honeyd ruleset for prelude-lml

Bjoern Weiland <[email protected]> Tue, 29 Aug 2006 12:23:57 +0200

Newsgroups	gmane.comp.security.ids.prelude.devel
Message-ID	<[email protected]>

Here we go as announced last week, an up to date honeyd ruleset for
consideration.

 -regards, bjoern

PS: I just put some random id(s) into the ruleset as I don't know how
they are allocated for the rules. Furthermore, there's gotta be some
changes in the pcre.rules to trigger at the correct events:

Momentarily, it's

regex=honeyd;				include = honeyd.rules;

but it's gotta be like:

regex=(honeyd|icmp|tcp|udp);		include = honeyd.rules;

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel

honeyd.rules (text/plain, 6.7 KB)

#####
#
# Copyright (C) 2006 Bjoern Weiland <bjoern-dot-weiland-at-web-dot-de>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING.  If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
#
#####

# Rules for honeyd version 1.5 (and probably later, NOT TESTED with later!)
# The rules should apply since honeyd version 0.7 or 0.8, for earlier versions
# of honeyd use the ruleset by Michael Boman.

#LOG:2006-08-18-12:21:12.1239 honeyd log started ------
 regex=honeyd log (started|stopped) ------; \
 classification.text=honeyd log $1; \
 id=9100; \
 revision=1; \
 analyzer(0).name=honeyd; \
 analyzer(0).manufacturer=www.honeyd.org; \
 analyzer(0).class=Honeypot; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=file; \
 assessment.impact.severity=info; \
 assessment.impact.description=Honeyd has $1 to write to its logfile; \
 last

#LOG:2006-08-18-12:21:12.1239 icmp(1) - 11.11.11.11 22.22.22.22: 8(0): 84 [SunOS 4.1 ]
 regex=icmp\(1\) - ([\d\.]+) ([\d\.]+): (\d+)\((\d+)\): (\d*)(.*); \
 classification.text=ICMP connection to honeypot; \
 id=9101; \
 revision=1; \
 analyzer(0).name=honeyd; \
 analyzer(0).manufacturer=www.honeyd.org; \
 analyzer(0).class=Honeypot; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$1; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$2; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=recon; \
 assessment.impact.severity=low; \
 assessment.impact.description=Your honeypot *probably* replied to an echo request (PING), see additional data for details; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Incoming ICMP packet type; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Outgoing ICMP packet type; \
 additional_data(1).data=$4; \
 additional_data(2).type=string; \
 additional_data(2).meaning=ICMP packet size; \
 additional_data(2).data=$5; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Attacked system; \
 additional_data(2).data=$6; \
 last

#LOG:2006-08-18-12:21:12.1239 tcp(6) - 11.11.11.11 53952 22.22.22.22 10078: 44 S [Linux 2.6 ]
 regex=tcp\(6\) - ([\d\.]+) (\d+) ([\d\.]+) (\d+): (\d+) (\S*)(.*); \
 classification.text=TCP connection to closed port on honeypot; \
 id=9102; \
 revision=1; \
 analyzer(0).name=honeyd; \
 analyzer(0).manufacturer=www.honeyd.org; \
 analyzer(0).class=Honeypot; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$1; \
 source(0).service.port=$2; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$3; \
 target(0).service.port=$4; \
 assessment.impact.completion=failed; \
 assessment.impact.type=recon; \
 assessment.impact.severity=medium; \
 assessment.impact.description=Someone tried to connect to a closed port on your honeypot; \
 additional_data(0).type=string; \
 additional_data(0).meaning=TCP packet size; \
 additional_data(0).data=$5; \
 additional_data(1).type=string; \
 additional_data(1).meaning=TCP flags; \
 additional_data(1).data=$6; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Attacked system; \
 additional_data(2).data=$7; \
 last

#LOG:2006-08-18-12:21:12.1239 udp(17) - 11.11.11.11 36722 22.22.22.22 545: 28 [Linux 2.6 ]
 regex=udp\(17\) - ([\d\.]+) (\d+) ([\d\.]+) (\d+): (\d+) (.*); \
 classification.text=UDP connection to closed port on honeypot; \
 id=9103; \
 revision=1; \
 analyzer(0).name=honeyd; \
 analyzer(0).manufacturer=www.honeyd.org; \
 analyzer(0).class=Honeypot; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$1; \
 source(0).service.port=$2; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$3; \
 target(0).service.port=$4; \
 assessment.impact.completion=failed; \
 assessment.impact.type=recon; \
 assessment.impact.severity=medium; \
 assessment.impact.description=Someone tried to connect to a closed port on your honeypot; \
 additional_data(0).type=string; \
 additional_data(0).meaning=TCP packet size; \
 additional_data(0).data=$5; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Attacked system; \
 additional_data(1).data=$6; \
 last

#LOG:2006-08-18-12:21:12.1239 udp(17) E 11.11.11.11 43569 22.22.22.22 135: 280 0
 regex=(udp|tcp)\(\d+\) E ([\d\.]+) (\d+) ([\d\.]+) (\d+): (\d+) (\d+); \
 classification.text=End of $1 connection to a port on honeypot; \
 id=9104; \
 revision=1; \
 analyzer(0).name=honeyd; \
 analyzer(0).manufacturer=www.honeyd.org; \
 analyzer(0).class=Honeypot; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.port=$3; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.port=$5; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=recon; \
 assessment.impact.severity=medium; \
 assessment.impact.description=$1 connection to your honeypot has been closed; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Amount of data received; \
 additional_data(0).data=$6; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Amount of data sent; \
 additional_data(1).data=$7; \
 last

#LOG:2006-08-18-12:21:12.1239 tcp(6) S 11.11.11.11 48877 22.22.22.22 2778 [Linux 2.6 ]
 regex=(udp|tcp)\(\d+\) S ([\d\.]+) (\d+) ([\d\.]+) (\d+)(.*); \
 classification.text=Start of $1 connection to a port on honeypot; \
 id=9105; \
 revision=1; \
 analyzer(0).name=honeyd; \
 analyzer(0).manufacturer=www.honeyd.org; \
 analyzer(0).class=Honeypot; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.port=$3; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.port=$5; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=recon; \
 assessment.impact.severity=medium; \
 assessment.impact.description=$1 connection to your honeypot has been opened; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Attacked system; \
 additional_data(0).data=$6; \
 last