1 <!-- @(#) $Id: ./etc/rules/mcafee_av_rules.xml, 2011/09/08 dcid Exp $
3 - McAfee AV rules for OSSEC.
5 - Copyright (C) 2008 Michael Starks
7 - This program is a free software; you can redistribute it
8 - and/or modify it under the terms of the GNU General Public
9 - License (version 3) as published by the FSF - Free Software
13 <var name="MCAFEE_ERROR">^259$|^100$|^1000$|^1001$|^1002$|^1003$|^1004$|^1005$|^1006$|^1007$|^1008$|^5003$|^5005$|^5008$|^5010$|^5011$|^5019$|^5020$|^5021$|^5022$|^5030$|^5031$|^5032$|^5033$|^5034$|^5035$|^5046$|^5047$|^5048$|^5049$|^5051$|^5054$|^5057$|^5059$|^5060$|^5063$|^5063$</var>
14 <var name="MCAFEE_WARN">^258$|^5001$|^5028$|^5036$|^5037$|^5038$|^5039$|^5040$|^5041$|^5053$|^5056$|^5061$|^5062$|^5065$</var>
15 <var name="MCAFEE_INFO">^257$|^5000$|^5026$|^5052$|^5055$</var>
16 <var name="MCAFEE_VIRUS_OK">quarantined|moved to quarantine|file was deleted|deleted successfully|has been deleted|message deleted|deleted after|cleaned|successfully deleted</var>
17 <var name="MCAFEE_VIRUS">The file \.+ contain|infected with|User defined detection|scan found|error attempting to clean</var>
18 <var name="MCAFEE_FREQ">10</var>
20 <group name="mcafee,">
21 <rule id="7500" level="0">
22 <if_sid>18101,18102,18103</if_sid>
23 <category>windows</category>
24 <extra_data>^McLogEvent</extra_data>
25 <description>Grouping of McAfee Windows AV rules.</description>
28 <rule id="7501" level="2">
31 <description>McAfee Windows AV informational event.</description>
34 <rule id="7502" level="3">
37 <description>McAfee Windows AV warning event.</description>
40 <rule id="7503" level="4">
42 <id>$MCAFEE_ERROR</id>
43 <description>McAfee Windows AV error event.</description>
46 <rule id="7504" level="12">
48 <regex>$MCAFEE_VIRUS</regex>
50 <description>McAfee Windows AV - Virus detected and not removed.</description>
53 <rule id="7505" level="7">
55 <match>$MCAFEE_VIRUS_OK</match>
57 <description>McAfee Windows AV - Virus detected and properly removed.</description>
60 <rule id="7506" level="7">
62 <match>Will be deleted</match>
64 <description>McAfee Windows AV - Virus detected and file will be deleted.</description>
67 <rule id="7507" level="3">
69 <match>scan started|scan stopped</match>
70 <description>McAfee Windows AV - Scan started or stopped.</description>
73 <rule id="7508" level="3">
76 <match>completed. No detections</match>
77 <description>McAfee Windows AV - Scan completed with no viruses found.</description>
80 <rule id="7509" level="5">
82 <match>scan was cancelled |has taken too long</match>
83 <description>McAfee Windows AV - Virus scan cancelled.</description>
86 <rule id="7510" level="5">
88 <match>scan was canceled because</match>
89 <description>McAfee Windows AV - Virus scan cancelled due to shutdown.</description>
92 <rule id="7511" level="3">
94 <match>update was successful</match>
95 <description>McAfee Windows AV - Virus program or DAT update succeeded.</description>
98 <rule id="07512" level="7">
100 <match>update failed</match>
101 <description>McAfee Windows AV - Virus program or DAT update failed.</description>
104 <rule id="7513" level="7">
105 <if_sid>7500</if_sid>
106 <match>update was cancelled</match>
107 <description>McAfee Windows AV - Virus program or DAT update cancelled.</description>
110 <rule id="7514" level="5">
111 <if_sid>7505</if_sid>
112 <match>contains the EICAR test file</match>
113 <options>alert_by_email</options>
114 <description>McAfee Windows AV - EICAR test file detected.</description>
117 <!-- Composite rules -->
119 <rule id="7550" level="10" frequency="$MCAFEE_FREQ" timeframe="240">
120 <if_matched_sid>7502</if_matched_sid>
121 <description>Multiple McAfee AV warning events.</description>