obrisane nepotrebne datoteke od zadnjeg builda

[ossec-hids.git] / debian / ossec-hids / var / ossec / rules / sysmon_rules.xml

diff --git a/debian/ossec-hids/var/ossec/rules/sysmon_rules.xml b/debian/ossec-hids/var/ossec/rules/sysmon_rules.xml
deleted file mode 100644 (file)
index 3271498..0000000
--- a/debian/ossec-hids/var/ossec/rules/sysmon_rules.xml
+++ /dev/null
@@ -1,173 +0,0 @@
-<!--Maintained by Josh Brower, Josh@DefensiveDepth.com -->
-<!--Licensed under the MIT License: http://opensource.org/licenses/MIT-->
-
-<!-- Ruleset to detect Windows Process Anomalies - 
-  -  Uses Sysmon Event ID 1 logs & associated decoder.
-  -  Currently only looks at Parent Image Anomalies.
-  -  Windows Process Attributes documentation here: http://defensivedepth.com/windows-processes
-  -
-  -  OSSEC to Sysmon (Event ID 1) Fields Mapping:
-  -  user = User
-  -  status = Image
-  -  url = Hash
-  -  extra_data = ParentImage
-  -->
-  
-<group name="sysmon_process-anomalies">
-  
- <rule id="18501" level="12">
-  <if_sid>18100</if_sid>
-  <status>svchost.exe</status>
-  <description>Sysmon - Suspicious Process - svchost.exe</description>
- </rule>
-
- <rule id="18502" level="0">
-  <if_sid>18501</if_sid>
-  <extra_data>\services.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - svchost.exe</description>
- </rule>
-
-
-<rule id="18511" level="12">
-  <if_sid>18100</if_sid>
-  <status>lsm.exe</status>
-  <description>Sysmon - Suspicious Process - lsm.exe</description>
-</rule>
-
-<rule id="18512" level="0">
-  <if_sid>18511</if_sid>
-  <extra_data>wininit.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - lsm.exe</description>
-</rule>
-
-<rule id="18513" level="12">
-  <if_sid>18100</if_sid>
-  <extra_data>lsm.exe</extra_data>
-  <description>Sysmon - Suspicious Process - lsm.exe is a Parent Image</description>
-</rule>
-
-
-<rule id="18521" level="12">
-  <if_sid>18100</if_sid>
-  <status>csrss.exe</status>
-  <description>Sysmon - Suspicious Process - csrss.exe</description>
-</rule>
-
-<rule id="18522" level="0">
-  <if_sid>18521</if_sid>
-  <extra_data>smss.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - csrss.exe</description>
-</rule>
-
-
-<rule id="18531" level="12">
-  <if_sid>18100</if_sid>
-  <status>lsass.exe</status>
-  <description>Sysmon - Suspicious Process - lsass</description>
-</rule>
-
-<rule id="18532" level="0">
-  <if_sid>18531</if_sid>
-  <extra_data>wininit.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - lsass.exe</description>
-</rule>
-
-<rule id="18533" level="12">
-  <if_sid>18100</if_sid>
-  <extra_data>lsass.exe</extra_data>
-  <description>Sysmon - Suspicious Process - lsass.exe is a Parent Image</description>
-</rule>
-
-
-<rule id="18541" level="12">
-  <if_sid>18100</if_sid>
-  <status>winlogon.exe</status>
-  <description>Sysmon - Suspicious Process - winlogon.exe</description>
-</rule>
-
-<rule id="18542" level="0">
-  <if_sid>18541</if_sid>
-  <extra_data>smss.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - winlogon.exe</description>
-</rule>
-
-
-<rule id="18551" level="12">
-  <if_sid>18100</if_sid>
-  <status>wininit.exe</status>
-  <description>Sysmon - Suspicious Process - wininit</description>
-</rule>
-
-<rule id="18552" level="0">
-  <if_sid>18551</if_sid>
-  <extra_data>smss.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - wininit.exe</description>
-</rule>
-
-
-<rule id="18561" level="12">
-  <if_sid>18100</if_sid>
-  <status>smss.exe</status>
-  <description>Sysmon - Suspicious Process - smss.exe</description>
-</rule>
-
-<rule id="18562" level="0">
-  <if_sid>18561</if_sid>
-  <extra_data>system</extra_data>
-  <description>Sysmon - Legitimate Parent Image - smss.exe</description>
-</rule>
-
-
-<rule id="18571" level="12">
-  <if_sid>18100</if_sid>
-  <status>taskhost.exe</status>
-  <description>Sysmon - Suspicious Process - taskhost.exe</description>
-</rule>
-
-<rule id="18572" level="0">
-  <if_sid>18571</if_sid>
-  <extra_data>services.exe|svchost.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - taskhost.exe</description>
-</rule>
-
-
-<rule id="18581" level="12">
-  <if_sid>18100</if_sid>
-  <status>/services.exe</status>
-  <description>Sysmon - Suspicious Process - services.exe</description>
-</rule>
-
-<rule id="18582" level="0">
-  <if_sid>18581</if_sid>
-  <extra_data>wininit.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - services.exe</description>
-</rule>
-
-
-<rule id="18591" level="12">
-  <if_sid>18100</if_sid>
-  <status>dllhost.exe</status>
-  <description>Sysmon - Suspicious Process - dllhost.exe</description>
-</rule>
-
-<rule id="18592" level="0">
-  <if_sid>18591</if_sid>
-  <extra_data>svchost.exe|services.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - dllhost.exe</description>
-</rule>
-
-
-<rule id="18601" level="12">
-  <if_sid>18100</if_sid>
-  <status>\explorer.exe</status>
-  <description>Sysmon - Suspicious Process - explorer.exe</description>
-</rule>
-
-<rule id="18602" level="0">
-  <if_sid>18601</if_sid>
-  <extra_data>userinit.exe</extra_data>
-  <description>Sysmon - Legitimate Parent Image - explorer.exe</description>
-</rule>
-</group> <!-- sysmon_process-anomalies -->
-
-<!-- EOF -->