<if_sid>18104</if_sid>
<id>^640$</id>
<description>General account database changed.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/events/com259.html</info>
+ <info type="link">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=640</info>
<group>adduser,account_changed,</group>
</rule>
<!-- Granular windows login rules -->
<rule id="18130" level="5">
<if_sid>18106</if_sid>
- <id>^529$</id>
+ <id>^529$|^4625$</id>
<description>Logon Failure - Unknown user or bad password.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/events/com190.html</info>
+ <info type="link">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4625</info>
<group>win_authentication_failed,</group>
</rule>
<id>^530$</id>
<description>Logon Failure - Account logon time restriction </description>
<description>violation.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/events/com191.html</info>
+ <info type="link">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=530</info>
<group>win_authentication_failed,login_denied,</group>
</rule>
<if_sid>18106</if_sid>
<id>^531$</id>
<description>Logon Failure - Account currently disabled.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/events/com192.html</info>
+ <info type="link">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=531</info>
<group>win_authentication_failed,login_denied,</group>
</rule>
<if_sid>18106</if_sid>
<id>^532$</id>
<description>Logon Failure - Specified account expired.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/events/com193.html</info>
+ <info type="link">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=532</info>
<group>win_authentication_failed,login_denied,</group>
</rule>
<id>^533$</id>
<description>Logon Failure - User not allowed to login at </description>
<description>this computer.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/events/com194.html</info>
+ <info type="link">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=533</info>
<group>win_authentication_failed,login_denied,</group>
</rule>
<if_sid>18106</if_sid>
<id>^534$</id>
<description>Logon Failure - User not granted logon type.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/events/com195.html</info>
+ <info type="link">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=534</info>
<group>win_authentication_failed,</group>
</rule>
<if_sid>18106</if_sid>
<id>^535$</id>
<description>Logon Failure - Account's password expired.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/events/com196.html</info>
+ <info type="link">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=535</info>
<group>win_authentication_failed,</group>
</rule>
<rule id="18138" level="7">
<if_sid>18106</if_sid>
- <id>^539$|^4625$</id>
+ <id>^539$</id>
<description>Logon Failure - Account locked out.</description>
<group>win_authentication_failed,</group>
</rule>
<if_sid>18104</if_sid>
<id>^671$|^4767$</id>
<description>User account unlocked.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/events/com291.html</info>
+ <info type="link">https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4767</info>
<group>account_changed,</group>
</rule>
<rule id="18218" level="5">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-1-0}</regex>
+ <regex> ID:\s+%{S-1-1-0}| ID:\s+S-1-1-0</regex>
<description>Everyone Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18219" level="12">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-9}</regex>
+ <regex> ID:\s+%{S-1-5-9}| ID:\s+S-1-5-9</regex>
<description>Enterprise Domain Controllers Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18220" level="5">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-11}</regex>
+ <regex> ID:\s+%{S-1-5-11}| ID:\s+S-1-5-11</regex>
<description>Authenticated Users Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18221" level="5">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-13}</regex>
+ <regex> ID:\s+%{S-1-5-13}| ID:\s+S-1-5-13</regex>
<description>Terminal Server Users Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18222" level="12">
<if_sid>18203,18204</if_sid>
- <regex> ID:\s+%{S-1-5-21\S+-512}</regex>
+ <regex> ID:\s+%{S-1-5-21\S+-512}| ID:\s+S-1-5-21\S+-512</regex>
<description>Domain Admins Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18223" level="5">
<if_sid>18203,18204</if_sid>
- <regex> ID:\s+%{S-1-5-21\S+-513}</regex>
+ <regex> ID:\s+%{S-1-5-21\S+-513}| ID:\s+S-1-5-21\S+-513</regex>
<description>Domain Users Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
