2 - Official Generic Syslog rules for OSSEC.
4 - Copyright (C) 2009 Trend Micro Inc.
7 - This program is a free software; you can redistribute it
8 - and/or modify it under the terms of the GNU General Public
9 - License (version 2) as published by the FSF - Free Software
12 - License details: http://www.ossec.net/en/licensing.html
16 <!-- Default variables for the SYSLOG rules. -->
18 <!-- Bad words matching. Any log containing these messages
21 <var name="BAD_WORDS">core_dumped|failure|error|attack|bad |illegal |denied|refused|unauthorized|fatal|failed|Segmentation Fault|Corrupted</var>
24 <!-- Syslog errors. -->
25 <group name="syslog,errors,">
26 <rule id="1001" level="2">
27 <match>^Couldn't open /etc/securetty</match>
28 <description>File missing. Root access unrestricted.</description>
31 <rule id="1002" level="2">
32 <match>$BAD_WORDS</match>
33 <options>alert_by_email</options>
34 <description>Unknown problem somewhere in the system.</description>
37 <rule id="1003" level="13" maxsize="1025">
38 <description>Non standard syslog message (size too large).</description>
41 <rule id="1004" level="5">
42 <match>^exiting on signal</match>
43 <description>Syslogd exiting (logging stopped).</description>
46 <rule id="1005" level="5">
47 <program_name>syslogd</program_name>
48 <match>^restart</match>
49 <description>Syslogd restarted.</description>
52 <rule id="1006" level="5">
53 <regex>^syslogd \S+ restart</regex>
54 <description>Syslogd restarted.</description>
57 <rule id="1007" level="7">
58 <match>file system full|No space left on device</match>
59 <description>File system full.</description>
60 <group>low_diskspace,</group>
63 <rule id="1008" level="5">
64 <match>killed by SIGTERM</match>
65 <description>Process exiting (killed).</description>
66 <group>service_availability,</group>
68 </group> <!-- SYSLOG,ERRORS -->
73 <group name="syslog,nfs,">
74 <!-- XXX All These NFS rules need to be fixed. -->
75 <rule id="2100" level="0" noalert="1">
76 <program_name>^automount|^mount</program_name>
77 <description>NFS rules grouped.</description>
80 <rule id="2101" level="4">
82 <match>nfs: mount failure</match>
83 <description>Unable to mount the NFS share.</description>
86 <rule id="2102" level="4">
88 <match>reason given by server: Permission denied</match>
89 <description>Unable to mount the NFS directory.</description>
92 <rule id="2103" level="4">
93 <match>^rpc.mountd: refused mount request from</match>
94 <description>Unable to mount the NFS directory.</description>
97 <rule id="2104" level="2">
99 <regex>lookup for \S+ failed</regex>
100 <description>Automount informative message</description>
102 </group> <!-- SYSLOG,NFS -->
106 <!-- xinetd messages -->
107 <group name="syslog,xinetd,">
108 <rule id="2301" level="10">
109 <match>^Deactivating service </match>
110 <description>Excessive number connections to a service.</description>
112 </group> <!-- SYSLOG,XINETD -->
116 <!-- Access control messages -->
117 <group name="syslog,access_control,">
118 <rule id="2501" level="5">
119 <match>FAILED LOGIN |authentication failure|</match>
120 <match>Authentication failed for|invalid password for|</match>
121 <match>LOGIN FAILURE|auth failure: |authentication error|</match>
122 <match>authinternal failed|Failed to authorize|</match>
123 <match>Wrong password given for|login failed|Auth: Login incorrect</match>
124 <group>authentication_failed,</group>
125 <description>User authentication failure.</description>
128 <rule id="2502" level="10">
129 <match>more authentication failures;|REPEATED login failures</match>
130 <description>User missed the password more than one time</description>
131 <group>authentication_failed,</group>
134 <rule id="2503" level="5">
135 <regex>^refused connect from|</regex>
136 <regex>^libwrap refused connection|</regex>
137 <regex>Connection from \S+ denied</regex>
138 <description>Connection blocked by Tcp Wrappers.</description>
139 <group>access_denied,</group>
142 <rule id="2504" level="9">
143 <match>ILLEGAL ROOT LOGIN|ROOT LOGIN REFUSED</match>
