1 <!-- @(#) $Id: ./etc/rules/smbd_rules.xml, 2011/09/08 dcid Exp $
3 - Official SMB rules for OSSEC.
5 - Copyright (C) 2009 Trend Micro Inc.
8 - This program is a free software; you can redistribute it
9 - and/or modify it under the terms of the GNU General Public
10 - License (version 2) as published by the FSF - Free Software
13 - License details: http://www.ossec.net/en/licensing.html
15 - Test logs sent by: Kayvan A. Sylvan <kayvan at sylvan.com>
20 <group name="syslog,smbd,">
21 <rule id="13100" level="0" noalert="1">
22 <decoded_as>smbd</decoded_as>
23 <description>Grouping for the smbd rules.</description>
26 <rule id="13101" level="0">
27 <if_sid>13100</if_sid>
28 <match>getpeername failed. Error was Transport endpoint</match>
29 <description>Samba network problems.</description>
32 <rule id="13102" level="5">
33 <if_sid>13100</if_sid>
34 <match>Denied connection from|Connection denied from</match>
35 <description>Samba connection denied.</description>
36 <group>access_denied,</group>
39 <rule id="13103" level="0">
40 <if_sid>13100</if_sid>
41 <match>Connection reset by peer</match>
42 <description>Samba network problems.</description>
45 <rule id="13104" level="5">
46 <if_sid>13100</if_sid>
47 <match>Permission denied--</match>
48 <description>User action denied by configuration.</description>
49 <group>access_denied,</group>
52 <rule id="13105" level="3">
53 <if_sid>13100</if_sid>
54 <match>Unable to connect to CUPS server</match>
55 <description>Samba network problems (unable to connect).</description>
58 <rule id="13106" level="0" noalert="1">
59 <decoded_as>nmbd</decoded_as>
62 <rule id="13108" level="1">
63 <if_sid>13100</if_sid>
64 <match>smbd is already running</match>
65 <description>An attempt has been made to start smbd but the process is already running.</description>
68 <rule id="13109" level="1">
69 <if_sid>13106</if_sid>
70 <match>nmbd is already running</match>
71 <description>An attempt has been made to start nmbd but the process is already running.</description>
74 <rule id="13110" level="2">
75 <if_sid>13100</if_sid>
76 <match>Connection denied from</match>
77 <description>Connection was denied.</description>
80 <rule id="13111" level="3">
81 <if_sid>13100</if_sid>
82 <match>Socket is not connected</match>
83 <description>Socket is not connected, write failed.</description>
86 <rule id="13112" level="3">
87 <decoded_as>iptables</decoded_as>
88 <match>gvfsd-smb</match>
89 <regex>segfault at \S+ ip \S+ sp \S+ error \d+ in</regex>
90 <description>Segfault in gvfs-smb.</description>
95 </group> <!-- SYSLOG,SMBD, -->