Re: New rules for su root attempts

On Thursday 24 July 2008 11:32:32 G Ramon Gomez wrote:
> What you seem to be asking for is more specific information in
> classification.text.  That's a reasonable request, considering that
> classification.text is what folks see first in the front-end.  HOWEVER... A
> few years ago classification.text was abstracted for a reason.  You can see
> it in pcre.rules (from LML) in this comment:
>
> # - If a similar rule exists in another ruleset (same function, different
> #   software), use the classification().text from the other rule.
>
> So...why?
> Well, it's due to the correlation engine.  We needed a single field
> (doesn't matter which field) that has event description data that is
> specific enough to have a meaning, while being abstract enough to match
> events that are similar from other devices.  We considered an
> additional_data field, but the problem was that some devices (in particular
> Snort) don't provide this data natively, and for the best compatibility, we
> should use a standard IDMEF field. Classification.text became that field
> because it's an "overview" field anyway, and there are other fields that
> can provide additional data and description to the extended event view.
> Having the field abstracted in this way allows the correlation engine to
> take data from multiple devices and understand that it could be related.
>  It allows us to find things like a "low and slow" scan against multiple
> devices even though in one case a wireless device is having a bunch of
> association attempts, while arpwatch is complaining about MAC flip-flops.
> Does this help?

What I'd really like to see is some hierarchial notation that can be specific 
and abstract depending on what you need. But I really don't feel that all 
kinds of events have been described, classified, and organized in a way that 
can be used. From a NIDS perspective, the evnts are abstract...someone is 
logging in or trying a know exploit against a service. From a HIDS point of 
view, you have very specific information...pam goes through 4 phases on login 
and I can see all 4 of them Failure in one may signal a different kind of 
issue. 

Authentication, authorization, session open failures all have different 
meaning. Authorization could be brute forcing, Authentication could be 
someone that stole the password and are now trying to get in from a remote 
location. Session open is usually a resource problem not of the user's 
making. I'd like to describe both broadly and specifically what an event 
means so that it can be used in more ways.

-Steve
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel