/etc/prelude-lml/ruleset/snare

#####
#
# Copyright Nicholas Nachefski (nicholas <underscore> nachefski <at> hotmail <dot> com
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING.  If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
#
#####

regex=(\d+)\s+Security\s+(?:ANONYMOUS LOGON|\S+\$|\S+)?\s+\w+\s+(Success Audit|Failure Audit)\s+(\S+)\s+Logon\/Logoff\s+(Successful Logon|Logon Failure):\s+(Reason:\s+(.+)\s+)?User Name: (ANONYMOUS LOGON|\S+\$|\S+)\s+Domain: (\w+|\w+ \w+)\s+(Logon ID: (\S+)\s+)?Logon Type: (10|2|3|4)\s+Logon Process: (\S+)\s+Authentication Package: (\S*)\s+Workstation Name: \S+\s+(Logon GUID: (\S+)\s+)?Caller User Name: \S+\s+Caller Domain: \S+\s+Caller Logon ID: \S+\s+Caller Process ID: (\d*)-?\s+Transited Services: \S+\s+Source Network Address: (\S+)\s+Source Port: \d*\s+\d*; \
 id=99991; \
 chained; silent; \
 analyzer(0).name=Snare; \
 analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows; \
 analyzer(0).class=Snare; \
 assessment.impact.description=$4; \
 assessment.impact.description=$6; \
 source(0).node.address(0).address=$17; \
 source(0).user.category=os-device; \
 target(0).node.name=$3; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$7; \
 target(0).process.name=$12; \
 target(0).process.pid=$16; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Event ID; \
 additional_data(0).data=$1; \
 additional_data(1).type=integer; \
 additional_data(1).meaning=Logon Type; \
 additional_data(1).data=$11; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Audit; \
 additional_data(2).data=$2; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Domain; \
 additional_data(3).data=$8;



###############################Windows 2000/2003 Style Events#######################################
########## Event ID 528
##Type 10 = Successful remote interactive logon
#LOG: Nov 23 12:36:59 10.1.1.1 testbox01    MSWinEventLog   1       Security        460     Mon Nov 23 12:36:38 2009        528     Security        test.user       User    Success Audit   TESTBOX01       Logon/Logoff            Successful Logon:     User Name: test.user     Domain: DOMAIN     Logon ID: (0x0,0xEBEF666E)     Logon Type: 10     Logon Process: User32       Authentication Package: Negotiate     Workstation Name: testbox01     Logon GUID: {009a469d-5738-ebf8-f94e-02e649bf5c61}     Caller User Name: testbox01$     Caller Domain: DOMAIN     Caller Logon ID: (0x0,0x3E7)     Caller Process ID: 5116     Transited Services: -     Source Network Address: 10.1.1.2     Source Port: 43923          441
regex=528\s+Security\s+.+Logon Type: 10; \
 id=99992; goto=99991; \
 revision=5; \
 classification.text=Remote Login; \
 assessment.impact.severity=info; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 last;

########## Event ID 528
##Type 2  = Successful local interactive logon
#LOG: Nov 30 10:11:23 10.1.1.1 testbox01.TESTDOMAIN.local       MSWinEventLog   1       Security        535     Mon Nov 30 10:11:23 2009        528     Security        test.user       User Success Audit      testbox01       Logon/Logoff            Successful Logon:     User Name: test.user     Domain: TESTDOMAIN     Logon ID: (0x0,0x2553F4)     Logon Type: 2     Logon Process: User32       Authentication Package: Negotiate     Workstation Name: testbox01     Logon GUID: {48bb687b-448f-629e-cd90-55f8165b7266}     Caller User Name: testbox01$     Caller Domain: TESTDOMAIN     Caller Logon ID: (0x0,0x3E7)     Caller Process ID: 416     Transited Services: -     Source Network Address: 127.0.0.1     Source Port: 0    21
regex=528\s+Security\s+.+Logon Type: 2; \
 id=99993; goto=99991; \
 revision=1; \
 classification.text=Login; \
 assessment.impact.severity=info; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 last;

