Re: prelude-lml SNARE ruleset

here is the ruleset, attached.....

On Mon, Nov 23, 2009 at 2:00 PM, Nicholas Nachefski
<[email protected]> wrote:
> Here is the revised SNARE ruleset for Windows <= 2003.  The SNARE
> agent setting "Syslog Headers" is no longer an issue as i was able to
> modify the regex to fit both cases.  These rules only capture and
> IDMEF'ify a handful of the many windows events that are available,
> however, i feel these are the most important from a security
> perspective.  I have some additional events to add to the 2003 set,
> but i need to test them first.
>
> Also, I'm currently working on a set of rules for Windows >= 2008,
> I'll post those as well when I'm done testing.
>
> -Nick Nachefski
>
> # cat snare_Win2003.rules
> ###############################Windows 2003 Style
> Events#######################################
> ########## Event ID 528
> ##Type 10 = Successful Remote Interactive Logon (Terminal Services,
> Remote Desktop or Remote Assistance)
> ##Type 2  = Successful Local Interactive Logon
> #LOG: Nov 23 12:36:59 10.1.1.1 testbox01    MSWinEventLog   1
> Security        460     Mon Nov 23 12:36:38 2009        528
> Security        test.user       User    Success Audit   testbox01
>  Logon/Logoff            Successful Logon:     User Name: test.user
>  Domain: DOMAIN     Logon ID: (0x0,0xEBEF666E)     Logon Type: 10
> Logon Process: User32       Authentication Package: Negotiate
> Workstation Name: testbox01     Logon GUID:
> {009a469d-5738-ebf8-f94e-02e649bf5c61}     Caller User Name:
> testbox01$     Caller Domain: DOMAIN     Caller Logon ID: (0x0,0x3E7)
>   Caller Process ID: 5116     Transited Services: -     Source
> Network Address: 10.1.1.2     Source Port: 43923          441
> # $1 = 10.1.1.1
> # $2 = testbox01
> # $3 = Nov 23
> # $4 = 12:36:38
> # $5 = 2009
> # $6 = 528
> # $7 = Success Audit
> # $8 = Logon
> # $9 = test.user
> # $10 = DOMAIN
> # $11 = 10
> # $12 = User32
> # $13 = 5116
> # $14 = 10.1.1.2
>
> regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d
> (?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})*?)\s*(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3}
> \d{1,2}) (\d\d:\d\d:\d\d) (\d{4})\s+(528)\s+Security\s+(?:ANONYMOUS
> LOGON|\S+\$|\S+)?\s+\w+\s+(Success
> Audit)\s+\S+\s+Logon\/Logoff\s+Successful (Logon):\s+User Name:
> (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon ID:
> \S+\s+Logon Type: (2|10)\s+Logon Process: (\S+)\s+Authentication
> Package: Negotiate\s+Workstation Name: \S+\s+Logon GUID: \S+\s+Caller
> User Name: \S+\s+Caller Domain: \S+\s+Caller Logon ID: \S+\s+Caller
> Process ID: (\d*)\s+Transited Services: -\s+Source Network Address:
> (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source Port: \d*\s+\d*; \
>  classification.text=$8; \
>  id=99998; \
>  revision=1; \
>  analyzer(0).name=Snare; \
>  analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows;
> \
>  analyzer(0).class=Snare; \
>  assessment.impact.severity=info; \
>  assessment.impact.completion=succeeded; \
>  assessment.impact.description=$10\$9 has successfully authenticated to $2; \
>  assessment.impact.type=user; \
>  source(0).node.address(0).category=ipv4-addr; \
>  source(0).node.address(0).address=$14; \
>  source(0).user.category=os-device; \
>  target(0).node.name=$2; \
>  target(0).user.user_id(0).type=target-user; \
>  target(0).user.user_id(0).name=$9; \
>  target(0).process.name=$12; \
>  target(0).process.pid=$13; \
>  additional_data(0).type=integer; \
>  additional_data(0).meaning=Event ID; \
>  additional_data(0).data=$6; \
>  additional_data(1).type=integer; \
>  additional_data(1).meaning=Logon Type; \
>  additional_data(1).data=$11; \
>  additional_data(2).type=string; \
>  additional_data(2).meaning=Logon ID; \
>  additional_data(2).data=$9; \
>  additional_data(3).type=string; \
>  additional_data(3).meaning=Domain; \
>  additional_data(3).data=$10; \
>  last;
>
> ########## Event ID 529
> ##Type 9 & 10 - An INTERACTIVE logon attempt was made with an unknown
> user name or a known user name with a bad password.
