Snare - Windows ruleset for Prelude-LML
Nicholas Nachefski <[email protected]> Mon, 30 Nov 2009 12:42:21 -0600
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Here is the latest beta version of the Snare/Windows ruleset for use with
Prelude-LML. I've made the corrections recommended by the community and
developers. The Win 2003 rules are pretty stable and well tested, however,
the 2008 ruleset will probably require further development.
Let me know if there are any other suggestions that you think i should
consider.
Attached....
Thanks!
Nick Nachefski
###############################Windows 2000/2003 Style
Events#######################################
########## Event ID 528
##Type 10 = Successful remote interactive logon
#LOG: Nov 23 12:36:59 10.1.1.1 testbox01 MSWinEventLog 1
Security 460 Mon Nov 23 12:36:38 2009 528
Security test.user User Success Audit TESTBOX01
Logon/Logoff Successful Logon: User Name: test.user
Domain: DOMAIN Logon ID: (0x0,0xEBEF666E) Logon Type: 10 Logon
Process: User32 Authentication Package: Negotiate Workstation
Name: testbox01 Logon GUID: {009a469d-5738-ebf8-f94e-02e649bf5c61}
Caller User Name: testbox01$ Caller Domain: DOMAIN Caller Logon ID:
(0x0,0x3E7) Caller Process ID: 5116 Transited Services: - Source
Network Address: 10.1.1.2 Source Port: 43923 441
# $1 = 528
# $2 = Success Audit
# $3 = TESTBOX01
# $4 = Successful Logon
# $5 = test.user
# $6 = DOMAIN
# $7 = 10
# $8 = User32
# $9 = Negotiate
# $10 = 5116
# $11 = 10.1.1.2
regex=(528)\s+Security\s+(?:ANONYMOUS LOGON|\S+\$|\S+)?\s+\w+\s+(Success
Audit)\s+(\S+)\s+Logon\/Logoff\s+(Successful Logon):\s+User Name: (ANONYMOUS
LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon ID: \S+\s+Logon Type:
(10)\s+Logon Process: (\S+)\s+Authentication Package: (\S*)\s+Workstation
Name: \S+\s+Logon GUID: \S+\s+Caller User Name: \S+\s+Caller Domain:
\S+\s+Caller Logon ID: \S+\s+Caller Process ID: (\S+)\s+Transited Services:
\S+\s+Source Network Address:
(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)\s+Source
Port: \d*\s+\d*; \
classification.text=Remote Login; \
id=99998; \
revision=5; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
analyzer(0).class=Snare; \
assessment.impact.severity=info; \
assessment.impact.completion=succeeded; \
assessment.impact.description=$4; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$11; \
source(0).user.category=os-device; \
target(0).node.name=$3; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$5; \
target(0).process.name=$8; \
target(0).process.pid=$10; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$1; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$7; \
additional_data(2).type=string; \
additional_data(2).meaning=Audit; \
additional_data(2).data=$2; \
additional_data(3).type=string; \
additional_data(3).meaning=Logon ID; \
additional_data(3).data=$5; \
additional_data(4).type=string; \
additional_data(4).meaning=Domain; \
additional_data(4).data=$6; \
last;
########## Event ID 528
##Type 2 = Successful local interactive logon
#LOG: Nov 30 10:11:23 10.1.1.1 testbox01.TESTDOMAIN.local
MSWinEventLog 1 Security 535 Mon Nov 30 10:11:23 2009 528
Security test.user User Success Audit testbox01 Logon/Logoff
Successful Logon: User Name: test.user Domain: TESTDOMAIN
Logon ID: (0x0,0x2553F4) Logon Type: 2 Logon Process: User32
Authentication Package: Negotiate Workstation Name: testbox01 Logon
GUID: {48bb687b-448f-629e-cd90-55f8165b7266} Caller User Name:
testbox01$ Caller Domain: TESTDOMAIN Caller Logon ID:
(0x0,0x3E7) Caller Process ID: 416 Transited Services: - Source
Network Address: 127.0.0.1 Source Port: 0 21
# $1 = 528
# $2 = Success Audit
# $3 = testbox01
# $4 = Successful Logon
# $5 = test.user
# $6 = TESTDOMAIN
# $7 = 2
# $8 = User32
# $9 = Negotiate
# $10 = 416
# $11 = 127.0.0.1
regex=(528)\s+Security\s+(?:ANONYMOUS LOGON|\S+\$|\S+)?\s+\w+\s+(Success
Audit)\s+(\S+)\s+Logon\/Logoff\s+(Successful Logon):\s+User Name: (ANONYMOUS
LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon ID: \S+\s+Logon Type:
(2)\s+Logon Process: (\S+)\s+Authentication Package: (\S*)\s+Workstation
Name: \S+\s+Logon GUID: \S+\s+Caller User Name: \S+\s+Caller Domain:
