X-Git-Url: http://ftp.carnet.hr/pub/carnet-debian/scm?a=blobdiff_plain;f=etc%2Frules%2Fasterisk_rules.xml;h=9ad97159b9859b447127bef3ee7087b7c824109f;hb=HEAD;hp=3582766673ee870194df7b1d2ef2105eb6da96f8;hpb=301048b51990573e58a30dc4a5bb4ec285cad554;p=ossec-hids.git

diff --git a/etc/rules/asterisk_rules.xml b/etc/rules/asterisk_rules.xml
old mode 100755
new mode 100644
index 3582766..9ad9715
--- a/etc/rules/asterisk_rules.xml
+++ b/etc/rules/asterisk_rules.xml
@@ -1,4 +1,5 @@
-<!-- @(#) $Id$
+<!-- @(#) $Id: ./etc/rules/asterisk_rules.xml, 2011/09/08 dcid Exp $
+
   -  Official Asterisk rules for OSSEC.
   -
   -  Copyright (C) 2009 Trend Micro Inc.
@@ -76,7 +77,53 @@
     <same_source_ip />
     <description>Extension enumeration.</description>
   </rule>
-  
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <!--http://sysbrain.wordpress.com/2010/05/24/asterisk-ossec-part-ii/-->
+  <rule id="6253" level="5">
+    <if_sid>6201</if_sid>
+    <match>No registration for peer</match>
+    <description>Login session failed (invalid iax user).</description>
+    <group>invalid_login,</group>
+  </rule>
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <rule id="6254" level="10" frequency="3" timeframe="300">
+    <if_matched_sid>6253</if_matched_sid>
+    <same_source_ip />
+    <description>Extension IAX Enumeration.</description>
+  </rule>
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <rule id="6255" level="5">
+    <if_sid>6202</if_sid>
+    <match>Don't know how to respond via</match>
+    <description>Possible Registration Hijacking.</description>
+    <group>invalid_login,</group>
+  </rule>
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <rule id="6256" level="5">
+    <if_sid>6201</if_sid>
+    <match>failed MD5 authentication</match>
+    <description>IAX peer Wrong Password.</description>
+    <group>invalid_login,</group>
+  </rule>
+
+  <!--From Javi Benito jabi.benito@gmail.com-->
+  <rule id="6257" level="10" frequency="3" timeframe="300">
+    <if_matched_sid>6256</if_matched_sid>
+    <same_source_ip />
+    <description>Multiple failed logins.</description>
+  </rule>
+
+  <rule id="6258" level="5">
+    <if_sid>6201</if_sid>
+    <match>No matching peer found|extension not found in context</match>
+    <description>Login session failed (invalid extension).</description>
+    <group>invalid_login,</group>
+  </rule>
+
 </group> <!-- ASTERISK -->
 
 <!-- EOF -->