> ##Type 3 & 4 - A network logon attempt was made with an unknown user
> name or a known user name with a bad password.
> #LOG: Oct 20 13:11:41 10.1.1.2
> wintestbox01    MSWinEventLog   1       Security        1627    Tue Oct 20 13:11:37
> 2009    529     Security        SYSTEM  User    Failure
> Audit   WINTESTBOX01    Logon/Logoff            Logon Failure:     Reason: Unknown
> user name or bad password     User Name: test.user     Domain: DOMAIN
>   Logon Type: 10     Logon Process: User32       Authentication
> Package: Negotiate     Workstation Name: WINTESTBOX01     Caller User
> Name: WINTESTBOX01$     Caller Domain: DOMAIN     Caller Logon ID:
> (0x0,0x3E7)     Caller Process ID: 72384     Transited Services: -
> Source Network Address: 10.1.1.3     Source Port: 60236         554
> # $1 = 10.1.1.2
> # $2 = wintestbox01
> # $3 = Oct 20
> # $4 = 13:11:37
> # $5 = 2009
> # $6 = 529
> # $7 = Failure Audit
> # $8 = Logon
> # $9 = Unknown user name or bad password
> # $10 = test.user
> # $11 = DOMAIN
> # $12 = 10
> # $13 = User32
> # $14 = 72384
> # $15 = 10.1.1.3
>
> regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d
> (?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})*?)\s*(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3}
> \d{1,2}) (\d\d:\d\d:\d\d) (\d{4})\s+(529)\s+Security\s+(?:ANONYMOUS
> LOGON|\S+\$|\S+)?\s+\w+\s+(Failure
> Audit)\s+\S+\s+Logon\/Logoff\s+(Logon) Failure:\s+Reason: (.+)\s+User
> Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon
> Type: (9|10)\s+Logon Process: (\S+)\s+Authentication Package:
> Negotiate\s+Workstation Name: \S+\s+Caller User Name: \S+\s+Caller
> Domain: \S+\s+Caller Logon ID: \S+\s+Caller Process ID:
> (\d*)\s+Transited Services: -\s+Source Network Address:
> (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source Port: \d*\s+\d*; \
>  classification.text=$8; \
>  id=99997; \
>  revision=1; \
>  analyzer(0).name=Snare; \
>  analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows;
> \
>  analyzer(0).class=Snare; \
>  assessment.impact.severity=medium; \
>  assessment.impact.completion=failed; \
>  assessment.impact.description=$9; \
>  assessment.impact.type=user; \
>  source(0).node.address(0).category=ipv4-addr; \
>  source(0).node.address(0).address=$15; \
>  source(0).user.category=os-device; \
>  target(0).node.name=$2; \
>  target(0).user.user_id(0).type=target-user; \
>  target(0).user.user_id(0).name=$10; \
>  target(0).process.name=$13; \
>  target(0).process.pid=$14; \
>  additional_data(0).type=integer; \
>  additional_data(0).meaning=Event ID; \
>  additional_data(0).data=$6; \
>  additional_data(1).type=integer; \
>  additional_data(1).meaning=Logon Type; \
>  additional_data(1).data=$12; \
>  additional_data(2).type=string; \
>  additional_data(2).meaning=Logon ID; \
>  additional_data(2).data=$10; \
>  additional_data(3).type=string; \
>  additional_data(3).meaning=Domain; \
>  additional_data(3).data=$11; \
>  last;
>
> ########### Event ID 531
> ##A logon attempt was made using a disabled account.
