#####
#
# Copyright (C) 2003 Vincent Glaume 
# Currently supported by G Ramon Gomez <gene at gomezbrothers dot com>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by 
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING.  If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
#
#####

#############################################################################
# 
# This ruleset aims at analyzing the logs returned by the ntsyslog 
# application, which converts NT events to syslog. 
# English logs only.
#
#############################################################################


###
# I. Security events
###

# 1. Success events
# 1.a 515
# No log sample; please submit
regex= security\[success\] 515 (.*) Logon Process Name:([\w\\]+); \
 classification.text=Windows Event ID [515]: Trusted logon process registration; \
 id=1400; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=$2 has registered as a trusted logon process; \
 source(0).process.name=$2; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 last

# 1.b 528
# No log sample; please submit
regex= security\[success\] 528 (.*) Successful Logon:  User Name:([\w ]+)  Domain:(.+)  Logon ID:\(.*\)  Logon Type:\d+  Logon Process:(\w+) .* Workstation Name:(\w+); \
 classification.text=Login successful; \
 id=1401; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=$2 successfully logged on on $5 ($3 domain) via $4; \
 source(0).node.address(0).category=unknown; \
 source(0).node.address(0).address=$5; \
 source(0).node.name=$5; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$2; \
 last

# 1.c 538
# LOG:Jun 24 15:22:39 bigipnet security[success] 538 NT AUTHORITY\ANONYMOUS LOGON User Logoff: User Name:ANONYMOUS LOGON Domain:NT AUTHORITY Logon ID:(0x0,0x938205) Logon Type:3 
regex=security\[success\] 538 (.*) User Logoff:\s+User Name:([\w ]+); \
 classification.text=Logoff; \
 id=1402; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=$2 logged off; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$2; \
 last

# 1.d 560
# No log sample; please submit
regex= security\[success\] 560 (.*)  Object Open:  Object Server:[\w\s]+  Object Type:[\w\_]+  Object Name:(\w+)  New Handle ID:\d+  Operation ID:.*  Process ID:(\d+)  Primary User Name:(.*)  Primary Domain:.+  Primary Logon ID:.*  Client User Name:([\w ]+); \
 classification.text=Windows Event ID [560]: Object open; \
 id=1403; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=$3 opened an object $2; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$4; \
 source(0).user.user_id(2).type=current-user; \
 source(0).user.user_id(2).name=$5; \
 source(0).process.pid=$3; \
 last

# 1.e 562
# No log sample; please submit
regex= security\[success\] 562 (.*) Handle Closed:  Object Server:[\w\s]+  Handle ID:(\d+)  Process ID:(\d+); \
 classification.text=Windows Event ID [562]: Handle closed; \
 id=1404; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Object Handle $2 closed; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 target(0).process.pid=$3; \
 last

# 1.f 576
# No log sample; please submit
regex= security\[success\] 576 (.*)  Special privileges assigned to new logon:  User Name:([\w ]+)  Domain:.+  Logon ID:\(.*\)  Assigned: ([\w\ ]+); \
 classification.text=Windows Event ID [576]: Privilege assigned to new logon; \
 id=1405; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=$2 got following privileges: $3; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$2; \
 last

# 1.g 577
# No log sample; please submit
regex= security\[success\] 577 (.*)  Privileged Service Called:  Server:.+  Service:(.*)  Primary User Name:([\w ]+)  Primary Domain:.+  Primary Logon ID:\(.*\)  Client User Name:(.+)  Client Domain:.+  Client Logon ID:.+  Privileges:(.+); \
 classification.text=Windows Event ID [577]: Privileged service called; \
 id=1406; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Service $2 called with the following privileges: $5; \
 source(0).user.category=os-device; \ 
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$3; \
 source(0).user.user_id(2).type=current-user; \
 source(0).user.user_id(2).name=$4; \
 target(0).node.address(0).category=unknown; \
 target(0).node.address(0).address=$2; \
 target(0).node.name=$2; \
 last

# 1.h
# No log sample; please submit
regex= security\[success\] 643 (.*)  Domain Policy Changed: Password Policy  modified  Domain:(.+)  Domain ID: .+  Caller User Name:(.+); \
 classification.text=Password policy modified; \
 id=1407; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=User $3 modified the password policy for the $2 domain; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$3; \
 last

# 1.i 680
# No log sample; please submit
regex= security\[success\] 680 (.*)  Account Used for Logon by: .+  Account Name: (.+)  Workstation: (.+); \
 classification.text=Login successful; \
 id=1408; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.type=user; \
 assessment.impact.description=Logon attempt on $3 using the $2 account; \
 source(0).node.address(0).category=unknown; \
 source(0).node.address(0).address=$3; \
 source(0).node.name=$3; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$2; \
 last

# 1.j 682
# No log sample; please submit
regex= security\[success\] 682 (.*)  Session reconnected to winstation:  User Name:([\w ]+)  Domain:.+  Logon ID:\(.+\)  Session Name:.+  Client Name:(.+)  Client Address:([\d\.]+); \
 classification.text=Windows Event ID [682]: Session reconnected to winstation; \
 id=1409; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Session reconnection from $5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).node.address(1).category=unknown; \
 source(0).node.address(1).address=$3; \
 source(0).node.name=$3; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$2; \
 last

