On Wed, May 9, 2012 at 5:07 PM, Aixia <[email protected]> wrote:
> I'm believing this may have something to do with the default decoder, and
> wondering if I need to create an updated one for Windows 2008.
>
> I have rule 18152 firing for Sophos users across my network. These systems
> are not on the same domain thus the Sophos user is different for each
> system.
> I have created a rule in local.rules.xml using the sif_id of 18152 like
> this:
>
> <group name="windows,security,">
> <rule id="100102" level="0">
> <if_sid>18152</if_sid>
> <group>authentication_failures,</group>
>
> <match>SOPHOSSA|SophosCUST01VM01|SophosCUST02VM02|SophosCUST03VM03|SophosCUST04VM04</match>
> <description>Ignoring Sophos Logins</description>
> </rule>
> </group>
>
> This is the original rule - which is a composite rule. So I don't know that
> a rule in local_rules.xml is really going to have any effect since OSSEC is
> simply counting failed logins, not really identifying each failed login.
>
> <rule id="18152" level="10" frequency="$MS_FREQ" timeframe="240">
> <if_matched_group>win_authentication_failed</if_matched_group>
> <description>Multiple Windows Logon Failures.</description>
> <group>authentication_failures,</group>
> </rule>
>
>
> I decided I would look at the decoder, which looks like this:
>
> WinEvtLog: Security: AUDIT_FAILURE(0x00000211): Security:
> SYSTEM: NT AUTHORITY: Logon Failure: Reason: Unknown user
> name or bad password User Name: ab Domain: cd
> Logon Type: 2 Logon Process: User32 Authentication
> Package: Negotiate Workstation Name: ad
>
> <decoder name="windows">
> <type>windows</type>
> <prematch>^WinEvtLog: </prematch>
> <regex offset="after_prematch">^\.+: (\w+)\((\d+)\): (\.+): </regex>
> <regex>(\.+): \.+: (\S+): </regex>
> <order>status, id, extra_data, user, system_name</order>
> <fts>name, location, user, system_name</fts>
> </decoder>
>
> And see if I could make a rule based off the information there by matching
> it against the log the OSSEC is showing in the alerts I'm receiving.
>
> This is the log:
>
> WinEvtLog: Security: AUDIT_FAILURE(4625):
> Microsoft-Windows-Security-Auditing: (no user): no domain: test.omitted.net:
> An account failed to log on. Subject: Security ID: S-1-0-0 Account Name:
> - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which
> Logon Failed: Security ID: S-1-0-0 Account Name: SophosCUST01VM01
> Account Domain: <OMITTED> Failure Information: Failure Reason: %%2313
> Status: 0xc000006d Sub Status: 0xc000006a Process Information: Caller
> Process ID: 0x0 Caller Process Name: - Network Information: Workstation
> Name: CLIENT01 Source Network Address: 10.1.1.2 Source Port: 50210
> Detailed Authentication Information: Logon Process: NtLmSsp
> Authentication Package: NTLM Transited Services: - Package Name (NTLM
> only): - Key Length: 0 This event is generated when a logon request
> fails. It is generated on the computer where access was attempted.
>
> Now if you notice the first occurrence of Account Name and Account Domain
> are empty. They are only populated in the next occurrence of these same
> fields later in the log.
> My first question is - Should OSSEC be sending logs with these fields
> duplicated in that manner?
> Next Question is since I'm a newb at Regex - I only know a little bit - is
> it matching on that first occurrence, thus it's not correctly decoding the
> "real" information located later in the log?
>
> Any help is appreciated!
>
> Thanks!
>
> Aixia
# cat /tmp/xxx | /var/ossec/bin/ossec-logtest
2012/05/10 14:01:07 ossec-testrule: INFO: Reading decoder file etc/decoder.xml.
2012/05/10 14:01:07 ossec-testrule: INFO: Reading decoder file
etc/local_decoder.xml.
2012/05/10 14:01:07 ossec-testrule: INFO: Reading decoder file
etc/wip/nsd_decoder.xml.
2012/05/10 14:01:07 ossec-testrule: INFO: Reading loading the lists
file: 'lists/blocked.txt.cdb'
2012/05/10 14:01:07 ossec-testrule: INFO: Reading loading the lists
file: 'lists/userlist.txt.cdb'
2012/05/10 14:01:07 ossec-testrule: INFO: Started (pid: 20319).
ossec-testrule: Type one log per line.
**Phase 1: Completed pre-decoding.
full event: 'WinEvtLog: Security: AUDIT_FAILURE(4625):
Microsoft-Windows-Security-Auditing: (no user): no domain:
test.omitted.net: An account failed to log on. Subject: Security ID:
S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon
Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0
Account Name: SophosCUST01VM01 Account Domain: <OMITTED> Failure
Information: Failure Reason: %%2313 Status: 0xc000006d Sub
Status: 0xc000006a Process Information: Caller Process ID: 0x0
Caller Process Name: - Network Information: Workstation Name:
CLIENT01 Source Network Address: 10.1.1.2 Source Port: 50210
Detailed Authentication Information: Logon Process: NtLmSsp
Authentication Package: NTLM Transited Services: - Package Name
(NTLM only): - Key Length: 0 This event is generated when a logon
request fails. It is generated on the computer where access was
attempted.'
hostname: 'ix'
program_name: '(null)'
log: 'WinEvtLog: Security: AUDIT_FAILURE(4625):
Microsoft-Windows-Security-Auditing: (no user): no domain:
test.omitted.net: An account failed to log on. Subject: Security ID:
S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon
Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0
Account Name: SophosCUST01VM01 Account Domain: <OMITTED> Failure
Information: Failure Reason: %%2313 Status: 0xc000006d Sub
Status: 0xc000006a Process Information: Caller Process ID: 0x0
Caller Process Name: - Network Information: Workstation Name:
CLIENT01 Source Network Address: 10.1.1.2 Source Port: 50210
Detailed Authentication Information: Logon Process: NtLmSsp
Authentication Package: NTLM Transited Services: - Package Name
(NTLM only): - Key Length: 0 This event is generated when a logon
request fails. It is generated on the computer where access was
attempted.'
**Phase 2: Completed decoding.
decoder: 'windows'
status: 'AUDIT_FAILURE'
id: '4625'
extra_data: 'Microsoft-Windows-Security-Auditing'
dstuser: '(no user)'
system_name: 'test.omitted.net'
**Phase 3: Completed filtering (rules).
Rule id: '18106'
Level: '5'
Description: 'Windows Logon Failure.'
**Alert to be generated.
Stop the chain before it gets to the composite rule:
<rule id="100361" level="0">
<if_sid>18106</if_sid>
<match>SOPHOSSA|SophosCUST01VM01|SophosCUST02VM02|SophosCUST03VM03|SophosCUST04VM04</match>
<description>Ignore Sophos</description>
</rule>