</rule>
- <rule id="18224" level="0">
- <if_sid>18223,18203</if_sid>
- <match>Target Account Name: None</match>
- <description>Local User Group NONE</description>
- <info>Bogus group user added to upon creation</info>
- </rule>
+ <rule id="18224" level="0">
+ <if_sid>18223,18203</if_sid>
+ <match>Target Account Name: None</match>
+ <description>Local User Group NONE</description>
+ <info>Bogus group user added to upon creation</info>
+ </rule>
<rule id="18225" level="12">
<if_sid>18203,18204</if_sid>
- <regex> ID:\s+%{S-1-5-21\S+-514}</regex>
+ <regex> ID:\s+%{S-1-5-21\S+-514}| ID:\s+S-1-5-21\S+-514</regex>
<description>Domain Guests Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18226" level="5">
<if_sid>18203,18204</if_sid>
- <regex> ID:\s+%{S-1-5-21\S+-515}</regex>
+ <regex> ID:\s+%{S-1-5-21\S+-515}| ID:\s+S-1-5-21\S+-515</regex>
<description>Domain Computers Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18227" level="12">
<if_sid>18203,18204</if_sid>
- <regex> ID:\s+%{S-1-5-21\S+-516}</regex>
+ <regex> ID:\s+%{S-1-5-21\S+-516}| ID:\s+S-1-5-21\S+-516</regex>
<description>Domain Controllers Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18228" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-21\S+-517}</regex>
+ <regex> ID:\s+%{S-1-5-21\S+-517}| ID:\s+S-1-5-21\S+-517</regex>
<description>Cert Publishers Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18229" level="12">
<if_sid>18203,18204</if_sid>
- <regex> ID:\s+%{S-1-5-21\.+-518}</regex>
+ <regex> ID:\s+%{S-1-5-21\.+-518}| ID:\s+S-1-5-21\.+-518</regex>
<description>Schema Admins Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18230" level="12">
<if_sid>18203,18204</if_sid>
- <regex> ID:\s+%{S-1-5-21\S+-519}</regex>
+ <regex> ID:\s+%{S-1-5-21\S+-519}| ID:\s+S-1-5-21\S+-519</regex>
<description>Enterprise Admins Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18231" level="10">
<if_sid>18203,18204</if_sid>
- <regex> ID:\s+%{S-1-5-21\S+-520}</regex>
+ <regex> ID:\s+%{S-1-5-21\S+-520}| ID:\s+S-1-5-21\S+-520</regex>
<description>Group Policy Creator Owners Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18232" level="10">
<if_sid>18207,18208</if_sid>
- <regex>\w* ID:\s+%{S-1-5-21\S+-553}</regex>
+ <regex> ID:\s+%{S-1-5-21\S+-553}| ID:\s+S-1-5-21\S+-553</regex>
<description>RAS and IAS Servers Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18233" level="5">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-545}</regex>
+ <regex> ID:\s+%{S-1-5-32-545}| ID:\s+S-1-5-32-545</regex>
<description>Users Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18234" level="12">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-546}</regex>
+ <regex> ID:\s+%{S-1-5-32-546}| ID:\s+S-1-5-32-546</regex>
<description>Guests Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18235" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-547}</regex>
+ <regex> ID:\s+%{S-1-5-32-547}| ID:\s+S-1-5-32-547</regex>
<description>Power Users Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18236" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-548}</regex>
+ <regex> ID:\s+%{S-1-5-32-548}| ID:\s+S-1-5-32-548</regex>
<description>Account Operators Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18237" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-549}</regex>
+ <regex> ID:\s+%{S-1-5-32-549}| ID:\s+S-1-5-32-549</regex>
<description>Server Operators Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18238" level="8">
<if_sid>18207,18208</if_sid>
- <regex>\w* ID:\s+%{S-1-5-32-550}</regex>
+ <regex> ID:\s+%{S-1-5-32-550}| ID:\s+S-1-5-32-550</regex>
<description>Print Operators Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18239" level="12">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-551}</regex>
+ <regex> ID:\s+%{S-1-5-32-551}| ID:\s+S-1-5-32-551</regex>
<description>Backup Operators Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18240" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-552}</regex>
+ <regex> ID:\s+%{S-1-5-32-552}| ID:\s+S-1-5-32-552</regex>
<description>Replicators Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18241" level="8">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-554}</regex>
+ <regex> ID:\s+%{S-1-5-32-554}| ID:\s+S-1-5-32-554</regex>
<description>Pre-Windows 2000 Compatible Access Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18242" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-555}</regex>
+ <regex> ID:\s+%{S-1-5-32-555}| ID:\s+S-1-5-32-555</regex>