> #LOG: Nov 23 13:14:22 10.1.1.1 testbox01    MSWinEventLog   1
> Security        611     Mon Nov 23 13:14:19 2009        531
> Security        SYSTEM  User    Failure Audit   testbox01
> Logon/Logoff            Logon Failure:     Reason: Account currently
> disabled     User Name: test.user     Domain: DOMAIN     Logon Type:
> 10     Logon Process: User32       Authentication Package: Negotiate
>  Workstation Name: testbox01     Caller User Name: testbox01$
> Caller Domain: DOMAIN     Caller Logon ID: (0x0,0x3E7)     Caller
> Process ID: 5484     Transited Services: -     Source Network Address:
> 10.1.1.2     Source Port: 37487            585
> # $1 = 10.1.1.1
> # $2 = testbox01
> # $3 = Nov 23
> # $4 = 13:14:19
> # $5 = 2009
> # $6 = 531
> # $7 = Failure Audit
> # $8 = Logon
> # $9 = Account currently disabled
> # $10 = test.user
> # $11 = DOMAIN
> # $12 = 10
> # $13 = User32
> # $14 = 5484
> # $15 = 10.1.1.2
>
> regex=^\w{3} \d{1,2} \d\d:\d\d:\d\d
> (?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})*?)\s*(\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d*\s+\w{3}\s(\w{3}
> \d{1,2}) (\d\d:\d\d:\d\d)
> (\d{4})\s+(531)\s+Security\s+\w+\s+\w+\s+(Failure
> Audit)\s+\S+\s+Logon\/Logoff\s+(Logon) Failure:\s+Reason: (.+)\s+User
> Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon
> Type: (\d{1,3})\s+Logon Process: (\S+)\s+Authentication Package:
> Negotiate\s+Workstation Name: \S+\s+Caller User Name: \S+\s+Caller
> Domain: \S+\s+Caller Logon ID: \S+\s+Caller Process ID:
> (\d*)\s+Transited Services: -\s+Source Network Address:
> (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+Source Port: \d*\s+\d*; \
>  classification.text=$8; \
>  id=99995; \
>  revision=1; \
>  analyzer(0).name=Snare; \
>  analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows;
> \
>  analyzer(0).class=Snare; \
>  assessment.impact.severity=high; \
>  assessment.impact.completion=failed; \
>  assessment.impact.description=$9; \
>  assessment.impact.type=user; \
>  source(0).node.address(0).category=ipv4-addr; \
>  source(0).node.address(0).address=$15; \
>  source(0).user.category=os-device; \
>  target(0).node.name=$2; \
>  target(0).user.user_id(0).type=target-user; \
>  target(0).user.user_id(0).name=$10; \
>  target(0).process.name=$13; \
>  target(0).process.pid=$14; \
>  additional_data(0).type=integer; \
>  additional_data(0).meaning=Event ID; \
>  additional_data(0).data=$6; \
>  additional_data(1).type=integer; \
>  additional_data(1).meaning=Logon Type; \
>  additional_data(1).data=$12; \
>  additional_data(2).type=string; \
>  additional_data(2).meaning=Logon ID; \
>  additional_data(2).data=$10; \
>  additional_data(3).type=string; \
>  additional_data(3).meaning=Domain; \
>  additional_data(3).data=$11; \
>  last;
>
>
>
> On Mon, Nov 23, 2009 at 8:46 AM, Yoann Vandoorselaere
> <[email protected]> wrote:
>> Hi Nicholas,
>>
>> Le jeudi 19 novembre 2009 à 10:37 -0600, Nicholas Nachefski a écrit :
>>> Hello,
>>>
>>> I've created and tested a set of prelude-lml rules for use with SNARE on
>>> Windows.  This series of pcre regex captures important security event logs
>>> and translates them into IDMEF for use with prelude-manager/prewikka.
>>>
>>> Make sure you disable the 'SYSLOG HEADERS' option in Snare or else the regex
>>> wont match, or leave headers enabled and adjust the regex.  The headers just
>>> provide redundant information anyway on Windows.
>>>
>>> Let me know if you have any comments or questions.  These have been tested
>>> thoroughly, but any recommendations or feedback would be greatly
>>> appreciated.
>>
>> Thank you very much for this contribution !
>>
>> Could you please append, at the top of each rule, an example log that
>> can be used to trigger the rule ?
>>
>> This is used for regression testing, and should have this format:
>> #LOG:<exemple log entry>
>>
>> It will also help when reviewing contributed rules, to check whether
>> each fields is assigned to the correct IDMEF element.
>>
>> Also, referring to the 'SYSLOG HEADERS' option, could you provides two
>> logs for each rules, with and without the option enabled. This will
>> allow us to check whether there is an easy way to make both kind of
>> output supported, without duplicating the rules.
>>
>> Thanks again,
>>
>> --
>> Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
>> Tel: +33 (0)8 70 70 21 58                       Fax: +33(0)4 78 42 21 58
>> http://www.prelude-ids.com
>>
>>
>>
>

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user