I'm believing this may have something to do with the default decoder, and
wondering if I need to create an updated one for Windows 2008.
I have rule 18152 firing for Sophos users across my network. These systems
are not on the same domain thus the Sophos user is different for each
system.
I have created a rule in local.rules.xml using the sif_id of 18152 like
this:
<group name="windows,security,">
<rule id="100102" level="0">
<if_sid>18152</if_sid>
<group>authentication_failures,</group>
<match>SOPHOSSA|SophosCUST01VM01|SophosCUST02VM02|SophosCUST03VM03|SophosCUST04VM04</match>
<description>Ignoring Sophos Logins</description>
</rule>
</group>
This is the original rule - which is a composite rule. So I don't know that
a rule in local_rules.xml is really going to have any effect since OSSEC is
simply counting failed logins, not really identifying each failed login.
<rule id="18152" level="10" frequency="$MS_FREQ" timeframe="240">
<if_matched_group>win_authentication_failed</if_matched_group>
<description>Multiple Windows Logon Failures.</description>
<group>authentication_failures,</group>
</rule>
I decided I would look at the decoder, which looks like this:
WinEvtLog: Security: AUDIT_FAILURE(0x00000211): Security:
SYSTEM: NT AUTHORITY: Logon Failure: Reason: Unknown user
name or bad password User Name: ab Domain: cd
Logon Type: 2 Logon Process: User32 Authentication
Package: Negotiate Workstation Name: ad
<decoder name="windows">
<type>windows</type>
<prematch>^WinEvtLog: </prematch>
<regex offset="after_prematch">^\.+: (\w+)\((\d+)\): (\.+): </regex>
<regex>(\.+): \.+: (\S+): </regex>
<order>status, id, extra_data, user, system_name</order>
<fts>name, location, user, system_name</fts>
</decoder>
And see if I could make a rule based off the information there by matching
it against the log the OSSEC is showing in the alerts I'm receiving.
This is the log:
WinEvtLog: Security: AUDIT_FAILURE(4625):
Microsoft-Windows-Security-Auditing: (no user): no domain:
test.omitted.net: An account failed to log on. Subject: Security ID:
S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon
Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0 Account
Name: SophosCUST01VM01 Account Domain: <OMITTED> Failure Information:
Failure Reason: %%2313 Status: 0xc000006d Sub Status: 0xc000006a
Process Information: Caller Process ID: 0x0 Caller Process Name: -
Network Information: Workstation Name: CLIENT01 Source Network Address:
10.1.1.2 Source Port: 50210 Detailed Authentication Information: Logon
Process: NtLmSsp Authentication Package: NTLM Transited Services: -
Package Name (NTLM only): - Key Length: 0 This event is generated when a
logon request fails. It is generated on the computer where access was
attempted.
Now if you notice the first occurrence of Account Name and Account Domain
are empty. They are only populated in the next occurrence of these same
fields later in the log.
My first question is - Should OSSEC be sending logs with these fields
duplicated in that manner?
Next Question is since I'm a newb at Regex - I only know a little bit - is
it matching on that first occurrence, thus it's not correctly decoding the
"real" information located later in the log?
Any help is appreciated!
Thanks!
Aixia
