Add Vitogate 300 rules

[mrheinen]

User description

This devices was recently featured in a CISA advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-01

On my setup I already recorded some attacks several months ago and in fact the vulnerabilities were reported in 2023 already so this isn't something new.

---

PR Type

Enhancement

---

Description

• Added a new YAML file rules/Vitogate-300.yaml containing detection rules for the Vitogate 300 device.
• These rules are likely in response to recently reported vulnerabilities, as mentioned in a CISA advisory (ICSA-24-254-01).
• The rules aim to enhance security monitoring and detection capabilities for Vitogate 300 devices.
• This addition is proactive, as attacks targeting these vulnerabilities have been observed several months prior.

---

Changes walkthrough 📝

	Relevant files
Enhancement	Vitogate-300.yaml Add Vitogate 300 detection rules                                                  rules/Vitogate-300.yaml Added new YAML file containing rules for Vitogate 300 device Likely includes detection rules for potential vulnerabilities or attacks +334/-1
Additional files (token-limit)	Vitogate-300.yaml ...                                                                                                            rules/Vitogate-300.yaml ... +334/-1

---

💡 PR-Agent usage: Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[codiumai-pr-agent-pro[bot]]

PR Reviewer Guide 🔍

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No key issues to review

[github-actions[bot]]

Preparing PR description...

[github-actions[bot]]

Preparing review...

[codiumai-pr-agent-pro[bot]]

PR Code Suggestions ✨

Category	Suggestion	Score
Best practice	Add descriptions to rules for better context and maintainability ___ **Consider adding a description field to each rule to provide context about its purpose or the specific vulnerability it's addressing. This would improve the maintainability and understandability of the rules.** [rules/Vitogate-300.yaml [17-33]](https://github.com/mrheinen/lophiid/pull/47/files#diff-17d1cf9c55610735f886b6b15e60cdc1fb0451c757b1e2f6a5b1fd42a752bc94R17-R33) ```diff - id: 341 uri: /cgi-bin/vitogate.cgi body: "" method: POST port: 0 uri_matching: exact body_matching: none content_id: 346 app_id: 128 app_uuid: c773b1ec-7dbe-4ca0-8ad8-e843977be358 content_uuid: 9895db17-f86c-489c-905f-7a436bc03932 created_at: 2024-09-19T20:14:23.887359Z updated_at: 2024-09-19T20:14:34.406345Z alert: true ext_version: 0 ext_uuid: b0af31bb-82c6-4378-9469-e125910f1f3a request_purpose: ATTACK + description: "Rule to detect potential exploit attempts on Vitogate 300 CGI script" ``` - [ ] **Apply this suggestion** Suggestion importance[1-10]: 8 Why: Adding descriptions to rules significantly improves understanding and maintainability, which is crucial for long-term management of security rules.	8
Enhancement	Use a more specific request purpose for potentially malicious requests ___ **Consider using a more specific request purpose for the rule with id 341. The current 'ATTACK' purpose might be too broad. If this is indeed an exploit attempt, consider using a more specific purpose like 'EXPLOIT' or 'VULNERABILITY_SCAN'.** [rules/Vitogate-300.yaml [17-33]](https://github.com/mrheinen/lophiid/pull/47/files#diff-17d1cf9c55610735f886b6b15e60cdc1fb0451c757b1e2f6a5b1fd42a752bc94R17-R33) ```diff - id: 341 uri: /cgi-bin/vitogate.cgi method: POST - request_purpose: ATTACK + request_purpose: EXPLOIT ``` - [ ] **Apply this suggestion** Suggestion importance[1-10]: 7 Why: The suggestion to use a more specific request purpose like 'EXPLOIT' instead of 'ATTACK' is valid and can improve the clarity of the rule's intent.	7
Maintainability	Group related fields together in each rule for better organization ___ **For consistency and better organization, consider grouping related fields together in each rule. For example, keep all identifier fields (id, content_id, app_id, etc.) together, and all request-related fields (uri, method, body, etc.) together.** [rules/Vitogate-300.yaml [34-50]](https://github.com/mrheinen/lophiid/pull/47/files#diff-17d1cf9c55610735f886b6b15e60cdc1fb0451c757b1e2f6a5b1fd42a752bc94R34-R50) ```diff - id: 340 - uri: /vitogate/device.png - body: "" - method: GET - port: 0 - uri_matching: exact - body_matching: none content_id: 345 app_id: 128 app_uuid: c773b1ec-7dbe-4ca0-8ad8-e843977be358 content_uuid: df6274c9-c870-4247-9343-bc6ab8579a69 + uri: /vitogate/device.png + method: GET + body: "" + port: 0 + uri_matching: exact + body_matching: none ``` - [ ] **Apply this suggestion** Suggestion importance[1-10]: 6 Why: Grouping related fields can improve readability and maintainability, but it's a minor organizational change that doesn't affect functionality.	6

💡 Need additional feedback ? start a PR chat