144 <description>Illegal root login. </description>
145 <group>invalid_login,</group>
148 <rule id="2505" level="3">
149 <match>^ROOT LOGIN on</match>
150 <description>Physical root login.</description>
153 <rule id="2506" level="3">
154 <match>^Authentication passed</match>
155 <description>Pop3 Authentication passed.</description>
157 </group> <!-- SYSLOG,ACESSCONTROL -->
162 <group name="syslog,access_control,">
163 <rule id="2550" level="0" noalert="1">
164 <decoded_as>rshd</decoded_as>
165 <description>rshd messages grouped.</description>
168 <rule id="2551" level="10">
169 <if_sid>2550</if_sid>
170 <regex>^Connection from \S+ on illegal port$</regex>
171 <description>Connection to rshd from unprivileged port. Possible network scan.</description>
172 <group>connection_attempt,</group>
178 <!-- Mail/Procmail messages -->
179 <group name="syslog,mail,">
180 <rule id="2701" level="0">
181 <program_name>^procmail</program_name>
182 <description>Ignoring procmail messages.</description>
184 </group> <!-- SYSLOG,SENDMAIL -->
188 <!-- Smartd messages -->
189 <group name="syslog,smartd,">
190 <rule id="2800" level="0" noalert="1">
191 <program_name>^smart</program_name>
192 <description>Pre-match rule for smartd.</description>
195 <rule id="2801" level="0">
196 <if_sid>2800</if_sid>
197 <match>No configuration file /etc/smartd.conf found</match>
198 <description>Smartd Started but not configured</description>
201 <rule id="2802" level="0">
202 <if_sid>2800</if_sid>
203 <match>Unable to register ATA device</match>
204 <description>Smartd configuration problem</description>
207 <rule id="2803" level="0">
208 <if_sid>2800</if_sid>
209 <match>No such device or address</match>
210 <description>Device configured but not available to Smartd</description>
212 </group> <!-- SYSLOG,SMARTD -->
216 <!-- Linux Kernel messages -->
217 <group name="syslog,linuxkernel,">
218 <rule id="5100" level="0" noalert="1">
219 <program_name>^kernel</program_name>
220 <description>Pre-match rule for kernel messages</description>
223 <rule id="5101" level="0">
224 <if_sid>5100</if_sid>
225 <match>PCI: if you experience problems, try using option</match>
226 <description>Informative message from the kernel.</description>
229 <rule id="5102" level="0">
230 <if_sid>5100</if_sid>
231 <match>modprobe: Can't locate module sound</match>
232 <description>Informative message from the kernel</description>
235 <rule id="5103" level="9">
236 <if_sid>5100</if_sid>
237 <match>Oversized packet received from</match>
238 <description>Error message from the kernel. </description>
239 <description>Ping of death attack.</description>
242 <rule id="5104" level="8">
243 <if_sid>5100</if_sid>
244 <regex>Promiscuous mode enabled|</regex>
245 <regex>device \S+ entered promiscuous mode</regex>
246 <description>Interface entered in promiscuous(sniffing) mode.</description>
247 <group>promisc,</group>
250 <rule id="5105" level="0">
251 <if_sid>5100</if_sid>
252 <match>end_request: I/O error, dev fd0, sector 0|</match>
253 <match>Buffer I/O error on device fd0, logical block 0</match>
254 <description>Invalid request to /dev/fd0 (bug on the kernel).</description>
257 <rule id="5106" level="0">
258 <if_sid>5100</if_sid>
259 <match>svc: unknown program 100227 (me 100003)</match>
260 <description>NFS incompability between Linux and Solaris.</description>
263 <rule id="5107" level="0">
264 <if_sid>5100</if_sid>
265 <match>svc: bad direction </match>
266 <description>NFS incompability between Linux and Solaris.</description>
269 <rule id="5108" level="12">
270 <if_sid>5100</if_sid>
271 <match>Out of Memory: </match>
272 <description>System running out of memory. </description>
273 <description>Availability of the system is in risk.</description>
274 <group>service_availability,</group>
277 <rule id="5109" level="4">
278 <if_sid>5100</if_sid>
279 <match>I/O error: dev |end_request: I/O error, dev</match>
280 <description>Kernel Input/Output error</description>
283 <rule id="5110" level="4">
284 <if_sid>5100</if_sid>