\S+\s+Caller Logon ID: \S+\s+Caller Process ID: (\S+)\s+Transited Services:
\S+\s+Source Network Address:
(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)\s+Source
Port: \d*\s+\d*; \
classification.text=Login; \
id=99990; \
revision=1; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
analyzer(0).class=Snare; \
assessment.impact.severity=info; \
assessment.impact.completion=succeeded; \
assessment.impact.description=$4; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$11; \
source(0).user.category=os-device; \
target(0).node.name=$3; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$5; \
target(0).process.name=$8; \
target(0).process.pid=$10; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$1; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$7; \
additional_data(2).type=string; \
additional_data(2).meaning=Audit; \
additional_data(2).data=$2; \
additional_data(3).type=string; \
additional_data(3).meaning=Logon ID; \
additional_data(3).data=$5; \
additional_data(4).type=string; \
additional_data(4).meaning=Domain; \
additional_data(4).data=$6; \
last;
########## Event ID 529
##Type 10 - Failed remote interactive logon
# Oct 20 13:11:41 10.1.1.2 wintestbox01 MSWinEventLog 1 Security
1627 Tue Oct 20 13:11:37 2009 529 Security SYSTEM User
Failure Audit WINTESTBOX01 Logon/Logoff Logon Failure:
Reason: Unknown user name or bad password User Name: test.user
Domain: testdomain Logon Type: 10 Logon Process: User32
Authentication Package: Negotiate Workstation Name: WINTESTBOX01
Caller User Name: WINTESTBOX01$ Caller Domain: testdomain Caller
Logon ID: (0x0,0x3E7) Caller Process ID: 72384 Transited Services:
- Source Network Address: 10.1.1.3 Source Port: 60236 554
# $1 = 529
# $2 = Failure Audit
# $3 = WINTESTBOX01
# $4 = Logon Failure
# $5 = Unknown user name or bad password
# $6 = test.user
# $7 = testdomain
# $8 = 10
# $9 = User32
# $10 = Negotiate
# $11 = 72384
# $12 = 10.1.1.3
regex=.+(529)\s+Security\s+(?:ANONYMOUS LOGON|\S+\$|\S+)?\s+\w+\s+(Failure
Audit)\s+(\S+)\s+Logon\/Logoff\s+(Logon Failure):\s+Reason: (.+)\s+User
Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon Type:
(10)\s+Logon Process: (\S+)\s+Authentication Package: (\w+)\s+Workstation
Name: \S+\s+Caller User Name: \S+\s+Caller Domain: \S+\s+Caller Logon ID:
\S+\s+Caller Process ID: (\S*)\s+Transited Services: \S+\s+Source Network
Address:
(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)\s+Source
Port: \d*\s+\d*; \
classification.text=Remote Login; \
id=99997; \
revision=4; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
analyzer(0).class=Snare; \
assessment.impact.severity=medium; \
assessment.impact.completion=failed; \
assessment.impact.description=$5; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$12; \
source(0).user.category=os-device; \
target(0).node.name=$3; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$6; \
target(0).process.name=$9; \
target(0).process.pid=$11; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$1; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$8; \
additional_data(2).type=string; \
additional_data(2).meaning=Audit; \
additional_data(2).data=$2; \
additional_data(3).type=string; \
additional_data(3).meaning=Logon ID; \
additional_data(3).data=$6; \
additional_data(4).type=string; \
additional_data(4).meaning=Domain; \
additional_data(4).data=$7; \
last;
########## Event ID 529
##Type 3 & 4 - Failed network logon
#LOG: Nov 24 14:42:26 10.1.1.2 testbox01 MSWinEventLog 1
Security 26719 Tue Nov 24 14:42:26 2009 529 Security
SYSTEM User Failure Audit TESTBOX01 Logon/Logoff Logon
Failure: Reason: Unknown user name or bad password User Name:
test.user Domain: testdomain Logon Type: 3 Logon Process:
NtLmSsp Authentication Package: NTLM Workstation Name:
TESTBOX02 Caller User Name: - Caller Domain: - Caller Logon ID:
- Caller Process ID: - Transited Services: - Source Network
Address: 10.1.1.3 Source Port: 4451 15619
# $1 = 529
# $2 = Failure Audit
# $3 = TESTBOX01
# $4 = Logon Failure
# $5 = Unknown user name or bad password
# $6 = test.user
# $7 = testdomain
# $8 = 3
# $9 = NtLmSsp
# $10 = NTLM
# $11 = -
# $12 = 10.1.1.3
regex=.+(529)\s+Security\s+(?:ANONYMOUS LOGON|\S+\$|\S+)?\s+\w+\s+(Failure
