Re: prelude-lml SNARE ruleset
Nicholas Nachefski <[email protected]> Mon, 23 Nov 2009 14:00:47 -0600
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Here is the revised SNARE ruleset for Windows <= 2003. The SNARE
agent setting "Syslog Headers" is no longer an issue as i was able to
modify the regex to fit both cases. These rules only capture and
IDMEF'ify a handful of the many windows events that are available,
however, i feel these are the most important from a security
perspective. I have some additional events to add to the 2003 set,
but i need to test them first.
Also, I'm currently working on a set of rules for Windows >= 2008,
I'll post those as well when I'm done testing.
-Nick Nachefski
# cat snare_Win2003.rules
###############################Windows 2003 Style
Events#######################################
########## Event ID 528
##Type 10 = Successful Remote Interactive Logon (Terminal Services,
Remote Desktop or Remote Assistance)
##Type 2 = Successful Local Interactive Logon
#LOG: Nov 23 12:36:59 10.1.1.1 testbox01 MSWinEventLog 1
Security 460 Mon Nov 23 12:36:38 2009 528
Security test.user User Success Audit testbox01
Logon/Logoff Successful Logon: User Name: test.user
Domain: DOMAIN Logon ID: (0x0,0xEBEF666E) Logon Type: 10
Logon Process: User32 Authentication Package: Negotiate
Workstation Name: testbox01 Logon GUID:
{009a469d-5738-ebf8-f94e-02e649bf5c61} Caller User Name:
testbox01$ Caller Domain: DOMAIN Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 5116 Transited Services: - Source
Network Address: 10.1.1.2 Source Port: 43923 441
# $1 = 10.1.1.1
# $2 = testbox01
# $3 = Nov 23
# $4 = 12:36:38
# $5 = 2009
# $6 = 528
# $7 = Success Audit
# $8 = Logon
# $9 = test.user
# $10 = DOMAIN
# $11 = 10
# $12 = User32
# $13 = 5116
# $14 = 10.1.1.2
regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d
(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})*?)\s*(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3}
\d{1,2}) (\d\d:\d\d:\d\d) (\d{4})\s+(528)\s+Security\s+(?:ANONYMOUS
LOGON|\S+\$|\S+)?\s+\w+\s+(Success
Audit)\s+\S+\s+Logon\/Logoff\s+Successful (Logon):\s+User Name:
(ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon ID:
\S+\s+Logon Type: (2|10)\s+Logon Process: (\S+)\s+Authentication
Package: Negotiate\s+Workstation Name: \S+\s+Logon GUID: \S+\s+Caller
User Name: \S+\s+Caller Domain: \S+\s+Caller Logon ID: \S+\s+Caller
Process ID: (\d*)\s+Transited Services: -\s+Source Network Address:
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source Port: \d*\s+\d*; \
classification.text=$8; \
id=99998; \
revision=1; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows;
\
analyzer(0).class=Snare; \
assessment.impact.severity=info; \
assessment.impact.completion=succeeded; \
assessment.impact.description=$10\$9 has successfully authenticated to $2; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$14; \
source(0).user.category=os-device; \
target(0).node.name=$2; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$9; \
target(0).process.name=$12; \
target(0).process.pid=$13; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$6; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$11; \
additional_data(2).type=string; \
additional_data(2).meaning=Logon ID; \
additional_data(2).data=$9; \
additional_data(3).type=string; \
additional_data(3).meaning=Domain; \
additional_data(3).data=$10; \
last;
########## Event ID 529
##Type 9 & 10 - An INTERACTIVE logon attempt was made with an unknown
user name or a known user name with a bad password.
##Type 3 & 4 - A network logon attempt was made with an unknown user
name or a known user name with a bad password.
#LOG: Oct 20 13:11:41 10.1.1.2
wintestbox01 MSWinEventLog 1 Security 1627 Tue Oct 20 13:11:37
2009 529 Security SYSTEM User Failure
Audit WINTESTBOX01 Logon/Logoff Logon Failure: Reason: Unknown
user name or bad password User Name: test.user Domain: DOMAIN
Logon Type: 10 Logon Process: User32 Authentication
Package: Negotiate Workstation Name: WINTESTBOX01 Caller User
Name: WINTESTBOX01$ Caller Domain: DOMAIN Caller Logon ID:
(0x0,0x3E7) Caller Process ID: 72384 Transited Services: -
Source Network Address: 10.1.1.3 Source Port: 60236 554
# $1 = 10.1.1.2
# $2 = wintestbox01
# $3 = Oct 20
# $4 = 13:11:37
# $5 = 2009
# $6 = 529
# $7 = Failure Audit
# $8 = Logon
# $9 = Unknown user name or bad password
# $10 = test.user
# $11 = DOMAIN
# $12 = 10
# $13 = User32
# $14 = 72384
# $15 = 10.1.1.3
regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d
(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})*?)\s*(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3}
\d{1,2}) (\d\d:\d\d:\d\d) (\d{4})\s+(529)\s+Security\s+(?:ANONYMOUS
LOGON|\S+\$|\S+)?\s+\w+\s+(Failure
Audit)\s+\S+\s+Logon\/Logoff\s+(Logon) Failure:\s+Reason: (.+)\s+User
Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon
Type: (9|10)\s+Logon Process: (\S+)\s+Authentication Package:
Negotiate\s+Workstation Name: \S+\s+Caller User Name: \S+\s+Caller
Domain: \S+\s+Caller Logon ID: \S+\s+Caller Process ID:
(\d*)\s+Transited Services: -\s+Source Network Address:
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source Port: \d*\s+\d*; \
classification.text=$8; \
id=99997; \
revision=1; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows;
\
analyzer(0).class=Snare; \
assessment.impact.severity=medium; \
assessment.impact.completion=failed; \
assessment.impact.description=$9; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$15; \
source(0).user.category=os-device; \
target(0).node.name=$2; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$10; \
target(0).process.name=$13; \
target(0).process.pid=$14; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$6; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$12; \
additional_data(2).type=string; \
additional_data(2).meaning=Logon ID; \
additional_data(2).data=$10; \
additional_data(3).type=string; \
additional_data(3).meaning=Domain; \
additional_data(3).data=$11; \
last;
########### Event ID 531
##A logon attempt was made using a disabled account.