<description>Remote Desktop Users Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18243" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-556}</regex>
+ <regex> ID:\s+%{S-1-5-32-556}| ID:\s+S-1-5-32-556</regex>
<description>Network Configuration Operators Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18244" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-557}</regex>
+ <regex> ID:\s+%{S-1-5-32-557}| ID:\s+S-1-5-32-557</regex>
<description>Incoming Forest Trust Builders Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18245" level="8">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-558}</regex>
+ <regex> ID:\s+%{S-1-5-32-558}| ID:\s+S-1-5-32-558</regex>
<description>Performance Monitor Users Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18246" level="8">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-559}</regex>
+ <regex> ID:\s+%{S-1-5-32-559}| ID:\s+S-1-5-32-559</regex>
<description>Performance Log Users Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18247" level="8">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-560}</regex>
+ <regex> ID:\s+%{S-1-5-32-560}| ID:\s+S-1-5-32-560</regex>
<description>Windows Authorization Access Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18248" level="8">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-561}</regex>
+ <regex> ID:\s+%{S-1-5-32-561}| ID:\s+S-1-5-32-561</regex>
<description>Terminal Server License Servers Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18249" level="8">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-562}</regex>
+ <regex> ID:\s+%{S-1-5-32-562}| ID:\s+S-1-5-32-562</regex>
<description>Distributed COM Users Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18250" level="12">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-\s*21\.+\s*-498}</regex>
+ <regex> ID:\s+%{S-1-5-\s*21\.+\s*-498}| ID:\s+S-1-5-\s*21\.+\s*-498</regex>
<description>Enterprise Read-only Domain Controllers Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18251" level="12">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-\s*21\.+\s*-529}</regex>
+ <regex> ID:\s+%{S-1-5-\s*21\.+\s*-529}| ID:\s+S-1-5-\s*21\.+\s*-529</regex>
<description>Read-only Domain Controllers Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18252" level="12">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-569}</regex>
+ <regex> ID:\s+%{S-1-5-32-569}| ID:\s+S-1-5-32-569</regex>
<description>Cryptographic Operators Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18253" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-\s*21\.+\s*-571}</regex>
+ <regex> ID:\s+%{S-1-5-\s*21\.+\s*-571}| ID:\s+S-1-5-\s*21\.+\s*-571</regex>
<description>Allowed RODC Password Replication Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18254" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-\s*21\.+\s*-572}</regex>
+ <regex> ID:\s+%{S-1-5-\s*21\.+\s*-572}| ID:\s+S-1-5-\s*21\.+\s*-572</regex>
<description>Denied RODC Password Replication Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18255" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-573}</regex>
+ <regex> ID:\s+%{S-1-5-32-573}| ID:\s+S-1-5-32-573</regex>
<description>Event Log Readers Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
<rule id="18256" level="10">
<if_sid>18207,18208</if_sid>
- <regex> ID:\s+%{S-1-5-32-574}</regex>
+ <regex> ID:\s+%{S-1-5-32-574}| ID:\s+S-1-5-32-574</regex>
<description>Certificate Service DCOM Access Group Changed</description>
<group>group_changed,win_group_changed,</group>
<info>http://support.microsoft.com/kb/243330</info>
</rule>
+
+ <rule id="18257" level="3">
+ <if_sid>18101</if_sid>
+ <id>^200$|^300$|^302$</id>
+ <description>TS Gateway login success.</description>
+ <group>authentication_success,</group>
+ <info>https://technet.microsoft.com/en-us/library/cc775181(v=ws.10).aspx</info>
+ </rule>
+
+ <rule id="18258" level="5">
+ <if_sid>18102, 18103</if_sid>
+ <id>^201$|^203$|^204$|^301$|^304$|^305$|^306$|^1001$</id>
+ <description>TS Gateway login failure.</description>
+ <group>authentication_failed,</group>
+ <info>https://technet.microsoft.com/en-us/library/cc775181(v=ws.10).aspx</info>
+ </rule>
+
+ <rule id="18259" level="3">
+ <if_sid>18101</if_sid>
+ <id>^202$|^303$</id>
+ <description>TS Gateway user disconnected.</description>
+ <info>https://technet.microsoft.com/en-us/library/cc775181(v=ws.10).aspx</info>
+ </rule>
<!-- Ignore Login events, type 5, from Advapi for:
- LOCAL SERVICE and NETWORK SERVICE.
