Not exactly sure if this is the right place to post this, but it took me some time to get working decodes for Microsoft's Azure Multi-Factor Authentication (PhoneFactor.net).
It's pretty cool multifactor authentication for on-prem RDP Gateway and OWA using your phone as the second factor. This was my first attempt to create my own decodes for an app that wasn't supported by OSSEC. OSSEC is so cool that I wanted to share these with others incase there might be one or two of you out there that could benefit. We're not using the APP or voice calls, but it shouldn't be to hard with the info below to setup the rest of the options for those. You could have the agent monitor the log files, or setup syslog inside the PhoneFactor app. I opted for syslog messages. And let me know if I'm posting in the wrong place, have an error in my decodes, or anything else helpful. Thanks! --- add the following to local_decoder.xml <decoder name="pfsvc-authentication"> <parent>pfsvc-auth</parent> <regex offset="after_parent">Pfauth \w+ for user '(\S+)'. Call status: (\S+) - "\w+\s+\w+|\w+\s+\w+\s+\w+\.".</regex> <order>srcuser, status</order> </decoder> then add the following to local_rules.xml (tailor to your specific needs). <group name="syslog,pfauth,"> <rule id="100140" level="0"> <decoded_as>pfsvc-auth</decoded_as> <description>Phone Factor Authentication app group.</description> </rule> <rule id="100141" level="10"> <if_sid>100140</if_sid> <match>FAILED_SMS_OTP_INCORRECT</match> <description>User Failed SMS Challenge/Response</description> </rule> </group> --end local_rules.xml -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