# 1.k 683
# No log sample; please submit
regex= security\[success\] 683 (.*)  Session disconnected from winstation:  User Name:([\w ]+)  Domain:.+  Logon ID:\(.+\)  Session Name:.+  Client Name:(.+)  Client Address:([\d\.]+); \
 classification.text=Windows Event ID [683]: Session disconnected from winstation; \
 id=1410; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Session reconnection from $4; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).node.address(1).category=unknown; \
 source(0).node.address(1).address=$3; \
 source(0).node.name=$3; \
 source(0).user.user_id(0).type=target-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$2; \
 last

# 1.l other
# No log sample; please submit
#regex= security\[success\] (\d+); \
# classification.text=Windows Event ID [$1]; \
# id=1411; \
# revision=1; \
# analyzer(0).name=NTsyslog; \
# analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
# analyzer(0).class=Logging; \
# assessment.impact.severity=low; \
# assessment.impact.type=other; \
# assessment.impact.description=Security Success message with identifier #$1; \
# last


# 2. Failure events
# 2.a 529 or 534
# LOG:Dec 10 00:23:37 webbrain.itg.sac.tfs security[failure] 529 NT AUTHORITY\SYSTEM  Logon Failure:  Reason:Unknown user name or bad password  User Name:administrator  Domain:ITG  Logon Type:2  Logon Process:Advapi    Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  Workstation Name:WEBBRAIN
regex=security\[failure\] (529|534) (.+) Logon Failure:  Reason:(.+)  User Name:([\w ]+)  Domain:.+  Logon Type:\d+  Logon Process:\w+    Authentication Package:.+  Workstation Name:(.+); \
 classification.text=Login failure; \
 id=1412; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=medium; \
 assessment.impact.completion=failed; \
 assessment.impact.type=user; \
 assessment.impact.description=Logon as $4 failed: $3; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$2; \
 target(0).node.address(0).category=unknown; \
 target(0).node.address(0).address=$5; \
 target(0).node.name=$5; \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$4; \
 last

# 2.b 578
# LOG:Dec  9 17:42:49 testdb.itg.sac.tfs security[failure] 578 ITG\mzirion  Privileged object operation:  Object Server:Security  Object Handle:4294967295  Process ID:3540  Primary User Name:TESTDB$  Primary Domain:ITG  Primary Logon ID:(0x0,0x3E7)  Client User Name:mzirion  Client Domain:ITG  Client Logon ID:(0x2,0x5E829351)  Privileges:SeIncreaseBasePriorityPrivilege
regex= security\[failure\] 578 (.+) Privileged object operation:  Object Server:Security  Object Handle:\d+  Process ID:(\d+)  Primary User Name:(.+)  Primary Domain:.+  Primary Logon ID:\(.*\)  Client User Name:([\w ]+); \
 classification.text=Windows Event ID [578]: Privileged object operation; \
 id=1413; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=medium; \
 assessment.impact.type=user; \
 target(0).process.pid=$2; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$3; \
 source(0).user.user_id(2).type=current-user; \
 source(0).user.user_id(2).name=$4; \
 last

# 2.c 627
# LOG:Dec  7 20:07:49 testdb.itg.sac.tfs security[failure] 627 NT AUTHORITY\SYSTEM  Change Password Attempt:  Target Account Name:TsInternetUser  Target Domain:TESTDB  Target Account ID: %{S-1-5-21-854245398-413027322-725345543-1000}  Caller User Name:TESTDB$  Caller Domain:ITG  Caller Logon ID:(0x0,0x3E7)  Privileges:-
regex= security\[failure\] 627 (.+)  Change Password Attempt:  Target Account Name:(.+)  Target Domain:(.+)  Target Account ID:(.+)  Caller User Name:(.+); \
 classification.text=Windows Event ID [627]: Change password attempt; \
 id=1414; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=medium; \
 assessment.impact.type=user; \
 assessment.impact.description=$5 attempted to change the password for $2 on the $3 domain; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$5; \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$2; \
 last

# 2.d 681
# LOG:Dec 10 08:20:07 mrfreeze.itg.sac.tfs security[failure] 681 NT AUTHORITY\SYSTEM  The logon to account: tfslegalask@itg.sac.tfs  by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  from workstation: MRFREEZE  failed. The error code was: 3221225572
regex=security\[failure\] 681 (.+)  The logon to account: (\S+)  by:.+  from workstation: (\w+); \
 classification.text=Windows Event ID [681]: Logon failure; \
 id=1415; \
 revision=1; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=medium; \
 assessment.impact.completion=failed; \
 assessment.impact.type=user; \
 assessment.impact.description=Logon as $2 from $3 failed; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).node.address(0).category=unknown; \
 source(0).node.address(0).address=$3; \
 source(0).node.name=$3; \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$2; \
 last

# 2.e other
# No log sample; please submit
#regex= security\[failure\] (\d+); \
# classification.text=Windows Event ID [$1]; \
# id=1416; \
# revision=1; \
# analyzer(0).name=NTsyslog; \
# analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
# analyzer(0).class=Logging; \
# assessment.impact.severity=medium; \
# assessment.impact.type=other; \
# assessment.impact.description=Security Failure message with identifier #$1; \
# last