etc/rules/vpopmail_rules.xml

   1 <!-- @(#) $Id: ./etc/rules/vpopmail_rules.xml, 2011/09/08 dcid Exp $
   2
   3   -  Official rules for vpopmail.
   4   -
   5   -  Author: Ceg Ryan <cegryan ( at ) gmail.com>
   6   -  License: http://www.ossec.net/en/licensing.html
   7   -->
   8
   9
  10 <group name="syslog,vpopmail,">
  11   <rule id="9900" level="0">
  12     <decoded_as>vpopmail</decoded_as>
  13     <description>Grouping for the vpopmail rules.</description>
  14   </rule>
  15
  16   <rule id="9901" level="5">
  17     <if_sid>9900</if_sid>
  18     <match> password fail </match>
  19     <group>authentication_failed,</group>
  20     <description>Login failed for vpopmail.</description>
  21   </rule>
  22
  23   <rule id="9902" level="5">
  24     <if_sid>9900</if_sid>
  25     <match> vpopmail user not found </match>
  26     <group>invalid_login,</group>
  27     <description>Attempt to login to vpopmail with invalid username.</description>
  28   </rule>
  29
  30   <rule id="9903" level="5">
  31     <if_sid>9900</if_sid>
  32     <match> null password given </match>
  33     <group>authentication_failed,</group>
  34     <description>Attempt to login to vpopmail with empty password.</description>
  35   </rule>
  36
  37   <rule id="9904" level="1">
  38     <if_sid>9900</if_sid>
  39     <match> login success </match>
  40     <group>authentication_success,</group>
  41     <description>Vpopmail successful login.</description>
  42   </rule>
  43
  44
  45   <rule id="9951" level="10" frequency="8" timeframe="240">
  46     <if_matched_sid>9901</if_matched_sid>
  47     <same_source_ip />
  48     <description>Vpopmail brute force (multiple failed logins).</description>
  49     <group>authentication_failures,</group>
  50   </rule>
  51
  52   <rule id="9952" level="10" frequency="8" timeframe="240">
  53     <if_matched_sid>9902</if_matched_sid>
  54     <same_source_ip />
  55     <description>Vpopmail brute force (email harvesting).</description>
  56     <group>authentication_failures,</group>
  57   </rule>
  58
  59   <rule id="9953" level="10" frequency="8" timeframe="240">
  60     <if_matched_sid>9903</if_matched_sid>
  61     <same_source_ip />
  62     <description>VPOPMAIL brute force (empty password).</description>
  63     <group>authentication_failures,</group>
  64   </rule>
  65
  66 </group>
  67
  68 <!-- EOF -->