########## Event ID 529
##Type 10 - Failed remote interactive logon
#LOG: Oct 20 13:11:41 10.1.1.2 wintestbox01 MSWinEventLog   1       Security        1627    Tue Oct 20 13:11:37 2009        529     Security        SYSTEM  User    Failure Audit   WINTESTBOX01    Logon/Logoff            Logon Failure:     Reason: Unknown user name or bad password     User Name: test.user     Domain: testdomain     Logon Type: 10     Logon Process: User32       Authentication Package: Negotiate     Workstation Name: WINTESTBOX01     Caller User Name: WINTESTBOX01$     Caller Domain: testdomain     Caller Logon ID: (0x0,0x3E7)     Caller Process ID: 72384     Transited Services: -     Source Network Address: 10.1.1.3     Source Port: 60236      554
regex=529\s+Security\s+.+Logon Type: 10; \
 id=99994; goto=99991; \
 revision=4; \
 classification.text=Remote Login; \
 assessment.impact.severity=medium; \
 assessment.impact.completion=failed; \
 assessment.impact.type=user; \
 last;

########## Event ID 529
##Type 3 & 4 - Failed network logon
#LOG: Nov 24 14:42:26 10.1.1.2 testbox01        MSWinEventLog   1       Security        26719   Tue Nov 24 14:42:26 2009        529     Security        SYSTEM  User    Failure Audit   TESTBOX01       Logon/Logoff            Logon Failure:     Reason: Unknown user name or bad password     User Name: test.user     Domain: testdomain     Logon Type: 3     Logon Process: NtLmSsp      Authentication Package: NTLM     Workstation Name: TESTBOX02     Caller User Name: -     Caller Domain: -     Caller Logon ID: -     Caller Process ID: -     Transited Services: -     Source Network Address: 10.1.1.3     Source Port: 4451           15619
regex=529\s+Security\s+.+Logon Type: (3|4); \
 id=99995; goto=99991; \
 revision=1; \
 classification.text=Login; \
 assessment.impact.severity=medium; \
 assessment.impact.completion=failed; \
 assessment.impact.type=user; \
 last;

########### Event ID 531
##A logon attempt was made using a disabled account.
#LOG: Nov 23 13:14:22 10.1.1.1 testbox01    MSWinEventLog   1       Security        611     Mon Nov 23 13:14:19 2009        531     Security        SYSTEM  User    Failure Audit   testbox01       Logon/Logoff            Logon Failure:     Reason: Account currently disabled     User Name: test.user     Domain: DOMAIN     Logon Type: 10     Logon Process: User32       Authentication Package: Negotiate     Workstation Name: testbox01     Caller User Name: testbox01$     Caller Domain: DOMAIN     Caller Logon ID: (0x0,0x3E7)     Caller Process ID: 5484     Transited Services: -     Source Network Address: 10.1.1.2     Source Port: 37487            585
regex=531\s+Security\s+.+Logon Type: (\d{1,2}); \
 id=99996; goto=99991; \
 revision=1; \
 classification.text=Login; \
 assessment.impact.severity=high; \
 assessment.impact.completion=failed; \
 assessment.impact.type=user; \
 last;


###############################Windows 2008 Style Events#######################################

