X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?p=ossec-hids.git;a=blobdiff_plain;f=etc%2Frules%2Fasterisk_rules.xml;h=bed0e714643472cfc21a74792d4add16fbfb2446;hp=3582766673ee870194df7b1d2ef2105eb6da96f8;hb=6ef2f786c6c8ead94841b5f93baf9f43421f08c8;hpb=301048b51990573e58a30dc4a5bb4ec285cad554

diff --git a/etc/rules/asterisk_rules.xml b/etc/rules/asterisk_rules.xml
index 3582766..bed0e71 100755
--- a/etc/rules/asterisk_rules.xml
+++ b/etc/rules/asterisk_rules.xml
@@ -1,4 +1,5 @@
-<!-- @(#) $Id$
+<!-- @(#) $Id: ./etc/rules/asterisk_rules.xml, 2011/09/08 dcid Exp $
+
   -  Official Asterisk rules for OSSEC.
   -
   -  Copyright (C) 2009 Trend Micro Inc.
@@ -76,6 +77,46 @@
     <same_source_ip />
     <description>Extension enumeration.</description>
   </rule>
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <!--http://sysbrain.wordpress.com/2010/05/24/asterisk-ossec-part-ii/-->
+  <rule id="6253" level="5">
+    <if_sid>6201</if_sid>
+    <match>No registration for peer</match>
+    <description>Login session failed (invalid iax user).</description>
+    <group>invalid_login,</group>
+  </rule>
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <rule id="6254" level="10" frequency="3" timeframe="300">
+    <if_matched_sid>6253</if_matched_sid>
+    <same_source_ip />
+    <description>Extension IAX Enumeration.</description>
+  </rule>
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <rule id="6255" level="5">
+    <if_sid>6202</if_sid>
+    <match>Don't know how to respond via</match>
+    <description>Possible Registration Hijacking.</description>
+    <group>invalid_login,</group>
+  </rule>
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <rule id="6256" level="5">
+    <if_sid>6201</if_sid>
+    <match>failed MD5 authentication</match>
+    <description>IAX peer Wrong Password.</description>
+    <group>invalid_login,</group>
+  </rule>
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <rule id="6257" level="10" frequency="3" timeframe="300">
+    <if_matched_sid>6256</if_matched_sid>
+    <same_source_ip />
+    <description>Multiple failed logins.</description>
+  </rule>
+
   
 </group> <!-- ASTERISK -->