#LOG: Nov 23 13:14:22 10.1.1.1 testbox01 MSWinEventLog 1
Security 611 Mon Nov 23 13:14:19 2009 531
Security SYSTEM User Failure Audit testbox01
Logon/Logoff Logon Failure: Reason: Account currently
disabled User Name: test.user Domain: DOMAIN Logon Type:
10 Logon Process: User32 Authentication Package: Negotiate
Workstation Name: testbox01 Caller User Name: testbox01$
Caller Domain: DOMAIN Caller Logon ID: (0x0,0x3E7) Caller
Process ID: 5484 Transited Services: - Source Network Address:
10.1.1.2 Source Port: 37487 585
# $1 = 10.1.1.1
# $2 = testbox01
# $3 = Nov 23
# $4 = 13:14:19
# $5 = 2009
# $6 = 531
# $7 = Failure Audit
# $8 = Logon
# $9 = Account currently disabled
# $10 = test.user
# $11 = DOMAIN
# $12 = 10
# $13 = User32
# $14 = 5484
# $15 = 10.1.1.2
regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d
(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})*?)\s*(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3}
\d{1,2}) (\d\d:\d\d:\d\d)
(\d{4})\s+(531)\s+Security\s+\w+\s+\w+\s+(Failure
Audit)\s+\S+\s+Logon\/Logoff\s+(Logon) Failure:\s+Reason: (.+)\s+User
Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon
Type: (\d{1,3})\s+Logon Process: (\S+)\s+Authentication Package:
Negotiate\s+Workstation Name: \S+\s+Caller User Name: \S+\s+Caller
Domain: \S+\s+Caller Logon ID: \S+\s+Caller Process ID:
(\d*)\s+Transited Services: -\s+Source Network Address:
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source Port: \d*\s+\d*; \
classification.text=$8; \
id=99995; \
revision=1; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows;
\
analyzer(0).class=Snare; \
assessment.impact.severity=high; \
assessment.impact.completion=failed; \
assessment.impact.description=$9; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$15; \
source(0).user.category=os-device; \
target(0).node.name=$2; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$10; \
target(0).process.name=$13; \
target(0).process.pid=$14; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$6; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$12; \
additional_data(2).type=string; \
additional_data(2).meaning=Logon ID; \
additional_data(2).data=$10; \
additional_data(3).type=string; \
additional_data(3).meaning=Domain; \
additional_data(3).data=$11; \
last;
On Mon, Nov 23, 2009 at 8:46 AM, Yoann Vandoorselaere
<[email protected]> wrote:
> Hi Nicholas,
>
> Le jeudi 19 novembre 2009 à 10:37 -0600, Nicholas Nachefski a écrit :
>> Hello,
>>
>> I've created and tested a set of prelude-lml rules for use with SNARE on
>> Windows. This series of pcre regex captures important security event logs
>> and translates them into IDMEF for use with prelude-manager/prewikka.
>>
>> Make sure you disable the 'SYSLOG HEADERS' option in Snare or else the regex
>> wont match, or leave headers enabled and adjust the regex. The headers just
>> provide redundant information anyway on Windows.
>>
>> Let me know if you have any comments or questions. These have been tested
>> thoroughly, but any recommendations or feedback would be greatly
>> appreciated.
>
> Thank you very much for this contribution !
>
> Could you please append, at the top of each rule, an example log that
> can be used to trigger the rule ?
>
> This is used for regression testing, and should have this format:
> #LOG:<exemple log entry>
>
> It will also help when reviewing contributed rules, to check whether
> each fields is assigned to the correct IDMEF element.
>
> Also, referring to the 'SYSLOG HEADERS' option, could you provides two
> logs for each rules, with and without the option enabled. This will
> allow us to check whether there is an easy way to make both kind of
> output supported, without duplicating the rules.
>
> Thanks again,
>
> --
> Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
> Tel: +33 (0)8 70 70 21 58 Fax: +33(0)4 78 42 21 58
> http://www.prelude-ids.com
>
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user