I fallowed this article (http://www.ossec.net/dcid/?p=199) but i don't
get any alerts and folder /var/ossec/queue/diff is empty.
1. On Windows agent i've added this code at the end of ossec.conf
file:
<ossec_config>
<localfile>
<log_format>full_command</log_format>
<command>reg QUERY HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR</
command>
</localfile>
</ossec_config>
(from log file i can see that monitoring has started): ossec-agent:
INFO: Monitoring full output of command(360): reg QUERY HKLM\SYSTEM
\CurrentControlSet\Enum\USBSTOR)
2. On Ossec server i've added this rule in the /var/ossec/rules/
local_rules.xml:
<rule id="140125" level="7">
<if_sid>530</if_sid>
<match>ossec: ouput: 'reg QUERY</match>
<check_diff />
<description>New USB device connected</description>
</rule>
And it's not working...What could be wrong?
What does number 530 stands for or SID?
<if_sid>530</if_sid>
Thanks
p.s.: here is VB script for monitoring usb storages for windows if
someone needs. The script is running in background (you can deploy it
through GPO as logon script):
Set OpSysSet = GetObject("winmgmts:\root\cimv2").ExecQuery("select *
from Win32_ComputerSystem")
For each i in OpSysSet
GetComputerName = i.Name
Next
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objOutFile = objFSO.OpenTextFile("\\server\logs\" &
GetComputerName & "usb.log", 8, True)
strComputer = "."
Set wmi = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set wmiEvent = wmi.ExecNotificationQuery("select * from
__InstanceOperationEvent within 1 where TargetInstance ISA
'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage
Device'")
While True
Set usb = wmiEvent.NextEvent()
Select Case usb.Path_.Class
Case "__InstanceCreationEvent" objOutFile.WriteLine Date & "-" & Time
& "-" & "USB device found"
Case "__InstanceDeletionEvent" objOutFile.WriteLine Date & "-" & Time
& "-" & "USB device removed"
Case "__InstanceModificationEvent" objOutFile.WriteLine Date & "-" &
Time & "-" & "USB device modified"
End Select
Wend
On Jun 12, 11:47 pm, Sébastien Duquette <[email protected]> wrote:
> I created those rules at work to detect insertion ofUSBkeys. On
> Windows, I created an audit object on the
> HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR registry key as described
> in the article. The high level of the alerts is because those rules
> are activated for servers, for which the use ofUSBdevice is highly
> suspicious.
>
> <rule id="100000" ignore="20" level="14">
> <if_group>syslog</if_group>
> <match>NewUSBdevice found</match>
> <description>USBstorage device detected. - Linux</description>
> </rule>
>
> <rule id="100001" ignore="20" level="14">
> <if_group>windows</if_group>
> <match>USBSTOR</match>
> <description>NewUSBstorage device detected. - Windows</description>
> </rule>
>
> On Fri, Jun 11, 2010 at 10:20 PM, Michael Starks
>
>
>
> <[email protected]> wrote:
> > On 06/10/2010 10:23 AM, Richard Geddes wrote:
>
> >> Can ossec detect changes in the devices that are connected to the host?
> >> Maybe through the file integrity checker?
>
> >> For example, if someone plugs ausbmemory stick into a machine.
>
> > Yes. OSSEC can alert on the logs that get written when these events happen.
> > This is something relevant to your question:
> >http://www.ossec.net/dcid/?p=199
>
> > --
> > Michael Starks
> > [I] Immutable Security
> >http://www.immutablesecurity.com
