root@ossec:/var/ossec/logs/archives# cat /var/ossec/rules/local_rules.xml 

<!-- @(#) $Id: local_rules.xml,v 1.7 2010/03/04 20:12:33 dcid Exp $
  -  Example of local rules for OSSEC.
  -
  -  Copyright (C) 2009 Trend Micro Inc.
  -  All rights reserved.
  -
  -  This program is a free software; you can redistribute it
  -  and/or modify it under the terms of the GNU General Public
  -  License (version 2) as published by the FSF - Free Software
  -  Foundation.
  -
  -  License details: http://www.ossec.net/en/licensing.html
  -->

<!-- Modify it at your will. -->

<group name="local,syslog,">

  <!-- Note that rule id 5711 is defined at the ssh_rules file
    -  as a ssh failed login. This is just an example
    -  since ip 1.1.1.1 shouldn't be used anywhere.
    -  Level 0 means ignore.
    -->
  <rule id="100001" level="0">
    <if_sid>5711</if_sid>
    <srcip>1.1.1.1</srcip>
    <description>Example of rule that will ignore sshd </description>
    <description>failed logins from IP 1.1.1.1.</description>
  </rule>

  <rule id="100018" level="7">
   <if_group>syscheck,</if_group>
   <regex>Permissions changed from ‘\D+’ to ‘\D\D\D\D\D\D\Dw\D’</regex>
   <description>World-writable File</description>
  </rule>

  <rule id="100019" level="0">
   <if_sid>100018</if_sid>
   <regex>Permissions changed from ‘\D\D\D\D\D\D\Dw\D’ to ‘\D+’</regex>
   <description>World-writable File</description>
  </rule>

  <!-- This example will ignore ssh failed logins for the user name XYZABC.
    -->
  <!--  
  <rule id="100020" level="0">
    <if_sid>5711</if_sid>
    <user>XYZABC</user>
    <description>Example of rule that will ignore sshd </description>
    <description>failed logins for user XYZABC.</description>
  </rule>
  -->

  <!-- Specify here a list of rules to ignore. -->
  <!--
  <rule id="100030" level="0">
    <if_sid>12345, 23456, xyz, abc</if_sid>
    <description>List of rules to be ignored.</description>
  </rule>
  -->

 <rule id="510000" level="7">
   <if_sid>530</if_sid>
   <match>ossec: output: 'netstat -tan |grep LISTEN</match>
   <check_diff />
   <description>Listened ports have changed.</description>
 </rule>

 <rule id="510001" level="7">
   <if_sid>530</if_sid>
   <match>ossec: output: 'awk -F: \'($2 == "") {print}' /etc/shadow</match>
   <check_diff />
   <description>An empty password has been found.</description>
 </rule>

 <rule id="510002" level="7">
   <if_sid>530</if_sid>
   <match>ossec: output: 'awk -F: \'($3 == "0") {print}' /etc/passwd</match>
   <check_diff />
   <description>A user with the UID of 0 has been found.</description>
 </rule>

 <rule id="510003" level="7">
   <if_sid>530</if_sid>
   <match>ossec: output: ‘rpm -qa' </match>
   <check_diff />
   <description>Changes have been made to the RPM database</description>
 </rule>

 <rule id="510004" level="7">
   <if_sid>530</if_sid>
   <match>ossec: output: ‘find / -user root' </match>
   <check_diff />
   <description>SUID root binaries have been changed</description>
 </rule>

 <rule id="510005" level="7">
   <if_sid>530</if_sid>
   <match>ossec: output: ‘/sbin/chkconfig </match>
   <check_diff />
   <description>The system start up services have changed</description>
 </rule>

   
</group> <!-- SYSLOG,LOCAL -->