established,to_server; threshold:type both, track by_src, count 10, seconds 60; sid:1000003; rev:1;)

# === IEC 60870-5-104 (port 2404) ===
alert tcp any any -> $HOME_NET 2404 (msg:"OT: IEC 104 connection detected"; sid:1000004; rev:1;)

# === IEC 61850 MMS (port 102) ===
alert tcp any any -> $HOME_NET 102 (msg:"OT: IEC 61850 MMS connection detected"; sid:1000005; rev:1;)

# === Подключение к SCADA не из ADMIN-сегмента ===
alert tcp !192.168.20.0/24 any -> 192.168.30.0/24 [502,2404,102] (msg:"OT: Unauthorized access attempt to SCADA from non-admin network"; sid:1000010; rev:1;)

# === Явно про Kali (для отчёта - модель угроз) ===
alert tcp 10.0.20.0/24 any -> 192.168.30.0/24 any (msg:"OT: Pentester (Kali) accessing OT network"; sid:1000011; rev:1;)

# === ICMP-тест (для проверки что Suricata вообще ловит) ===
alert icmp any any -> $HOME_NET any (msg:"OT: ICMP ping in monitored network"; sid:1000099; rev:1;)