Re: prelude-lml SNARE ruleset

It looks like the attachment got stripped on my last post.  Here it is,
snare.rules:

$ cat snare.rules
########## Event ID 528
##Type 10 = Remote Interactive Logon (Terminal Services, Remote Desktop or
Remote Assistance)
##Type 2  = Local Interactive Logon
# $1 = 10.1.1.2
# $2 = servername
# $3 = Oct 19
# $4 = 14:57:48
# $5 = 2009
# $6 = 528
# $7 = Success Audit
# $8 = Logon
# $9 = some.user
# $10 = DOMAINNAME
# $11 = 10
# $12 = User32
# $13 = 59764
# $14 = 1.2.3.4

regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3} \d{1,2})
(\d\d:\d\d:\d\d) (\d{4})\s+(528)\s+Security\s+(?:ANONYMOUS
LOGON|\S+\$|\S+)?\s+\w+\s+(Success Audit)\s+\S+\s+Logon\/Logoff\s+Successful
(Logon):\s+User Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+
\w+)\s+Logon ID: \S+\s+Logon Type: (\d{1,3})\s+Logon Process:
(\S+)\s+Authentication Package: Negotiate\s+Workstation Name: \S+\s+Logon
GUID: \S+\s+Caller User Name: \S+\s+Caller Domain: \S+\s+Caller Logon ID:
\S+\s+Caller Process ID: (\d*)\s+Transited Services: -\s+Source Network
Address: (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source Port: \d*\s+\d*; \
 classification.text=$8; \
 id=99998; \
 revision=1; \
 analyzer(0).name=Snare; \
 analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
 analyzer(0).class=Snare; \
 assessment.impact.severity=info; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=$10\$9 has successfully authenticated to $2;
\
 assessment.impact.type=user; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$14; \
 source(0).user.category=os-device; \
 target(0).node.name=$2; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$9; \
 target(0).process.name=$12; \
 target(0).process.pid=$13; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Event ID; \
 additional_data(0).data=$6; \
 additional_data(1).type=integer; \
 additional_data(1).meaning=Logon Type; \
 additional_data(1).data=$11; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Logon ID; \
 additional_data(2).data=$9; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Domain; \
 additional_data(3).data=$10; \
 last;

########## Event ID 529
##Type 3 & 4 - A network logon attempt was made with an unknown user name or
a known user name with a bad password.
# $1 = 10.1.1.2
# $2 = servername
# $3 = Oct 20
# $4 = 13:11:37
# $5 = 2009
# $6 = 529
# $7 = Failure Audit
# $8 = Logon
# $9 = some.user
# $10 = DOMAINNAME
# $11 = 3
# $12 = User32
# $13 = 72384
# $14 = 1.1.1.2

regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3} \d{1,2})
(\d\d:\d\d:\d\d) (\d{4})\s+(529)\s+Security\s+(?:ANONYMOUS
LOGON|\S+\$|\S+)?\s+\w+\s+(Failure Audit)\s+\S+\s+Logon\/Logoff\s+(Logon)
Failure:\s+Reason: \w+ \w+ \w+ \w+ \w+ \w+\s+User Name: (ANONYMOUS
LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon Type: (4)\s+Logon Process:
(\S+)\s+Authentication Package: Negotiate\s+Workstation Name: \S+\s+Caller
User Name: \S+\s+Caller Domain: \S+\s+Caller Logon ID: \S+\s+Caller Process
ID: (\d*)\s+Transited Services: -\s+Source Network Address:
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source Port: \d*\s+\d*; \
 classification.text=$8; \
 id=99997; \
 revision=1; \
 analyzer(0).name=Snare; \
 analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
 analyzer(0).class=Snare; \
 assessment.impact.severity=low; \
 assessment.impact.completion=failed; \
 assessment.impact.description=$10\$9 has failed a network logon; \
 assessment.impact.type=user; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$14; \
 source(0).user.category=os-device; \
 target(0).node.name=$2; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$9; \
 target(0).process.name=$12; \
 target(0).process.pid=$13; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Event ID; \
 additional_data(0).data=$6; \
 additional_data(1).type=integer; \
 additional_data(1).meaning=Logon Type; \
 additional_data(1).data=$11; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Logon ID; \
 additional_data(2).data=$9; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Domain; \
 additional_data(3).data=$10; \
 last;