Audit)\s+(\S+)\s+Logon\/Logoff\s+(Logon Failure):\s+Reason: (.+)\s+User
Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon Type:
(3|4)\s+Logon Process: (\S+)\s+Authentication Package: (\w+)\s+Workstation
Name: \S+\s+Caller User Name: \S+\s+Caller Domain: \S+\s+Caller Logon ID:
\S+\s+Caller Process ID: (\S*)\s+Transited Services: \S+\s+Source Network
Address:
(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)\s+Source
Port: \d*\s+\d*; \
classification.text=Login; \
id=99992; \
revision=1; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
analyzer(0).class=Snare; \
assessment.impact.severity=medium; \
assessment.impact.completion=failed; \
assessment.impact.description=$5; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$12; \
source(0).user.category=os-device; \
target(0).node.name=$3; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$6; \
target(0).process.name=$9; \
target(0).process.pid=$11; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$1; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$8; \
additional_data(2).type=string; \
additional_data(2).meaning=Audit; \
additional_data(2).data=$2; \
additional_data(3).type=string; \
additional_data(3).meaning=Logon ID; \
additional_data(3).data=$6; \
additional_data(4).type=string; \
additional_data(4).meaning=Domain; \
additional_data(4).data=$7; \
last;
########### Event ID 531
##A logon attempt was made using a disabled account.
# Nov 23 13:14:22 10.1.1.1 testbox01 MSWinEventLog 1
Security 611 Mon Nov 23 13:14:19 2009 531
Security SYSTEM User Failure Audit testbox01
Logon/Logoff Logon Failure: Reason: Account currently
disabled User Name: test.user Domain: DOMAIN Logon Type: 10
Logon Process: User32 Authentication Package: Negotiate
Workstation Name: testbox01 Caller User Name: testbox01$ Caller
Domain: DOMAIN Caller Logon ID: (0x0,0x3E7) Caller Process ID:
5484 Transited Services: - Source Network Address: 10.1.1.2
Source Port: 37487 585
# $1 = 531
# $2 = Failure Audit
# $3 = testbox01
# $4 = Logon Failure
# $5 = Account currently disabled
# $6 = test.user
# $7 = DOMAIN
# $8 = 10
# $9 = User32
# $10 = Negotiate
# $11 = 5484
# $12 = 10.1.1.2
regex=(531)\s+Security\s+\w+\s+\w+\s+(Failure
Audit)\s+(\S+)\s+Logon\/Logoff\s+(Logon Failure):\s+Reason: (.+)\s+User
Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+Logon Type:
(\d{1,2})\s+Logon Process: (\S+)\s+Authentication Package:
(\S+)\s+Workstation Name: \S+\s+Caller User Name: \S+\s+Caller Domain:
\S+\s+Caller Logon ID: \S+\s+Caller Process ID: (\S*)\s+Transited Services:
\S+\s+Source Network Address:
(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)\s+Source
Port: \d*\s+\d*; \
classification.text=Login; \
id=99991; \
revision=1; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
analyzer(0).class=Snare; \
assessment.impact.severity=high; \
assessment.impact.completion=failed; \
assessment.impact.description=$5; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$12; \
source(0).user.category=os-device; \
target(0).node.name=$3; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$6; \
target(0).process.name=$9; \
target(0).process.pid=$11; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$1; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$8; \
additional_data(2).type=string; \
additional_data(2).meaning=Audit; \
additional_data(2).data=$2; \
additional_data(3).type=string; \
additional_data(3).meaning=Logon ID; \
additional_data(3).data=$6; \
additional_data(4).type=string; \
additional_data(4).meaning=Domain; \
additional_data(4).data=$7; \
last;
###############################Windows 2008 Style
Events#######################################
############ Event ID 4624
##An account has successfully logged on
#Type 10 RemoteInteractive (Terminal Services, Remote Desktop or Remote
Assistance)
#LOG: Nov 23 15:49:03 10.1.1.1 testbox01 MSWinEventLog 1
Security 13469 Mon Nov 23 15:48:59 2009 4624
Microsoft-Windows-Security-Auditing N/AN/A Information
testbox01.TESTDOMAIN.local None An account was successfully logged
on. Subject: Security ID: S-1-5-18 Account Name: testbox01$
Account Domain: TESTDOMAIN Logon ID: 0x3e7 Logon Type: 10 New
