Bandwidth Hijack via Peer-to-Peer Botnet Traffic
This rule detects potential bandwidth hijacking activity associated with peer-to-peer botnet traffic. It triggers an alert when a high volume of TCP traffic (more than 200 packets within 60 seconds) with a packet size greater than 1000 bytes is observed originating from the home network to any destination. The 'flow:to_server,established' indicates that the rule is looking for established connections where the traffic is flowing from the internal network to an external server. The 'threshold' keyword ensures that only sustained high-volume traffic triggers the alert, reducing noise from legitimate, short bursts of activity. The 'classtype:policy-violation' suggests that this activity is considered a violation of network usage policies.
Suricata