285 <match>Forged DCC command from</match>
286 <description>IRC misconfiguration</description>
289 <rule id="5111" level="0">
290 <if_sid>5100</if_sid>
291 <match>ipw2200: Firmware error detected.</match>
292 <description>Kernel device error.</description>
295 <rule id="5112" level="0">
296 <if_sid>5100</if_sid>
297 <match>usbhid: probe of</match>
298 <description>Kernel usbhid probe error (ignored).</description>
301 <rule id="5113" level="7">
302 <if_sid>5100</if_sid>
303 <match>Kernel log daemon terminating</match>
304 <group>system_shutdown,</group>
305 <description>System is shutting down.</description>
308 <rule id="5130" level="7">
309 <if_sid>5100</if_sid>
310 <match>ADSL line is down</match>
311 <description>Monitor ADSL line is down.</description>
314 <rule id="5131" level="3">
315 <if_sid>5100</if_sid>
316 <match>ADSL line is up</match>
317 <description>Monitor ADSL line is up.</description>
320 <rule id="5200" level="0">
321 <match>^hpiod: unable to ParDevice</match>
322 <description>Ignoring hpiod for producing useless logs.</description>
324 </group> <!-- SYSLOG,LINUXKERNEL -->
328 <!-- Cron messages -->
329 <group name="syslog,cron,">
330 <rule id="2830" level="0">
331 <program_name>crond|crontab</program_name>
332 <description>Crontab rule group.</description>
335 <rule id="2831" level="0">
336 <if_sid>2830</if_sid>
337 <match>^unable to exec</match>
338 <description>Wrong crond configuration</description>
341 <rule id="2834" level="5">
342 <if_sid>2830</if_sid>
343 <match>BEGIN EDIT</match>
344 <description>Crontab opened for editing.</description>
347 <rule id="2832" level="5">
348 <if_sid>2830</if_sid>
349 <match>REPLACE</match>
350 <description>Crontab entry changed.</description>
353 <rule id="2833" level="8">
354 <if_sid>2832</if_sid>
355 <match>^(root)</match>
356 <description>Root's crontab entry changed.</description>
359 </group> <!-- SYSLOG,CRON -->
364 <group name="syslog, su,">
365 <rule id="5300" level="0" noalert="1">
366 <decoded_as>su</decoded_as>
367 <description>Initial grouping for su messages.</description>
370 <rule id="5301" level="5">
371 <if_sid>5300</if_sid>
372 <match>authentication failure; |failed|BAD su|^-| - </match>
373 <description>User missed the password to change UID (user id).</description>
374 <group>authentication_failed,</group>
377 <rule id="5302" level="9">
378 <if_sid>5301</if_sid>
380 <description>User missed the password to change UID to root.</description>
381 <group>authentication_failed,</group>
384 <rule id="5303" level="3">
385 <if_sid>5300</if_sid>
386 <regex>session opened for user root|^'su root'|</regex>
387 <regex>^+ \S+ \S+\proot$|^\S+ to root on|^SU \S+ \S+ + \S+ \S+-root$</regex>
388 <description>User successfully changed UID to root.</description>
389 <group>authentication_success,</group>
392 <rule id="5304" level="3">
393 <if_sid>5300</if_sid>
394 <regex>session opened for user|succeeded for|</regex>
395 <regex>^+|^\S+ to |^SU \S+ \S+ + </regex>
396 <description>User successfully changed UID.</description>
397 <group>authentication_success,</group>
400 <rule id="5305" level="4">
401 <if_sid>5303, 5304</if_sid>
403 <options>alert_by_email</options>
404 <description>First time (su) is executed by user.</description>
406 </group> <!-- SYSLOG,SU -->
410 <!-- Tripwire messages -->
411 <group name="syslog,tripwire,">
412 <rule id="7101" level="8">
413 <match>Integrity Check failed: File could not</match>
414 <description>Problems with the tripwire checking</description>
416 </group> <!-- SYSLOG,TRIPWIRE -->
420 <!-- Adduser messages -->
421 <group name="syslog,adduser">
422 <rule id="5901" level="8">
423 <match>^new group</match>
424 <description>New group added to the system</description>
427 <rule id="5902" level="8">
428 <match>^new user|^new account added</match>
429 <description>New user added to the system</description>
432 <rule id="5903" level="2">
433 <match>^delete user|^account deleted|^remove group</match>
434 <description>Group (or user) deleted from the system</description>
437 <rule id="5904" level="8">