Logon: Security ID: S-1-5-21-1481646799-3140499893-3922762874-3132
Account Name: test.user Account Domain: TESTDOMAIN Logon ID:
0x3373f5a03 Logon GUID: {00000000-0000-0000-0000-000000000000} Process
Information: Process ID: 0x1a3c Process Name:
C:\Windows\System32\winlogon.exe Network Information: Workstation Name:
testbox01 Source Network Address: 10.1.1.2 Source Port: 43637
Detailed Authentication Information: Logon Process: User32
Authentication Package: Negotiate Transited Services: - Package Name
(NTLM only): - Key Length: 0 This event is generated when a logon
session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested
the logon. This is most commonly a service such as the Server service, or a
local process such as Winlogon.exe or Services.exe. The logon type field
indicates the kind of logon that occurred. The most common types are 2
(interactive) and 3 (network). The New Logon fields indicate the account
for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated.
Workstation name is not always available and may be left blank in some
cases. The authentication information fields provide detailed information
about this specific logon request. - Logon GUID is a unique identifier
that can be used to correlate this event with a KDC event. - Transited
services indicate which intermediate services have participated in this
logon request. - Package name indicates which sub-protocol was used among
the NTLM protocols. - Key length indicates the length of the generated
session key. This will be 0 if no session key was requested. 13317
# $1 = 4624
# $2 = testbox01.TESTDOMAIN.local
# $3 = An account was successfully logged on
# $4 = 10
# $5 = test.user
# $6 = TESTDOMAIN
# $7 = 0x1a3c
# $8 = winlogon.exe
# $9 = 10.1.1.2
regex=(4624)\s+Microsoft-Windows-Security-Auditing\s+(?:N\/A\s*)*?Information\s+(\S+)\s+\w+\s+(An
account was successfully logged on)\.\s+Subject:\s+\S*\s*Security
ID:\s+\S*\s*Account Name:\s+(?:ANONYMOUS LOGON*|\S*\$|\S*)?\s*Account
Domain:\s+\S*\s*Logon ID:\s+\S*\s*Logon Type:\s+(10)\s+New
Logon:\s+\S*\s*Security ID:\s+\S*\s*Account Name:\s+(\S*)\s*Account
Domain:\s+(\S*)\s*Logon ID:\s+\S*\s*Logon GUID:\s+\S*\s*Process
Information:\s+Process ID:\s+(\S*)\s*Process
Name:\s+(?:C\:\\Windows\\System32\\)?(\S*)\s*Network
Information:\s+Workstation Name:\s+\S*\s*Source Network
Address:\s+(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)\s*;
\
classification.text=Remote Login; \
id=99989; \
revision=1; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
analyzer(0).class=Snare; \
assessment.impact.severity=info; \
assessment.impact.completion=succeeded; \
assessment.impact.description=$3; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$9; \
source(0).user.category=os-device; \
target(0).node.name=$2; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$5; \
target(0).process.name=$8; \
target(0).process.pid=$7; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$1; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$4; \
additional_data(2).type=string; \
additional_data(2).meaning=Logon ID; \
additional_data(2).data=$5; \
additional_data(3).type=string; \
additional_data(3).meaning=Domain; \
additional_data(3).data=$6; \
last;
############ Event ID 4624
##Type 2 = Interactive LOCAL logon
#LOG: Nov 24 10:25:57 10.1.1.1 testbox01 MSWinEventLog 1
Security 27250 Tue Nov 24 10:25:55 2009 4624
Microsoft-Windows-Security-Auditing N/AN/AInformation
testbox01.TESTDOMAIN.local None An account was successfully logged
on. Subject: Security ID: S-1-5-18 Account Name: testbox01$
Account Domain: TESTDOMAIN Logon ID: 0x3e7 Logon Type: 2 New
Logon: Security ID: S-1-5-21-1481646799-3140499893-3922762874-3132
Account Name: test.user Account Domain: TESTDOMAIN Logon ID:
0xa3b2cc3b Logon GUID: {00000000-0000-0000-0000-000000000000} Process
Information: Process ID: 0x260 Process Name:
C:\Windows\System32\winlogon.exe Network Information: Workstation Name:
testbox01 Source Network Address: 127.0.0.1 Source Port: 0 Detailed
Authentication Information: Logon Process: User32 Authentication
Package: Negotiate Transited Services: - Package Name (NTLM only): -
Key Length: 0 This event is generated when a logon session is created.
