etc/rules/ossec_rules.xml

   1 <!-- @(#) $Id$
   2   -  Official ossec rules for OSSEC.
   3   -
   4   -  Copyright (C) 2009 Trend Micro Inc.
   5   -  All rights reserved.
   6   -
   7   -  This program is a free software; you can redistribute it
   8   -  and/or modify it under the terms of the GNU General Public
   9   -  License (version 2) as published by the FSF - Free Software
  10   -  Foundation.
  11   -
  12   -  License details: http://www.ossec.net/en/licensing.html
  13   -->
  14
  15
  16
  17 <group name="ossec,">
  18   <rule id="500" level="0">
  19     <category>ossec</category>
  20     <decoded_as>ossec</decoded_as>
  21     <description>Grouping of ossec rules.</description>
  22   </rule>
  23
  24   <rule id="501" level="3">
  25     <if_sid>500</if_sid>
  26     <if_fts />
  27     <options>alert_by_email</options>
  28     <match>Agent started</match>
  29     <description>New ossec agent connected.</description>
  30   </rule>
  31
  32   <rule id="502" level="3">
  33     <if_sid>500</if_sid>
  34     <options>alert_by_email</options>
  35     <match>Ossec started</match>
  36     <description>Ossec server started.</description>
  37   </rule>
  38
  39   <rule id="503" level="3">
  40     <if_sid>500</if_sid>
  41     <options>alert_by_email</options>
  42     <match>Agent started</match>
  43     <description>Ossec agent started.</description>
  44   </rule>
  45
  46   <rule id="504" level="3">
  47     <if_sid>500</if_sid>
  48     <options>alert_by_email</options>
  49     <match>Agent disconnected</match>
  50     <description>Ossec agent disconnected.</description>
  51   </rule>
  52
  53   <rule id="509" level="0">
  54     <category>ossec</category>
  55     <decoded_as>rootcheck</decoded_as>
  56     <description>Rootcheck event.</description>
  57     <group>rootcheck,</group>
  58   </rule>
  59
  60   <rule id="510" level="7">
  61     <if_sid>509</if_sid>
  62     <description>Host-based anomaly detection event (rootcheck).</description>
  63     <group>rootcheck,</group>
  64     <if_fts />
  65   </rule>
  66
  67   <rule id="511" level="0">
  68     <if_sid>510</if_sid>
  69     <match>^NTFS Alternate data stream found</match>
  70     <regex>Thumbs.db:encryptable'.|:Zone.Identifier'.|</regex>
  71     <regex>Exchsrvr/Mailroot/vsi</regex>
  72     <description>Ignored common NTFS ADS entries.</description>
  73     <group>rootcheck,</group>
  74   </rule>
  75
  76   <rule id="512" level="3">
  77     <if_sid>510</if_sid>
  78     <match>^Windows Audit</match>
  79     <description>Windows Audit event.</description>
  80     <group>rootcheck,</group>
  81   </rule>
  82
  83   <rule id="513" level="9">
  84     <if_sid>510</if_sid>
  85     <match>^Windows Malware</match>
  86     <description>Windows malware detected.</description>
  87     <group>rootcheck,</group>
  88   </rule>
  89
  90   <rule id="514" level="2">
  91     <if_sid>510</if_sid>
  92     <match>^Application Found</match>
  93     <description>Windows application monitor event.</description>
  94     <group>rootcheck,</group>
  95   </rule>
  96
  97   <rule id="515" level="0">
  98     <if_sid>510</if_sid>
  99     <match>^Starting rootcheck scan|^Ending rootcheck scan.|</match>
 100     <match>^Starting syscheck scan|^Ending syscheck scan.</match>
 101     <description>Ignoring rootcheck/syscheck scan messages.</description>
 102     <group>rootcheck,syscheck</group>
 103   </rule>
 104
 105   <rule id="516" level="3">
 106     <if_sid>510</if_sid>
 107     <match>^System Audit</match>
 108     <description>System Audit event.</description>
 109     <group>rootcheck,</group>
 110   </rule>
 111
 112   <rule id="518" level="9">