<match>Failure Code: 0x1F</match>
<description>Windows DC integrity check on decrypted </description>
<description>field failed.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/kerberrors.html</info>
+ <!--<info type="link">http://www.ultimatewindowssecurity.com/kerberrors.html</info>-->
<group>win_authentication_failed,attacks,</group>
</rule>
<if_sid>18139</if_sid>
<match>Failure Code: 0x22</match>
<description>Windows DC - Possible replay attack.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/kerberrors.html</info>
+ <!--<info type="link">http://www.ultimatewindowssecurity.com/kerberrors.html</info>-->
<group>win_authentication_failed,attacks,</group>
</rule>
<if_sid>18139</if_sid>
<match>Failure Code: 0x25</match>
<description>Windows DC - Clock skew too great.</description>
- <info type="link">http://www.ultimatewindowssecurity.com/kerberrors.html</info>
+ <!--<info type="link">http://www.ultimatewindowssecurity.com/kerberrors.html</info>-->
<group>win_authentication_failed,attacks,</group>
</rule>
<group>authentication_success,</group>
</rule>
+<!-- Detail logon rules -->
+ <rule id="18260" level="3">
+ <if_sid>18107</if_sid>
+ <id>^4624$</id>
+ <match>Logon Type: 8</match>
+ <description>MS Exchange Logon Success.</description>
+ </rule>
+
+ <rule id="18261" level="0">
+ <if_sid>18149</if_sid>
+ <id>^4634$</id>
+ <match>Logon Type: 8</match>
+ <description>User Logoff Exchange.</description>
+ </rule>
<!-- Composite rules -->
<description>Multiple remote access login failures.</description>
<group>authentication_failures,</group>
</rule>
+
+ <rule id="18157" level="10" frequency="$MS_FREQ" timeframe="240">
+ <if_matched_sid>18258</if_matched_sid>
+ <description>Multiple TS Gateway login failures.</description>
+ <group>authentication_failures,</group>
+ </rule>
+
+ <!--
+ Chrome Remote Desktop
+ Created by Kevin Branch
+ Updated by Wazuh
+ -->
+ <rule id="18158" level="5">
+ <if_sid>18103</if_sid>
+ <match>chromoting</match>
+ <regex>: chromoting: \.* Access denied for client: </regex>
+ <description>Chrome Remote Desktop attempt - access denied</description>
+ </rule>
+
+ <rule id="18159" level="5">
+ <if_sid>18101</if_sid>
+ <match>chromoting</match>
+ <regex>: chromoting: \.* Client connected:</regex>
+ <description>Chrome Remote Desktop attempt - connected</description>
+ </rule>
+
+ <rule id="18160" level="5">
+ <if_sid>18101</if_sid>
+ <match>chromoting</match>
+ <regex>: chromoting: \.* Client disconnected:</regex>
+ <description>Chrome Remote Desktop attempt - disconnected</description>
+ </rule>
+
</group>
<!-- EOF -->
projects / ossec-hids.git / blobdiff