It is generated on the computer that was accessed. The subject fields
indicate the account on the local system which requested the logon. This is
most commonly a service such as the Server service, or a local process such
as Winlogon.exe or Services.exe. The logon type field indicates the kind
of logon that occurred. The most common types are 2 (interactive) and 3
(network). The New Logon fields indicate the account for whom the new
logon was created, i.e. the account that was logged on. The network
fields indicate where a remote logon request originated. Workstation name is
not always available and may be left blank in some cases. The
authentication information fields provide detailed information about this
specific logon request. - Logon GUID is a unique identifier that can be
used to correlate this event with a KDC event. - Transited services
indicate which intermediate services have participated in this logon
request. - Package name indicates which sub-protocol was used among the
NTLM protocols. - Key length indicates the length of the generated session
key. This will be 0 if no session key was requested. 25044
# $1 = 4624
# $2 = testbox01.TESTDOMAIN.local
# $3 = An account was successfully logged on
# $4 = 2
# $5 = test.user
# $6 = TESTDOMAIN
# $7 = 0x260
# $8 = winlogon.exe
# $9 = 127.0.0.1
regex=(4624)\s+Microsoft-Windows-Security-Auditing\s+(?:N\/A\s*)*?Information\s+(\S+)\s+\w+\s+(An
account was successfully logged on)\.\s+Subject:\s+\S*\s*Security
ID:\s+\S*\s*Account Name:\s+(?:ANONYMOUS LOGON*|\S*\$|\S*)?\s*Account
Domain:\s+\S*\s*Logon ID:\s+\S*\s*Logon Type:\s+(2)\s+New
Logon:\s+\S*\s*Security ID:\s+\S*\s*Account Name:\s+(\S*)\s*Account
Domain:\s+(\S*)\s*Logon ID:\s+\S*\s*Logon GUID:\s+\S*\s*Process
Information:\s+Process ID:\s+(\S*)\s*Process
Name:\s+(?:C\:\\Windows\\System32\\)?(\S*)\s*Network
Information:\s+Workstation Name:\s+\S*\s*Source Network
Address:\s+(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)\s*;
\
classification.text=Login; \
id=99988; \
revision=1; \
analyzer(0).name=Snare; \
analyzer(0).manufacturer=
http://www.intersectalliance.com/projects/SnareWindows; \
analyzer(0).class=Snare; \
assessment.impact.severity=info; \
assessment.impact.completion=succeeded; \
assessment.impact.description=$3; \
assessment.impact.type=user; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$9; \
source(0).user.category=os-device; \
target(0).node.name=$2; \
target(0).user.user_id(0).type=target-user; \
target(0).user.user_id(0).name=$5; \
target(0).process.name=$8; \
target(0).process.pid=$7; \
additional_data(0).type=integer; \
additional_data(0).meaning=Event ID; \
additional_data(0).data=$1; \
additional_data(1).type=integer; \
additional_data(1).meaning=Logon Type; \
additional_data(1).data=$4; \
additional_data(2).type=string; \
additional_data(2).meaning=Logon ID; \
additional_data(2).data=$5; \
additional_data(3).type=string; \
additional_data(3).meaning=Domain; \
additional_data(3).data=$6; \
last;
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user
snare_windows.rules
(application/octet-stream, 21.5 KB) - not displayed