 113     <if_sid>514</if_sid>
 114     <match>Adware|Spyware</match>
 115     <description>Windows Adware/Spyware application found.</description>
 116     <group>rootcheck,</group>
 117   </rule>
 118
 119   <!-- Process monitoring rules -->
 120   <rule id="530" level="0">
 121     <if_sid>500</if_sid>
 122     <match>^ossec: output: </match>
 123     <description>OSSEC process monitoring rules.</description>
 124     <group>process_monitor,</group>
 125   </rule>
 126
 127   <rule id="531" level="7" ignore="7200">
 128     <if_sid>530</if_sid>
 129     <match>ossec: output: 'df -h': /dev/</match>
 130     <regex>100%</regex>
 131     <description>Partition usage reached 100% (disk space monitor).</description>
 132     <group>low_diskspace,</group>
 133   </rule>
 134
 135  <rule id="532" level="0">
 136     <if_sid>531</if_sid>
 137     <match>cdrom|/media|usb|/mount|floppy|dvd</match>
 138     <description>Ignoring external medias.</description>
 139   </rule>
 140
 141   <rule id="550" level="7">
 142     <category>ossec</category>
 143     <decoded_as>syscheck_integrity_changed</decoded_as>
 144     <description>Integrity checksum changed.</description>
 145     <group>syscheck,</group>
 146   </rule>
 147
 148   <rule id="551" level="7">
 149     <category>ossec</category>
 150     <decoded_as>syscheck_integrity_changed_2nd</decoded_as>
 151     <description>Integrity checksum changed again (2nd time).</description>
 152     <group>syscheck,</group>
 153   </rule>
 154
 155   <rule id="552" level="7">
 156     <category>ossec</category>
 157     <decoded_as>syscheck_integrity_changed_3rd</decoded_as>
 158     <description>Integrity checksum changed again (3rd time).</description>
 159     <group>syscheck,</group>
 160   </rule>
 161
 162   <rule id="553" level="7">
 163     <category>ossec</category>
 164     <decoded_as>syscheck_deleted</decoded_as>
 165     <description>File deleted. Unable to retrieve checksum.</description>
 166     <group>syscheck,</group>
 167   </rule>
 168
 169   <rule id="554" level="0">
 170     <category>ossec</category>
 171     <decoded_as>syscheck_new_entry</decoded_as>
 172     <description>File added to the system.</description>
 173     <group>syscheck,</group>
 174   </rule>
 175
 176   <rule id="555" level="7">
 177     <if_sid>500</if_sid>
 178     <match>^ossec: agentless: </match>
 179     <description>Integrity checksum for agentless device changed.</description>
 180     <group>syscheck,agentless</group>
 181   </rule>
 182
 183   <!-- Hostinfo rules -->
 184   <rule id="580" level="8">
 185     <category>ossec</category>
 186     <decoded_as>hostinfo_modified</decoded_as>
 187     <description>Host information changed.</description>
 188     <group>hostinfo,</group>
 189   </rule>
 190
 191   <rule id="581" level="8">
 192     <category>ossec</category>
 193     <decoded_as>hostinfo_new</decoded_as>
 194     <description>Host information added.</description>
 195     <group>hostinfo,</group>
 196   </rule>
 197
 198
 199   <!-- File rotation/reducded rules -->
 200   <rule id="591" level="3">
 201     <if_sid>500</if_sid>
 202     <match>^ossec: File rotated </match>
 203     <description>Log file rotated.</description>
 204   </rule>
 205
 206   <rule id="592" level="8">
 207     <if_sid>500</if_sid>
 208     <match>^ossec: File size reduced</match>
 209     <description>Log file size reduced.</description>
 210     <group>attacks,</group>
 211   </rule>
 212
 213   <rule id="593" level="9">
 214     <if_sid>500</if_sid>
 215     <match>^ossec: Event log cleared</match>
 216     <description>Microsoft Event log cleared.</description>
 217     <group>logs_cleared,</group>
 218   </rule>
 219 </group> <!-- OSSEC -->