########## Event ID 529
##Type 10 & 9 - An INTERACTIVE logon attempt was made with an unknown user
name or a known user name with a bad password.
# $1 = 10.1.1.2
# $2 = servername
# $3 = Oct 20
# $4 = 13:11:37
# $5 = 2009
# $6 = 529
# $7 = Failure Audit
# $8 = Logon
# $9 = some.user
# $10 = DOMAINNAME
# $11 = 10
# $12 = User32
# $13 = 72384
# $14 = 4.3.2.1

regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3} \d{1,2})
(\d\d:\d\d:\d\d) (\d{4})\s+(529)\s+Security\s+(?:ANONYMOUS
LOGON|\S+\$|\S+)?\s+\w+\s+(Failure Audit)\s+\S+\s+Logon\/Logoff\s+(Logon)
Failure:\s+Reason: \w+ \w+ \w+ \w+ \w+ \w+\s+User Name: (ANONYMOUS
LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon Type: (2|9|10)\s+Logon
Process: (\S+)\s+Authentication Package: Negotiate\s+Workstation Name:
\S+\s+Caller User Name: \S+\s+Caller Domain: \S+\s+Caller Logon ID:
\S+\s+Caller Process ID: (\d*)\s+Transited Services: -\s+Source Network
Address: (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source Port: \d*\s+\d*; \
 classification.text=$8; \
 id=99996; \
 revision=1; \
 analyzer(0).name=Snare; \
 analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
 analyzer(0).class=Snare; \
 assessment.impact.severity=low; \
 assessment.impact.completion=failed; \
 assessment.impact.description=$10\$9 has failed an interactive logon to $2;
\
 assessment.impact.type=user; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$14; \
 source(0).user.category=os-device; \
 target(0).node.name=$2; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$9; \
 target(0).process.name=$12; \
 target(0).process.pid=$13; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Event ID; \
 additional_data(0).data=$6; \
 additional_data(1).type=integer; \
 additional_data(1).meaning=Logon Type; \
 additional_data(1).data=$11; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Logon ID; \
 additional_data(2).data=$9; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Domain; \
 additional_data(3).data=$10; \
 last;

########### Event ID 531
##A logon attempt was made using a disabled account.
# $1 = 10.3.1.1
# $2 = servername
# $3 = Oct 20
# $4 = 13:47:12
# $5 = 2009
# $6 = 531
# $7 = Failure Audit
# $8 = Logon
# $9 = test.user
# $10 = DOMAINNAME
# $11 = 10
# $12 = User32
# $13 = 71884
# $14 = 1.2.3.4

regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3} \d{1,2})
(\d\d:\d\d:\d\d) (\d{4})\s+(531)\s+Security\s+\w+\s+\w+\s+(Failure
Audit)\s+\S+\s+Logon\/Logoff\s+(Logon) Failure:\s+Reason: \w+ \w+ \w+\s+User
Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon Type:
(\d{1,3})\s+Logon Process: (\S+)\s+Authentication Package:
Negotiate\s+Workstation Name: \S+\s+Caller User Name: \S+\s+Caller Domain:
\S+\s+Caller Logon ID: \S+\s+Caller Process ID: (\d*)\s+Transited Services:
-\s+Source Network Address: (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source
Port: \d*\s+\d*; \
 classification.text=$8; \
 id=99995; \
 revision=1; \
 analyzer(0).name=Snare; \
 analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
 analyzer(0).class=Snare; \
 assessment.impact.severity=high; \
 assessment.impact.completion=failed; \
 assessment.impact.description=A logon attempt was made using a disabled
account $10\$9 to $2; \
 assessment.impact.type=user; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$14; \
 source(0).user.category=os-device; \
 target(0).node.name=$2; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$9; \
 target(0).process.name=$12; \
 target(0).process.pid=$13; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Event ID; \
 additional_data(0).data=$6; \
 additional_data(1).type=integer; \
 additional_data(1).meaning=Logon Type; \
 additional_data(1).data=$11; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Logon ID; \
 additional_data(2).data=$9; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Domain; \
 additional_data(3).data=$10; \
 last;
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user