438 <match>^changed user</match>
439 <description>Information from the user was changed</description>
441 </group> <!-- SYSLOG,ADDUSER -->
445 <!-- Sudo messages -->
446 <group name="syslog,sudo">
447 <rule id="5400" level="0" noalert="1">
448 <decoded_as>sudo</decoded_as>
449 <description>Initial group for sudo messages</description>
452 <rule id="5401" level="10">
453 <if_sid>5400</if_sid>
454 <match>3 incorrect password attempts</match>
455 <description>Three failed attempts to run sudo</description>
458 <rule id="5402" level="3">
459 <if_sid>5400</if_sid>
460 <match> ; USER=root ; COMMAND=</match>
461 <description>Successful sudo to ROOT executed</description>
464 <rule id="5403" level="4">
465 <if_sid>5400</if_sid>
466 <options>alert_by_email</options>
468 <description>First time user executed sudo.</description>
470 </group> <!-- SYSLOG, SUDO -->
473 <!-- PPTP messages -->
474 <group name="syslog,pptp">
475 <rule id="9100" level="0" noalert="1">
476 <program_name>^pptpd</program_name>
477 <description>PPTPD messages grouped</description>
480 <rule id="9101" level="0">
481 <if_sid>9100</if_sid>
482 <regex>^GRE: \S+ from \S+ failed: status = -1 </regex>
483 <description>PPTPD failed message (communication error)</description>
484 <info type="link">http://poptop.sourceforge.net/dox/gre-protocol-unavailable.phtml</info>
487 <rule id="9102" level="0">
488 <if_sid>9100</if_sid>
489 <match>^tcflush failed: Bad file descriptor</match>
490 <description>PPTPD communication error</description>
497 <group name="syslog,fts,">
498 <rule id="10100" level="4">
499 <if_group>authentication_success</if_group>
500 <options>alert_by_email</options>
502 <group>authentication_success</group>
503 <description>First time user logged in.</description>
508 <group name="syslog,squid,">
509 <rule id="9200" level="0" noalert="1">
510 <program_name>^squid</program_name>
511 <description>Squid syslog messages grouped</description>
514 <rule id="9201" level="0">
515 <if_sid>9200</if_sid>
516 <match>^ctx: enter level|^sslRead|^urlParse: Illegal |</match>
517 <match>^httpReadReply: Request not yet |^httpReadReply: Excess data</match>
518 <description>Squid debug message</description>
523 <group name="syslog,dpkg,">
524 <rule id="2900" level="0">
525 <decoded_as>windows-date-format</decoded_as>
526 <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d \w+ </regex>
527 <description>Dpkg (Debian Package) log.</description>
530 <rule id="2901" level="3">
531 <if_sid>2900</if_sid>
532 <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d install</regex>
533 <description>New dpkg (Debian Package) requested to install.</description>
536 <rule id="2902" level="7">
537 <if_sid>2900</if_sid>
538 <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d status installed</regex>
539 <description>New dpkg (Debian Package) installed.</description>
540 <group>config_changed,</group>
543 <rule id="2903" level="7">
544 <if_sid>2900</if_sid>
545 <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d remove|</regex>
546 <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d purge</regex>
547 <description>Dpkg (Debian Package) removed.</description>
548 <group>config_changed,</group>
553 <group name="syslog,yum,">
554 <rule id="2930" level="0">
555 <program_name>^yum</program_name>
556 <description>Yum logs.</description>
559 <rule id="2931" level="0">
560 <hostname>yum.log$</hostname>
561 <match>^Installed|^Updated|^Erased</match>
562 <description>Yum logs.</description>
565 <rule id="2932" level="7">
566 <if_sid>2930,2931</if_sid>
567 <match>^Installed</match>
568 <group>config_changed,</group>
569 <description>New Yum package installed.</description>
572 <rule id="2933" level="7">
573 <if_sid>2930,2931</if_sid>
574 <match>^Updated</match>
575 <group>config_changed,</group>
576 <description>Yum package updated.</description>
579 <rule id="2934" level="7">
580 <if_sid>2930,2931</if_sid>
581 <match>^Erased</match>
582 <group>config_changed,</group>
583 <description>Yum package deleted.</description>