I created those rules at work to detect insertion of USB keys. On
Windows, I created an audit object on the
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR registry key as described
in the article. The high level of the alerts is because those rules
are activated for servers, for which the use of USB device is highly
suspicious.
<rule id="100000" ignore="20" level="14">
<if_group>syslog</if_group>
<match>New USB device found</match>
<description>USB storage device detected. - Linux</description>
</rule>
<rule id="100001" ignore="20" level="14">
<if_group>windows</if_group>
<match>USBSTOR</match>
<description>New USB storage device detected. - Windows</description>
</rule>
On Fri, Jun 11, 2010 at 10:20 PM, Michael Starks
<[email protected]> wrote:
> On 06/10/2010 10:23 AM, Richard Geddes wrote:
>>
>> Can ossec detect changes in the devices that are connected to the host?
>> Maybe through the file integrity checker?
>>
>> For example, if someone plugs a usb memory stick into a machine.
>
> Yes. OSSEC can alert on the logs that get written when these events happen.
> This is something relevant to your question:
> http://www.ossec.net/dcid/?p=199
>
> --
> Michael Starks
> [I] Immutable Security
> http://www.immutablesecurity.com
>