regex=(4624)\s+Microsoft-Windows-Security-Auditing\s+(?:N\/A\s*)*?Information\s+(\S+)\s+\w+\s+(An account was successfully logged on)\.\s+Subject:\s+\S*\s*Security ID:\s+\S*\s*Account Name:\s+(?:ANONYMOUS LOGON*|\S*\$|\S*)?\s*Account Domain:\s+\S*\s*Logon ID:\s+\S*\s*Logon Type:\s+(\d+)\s+New Logon:\s+\S*\s*Security ID:\s+\S*\s*Account Name:\s+(\S*)\s*Account Domain:\s+(\S*)\s*Logon ID:\s+\S*\s*Logon GUID:\s+\S*\s*Process Information:\s+Process ID:\s+(\S*)\s*Process Name:\s+(?:C\:\\Windows\\System32\\)?(\S*)\s*Network Information:\s+Workstation Name:\s+\S*\s*Source Network Address:\s+(\S+)\s*; \
 id=99996; \
 revision=1; \
 analyzer(0).name=Snare; \
 analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows; \
 analyzer(0).class=Snare; \
 assessment.impact.severity=info; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=$3; \
 assessment.impact.type=user; \
 source(0).node.address(0).address=$9; \
 source(0).user.category=os-device; \
 target(0).node.name=$2; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$5; \
 target(0).process.pid=$7; \
 target(0).process.name=$8; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Event ID; \
 additional_data(0).data=$1; \
 additional_data(1).type=integer; \
 additional_data(1).meaning=Logon Type; \
 additional_data(1).data=$4; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Domain; \
 additional_data(2).data=$6; \
 silent; chained;


############ Event ID 4624
##An account has successfully logged on
#Type 10 RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance)
#LOG: Nov 23 15:49:03 10.1.1.1 testbox01        MSWinEventLog   1       Security        13469   Mon Nov 23 15:48:59 2009        4624    Microsoft-Windows-Security-Auditing     N/AN/A Information      testbox01.TESTDOMAIN.local      None            An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  testbox01$   Account Domain:  TESTDOMAIN   Logon ID:  0x3e7    Logon Type:   10    New Logon:   Security ID:  S-1-5-21-1481646799-3140499893-3922762874-3132   Account Name:  test.user   Account Domain:  TESTDOMAIN   Logon ID:  0x3373f5a03   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x1a3c   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: testbox01   Source Network Address: 10.1.1.2   Source Port:  43637    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. 13317
regex=4624\s+Microsoft-Windows-Security-Auditing.*Logon Type:\s+10; \
 id=99997; revision=1; goto=99996; \
 classification.text=Remote Login; \
 assessment.impact.severity=info; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 last;

############ Event ID 4624
##Type 2 = Interactive LOCAL logon
#LOG: Nov 24 10:25:57 10.1.1.1 testbox01        MSWinEventLog   1       Security        27250   Tue Nov 24 10:25:55 2009        4624    Microsoft-Windows-Security-Auditing     N/AN/AInformation       testbox01.TESTDOMAIN.local      None            An account was successfully logged on.    Subject:   Security ID:  S-1-5-18   Account Name:  testbox01$   Account Domain:  TESTDOMAIN   Logon ID:  0x3e7    Logon Type:   2    New Logon:   Security ID:  S-1-5-21-1481646799-3140499893-3922762874-3132   Account Name:  test.user   Account Domain:  TESTDOMAIN   Logon ID:  0xa3b2cc3b   Logon GUID:  {00000000-0000-0000-0000-000000000000}    Process Information:   Process ID:  0x260   Process Name:  C:\Windows\System32\winlogon.exe    Network Information:   Workstation Name: testbox01   Source Network Address: 127.0.0.1   Source Port:  0    Detailed Authentication Information:   Logon Process:  User32    Authentication Package: Negotiate   Transited Services: -   Package Name (NTLM only): -   Key Length:  0    This event is generated when a logon session is created. It is generated on the computer that was accessed.    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.    The authentication information fields provide detailed information about this specific logon request.   - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.   - Transited services indicate which intermediate services have participated in this logon request.   - Package name indicates which sub-protocol was used among the NTLM protocols.   - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.       25044
regex=4624\s+Microsoft-Windows-Security-Auditing.*Logon Type:\s+2; \
 id=99998; revision=1; goto=99996; \
 classification.text=Login; \
 assessment.impact.severity=info; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 last;
prelude-lml 1.0.0-5.3 / etc / prelude-lml / ruleset / snare_windows.rules
