1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
#####
#
# Copyright (C) 2002 Arnaud Guignard
# This ruleset is currently maintained by Dennis Hadderingh
# <dennis.hadderingh@is-company.nl>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING. If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
#
#####
# Cisco router support for Prelude-LML
#LOG:Sep 23 07:30:41 gate 301270: 5d17h: %SEC-6-IPACCESSLOGP: list 101 denied tcp 1.2.3.4(1929) -> 5.6.7.8(80), 1 packet
regex=SEC-6-IPACCESSLOGP: list (\d+) denied (udp|tcp) ([\d\.]+)\((\d+)\).*-> ([\d\.]+)\((\d+)\), (\d+); \
classification.text=Packet denied; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%SEC-6-IPACCESSLOGP; \
classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapter09186a00800f71b0.html; \
id=500; \
revision=2; \
analyzer(0).name=Router; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Router; \
assessment.impact.completion=failed; \
assessment.impact.type=other; \
assessment.impact.severity=medium; \
assessment.impact.description=Someone tried to bypass access-list #$1; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$3; \
source(0).service.port=$4; \
source(0).service.iana_protocol_name=$2; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address=$5; \
target(0).service.port=$6; \
target(0).service.iana_protocol_name=$2; \
additional_data(0).type=string; \
additional_data(0).meaning=ACL; \
additional_data(0).data=$1; \
additional_data(1).type=integer; \
additional_data(1).meaning=Events; \
additional_data(1).data=$6; \
last
#LOG:Apr 11 20:13:49 wormhole.flash.net 2279: %RCMD-4-RSHPORTATTEMPT: Attempted to connect to RSHELL from 1.2.3.4
regex=RCMD-4-RSHPORTATTEMPT:.* from ([\d\.]+); \
classification.text=RSH attempt; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%RCMD-4-RSHPORTATTEMPT; \
classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapter09186a00800f71b0.html; \
id=501; \
revision=2; \
analyzer(0).name=Router; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Router; \
assessment.impact.completion=failed; \
assessment.impact.type=other; \
assessment.impact.severity=medium; \
assessment.impact.description=Someone tried to connect to rshell; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$1; \
target(0).service.name=rsh; \
last
# Copyright (C) 2004 Dennis Hadderingh <dennis.hadderingh@is-company.nl>
# All Rights Reserved
#LOG:Jun 1 13:59:17 rtr-dsl-01 3972256: 5w5d: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to down
regex=%LINEPROTO-5-UPDOWN: Line protocol on Interface (\S+), changed state to (down|up); \
classification.text=Interface $2; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%LINEPROTO-5-UPDOWN; \
classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapter09186a00800f71b0.html; \
id=502; \
revision=2; \
analyzer(0).name=Router; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Router; \
assessment.impact.completion=succeeded; \
assessment.impact.type=dos; \
assessment.impact.severity=medium; \
assessment.impact.description=Interface $1 status changed to $2; \
target(0).interface=$1; \
additional_data(0).type=string; \
additional_data(0).meaning=New state; \
additional_data(0).data=$2; \
last
# Match if a host has requested an unknown key exchange
#LOG:Jun 1 15:20:39 rtr-dsl-01 3972364: 5w5d: %CRYPTO-6-IKMP_UNK_EXCHANGE: IKE peer at 1.1.1.1 sent a message with unknown exchange 1
regex=%CRYPTO-6-IKMP_UNK_EXCHANGE: IKE peer at (\S+) * sent a message with unknown; \
classification.text=Router unknown IKE key exchange request; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=cisco_id; \
classification.reference(0).name=%CRYPTO-6-IKMP_UNK_EXCHANGE; \
classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapter09186a00800f71b0.html; \
id=503; \
revision=2; \
analyzer(0).name=Router; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Router; \
assessment.impact.completion=failed; \
assessment.impact.type=other; \
assessment.impact.severity=high; \
assessment.impact.description=An unknown Internet Key Exchange request has been received from host: $1 ; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$1; \
target(0).service.port=500; \
target(0).service.name=isakmp; \
last
|
