1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
# Sagan windows-mssql.rules
# Copyright (c) 2009-2017, Quadrant Information Security <www.quadrantsec.com>
# All rights reserved.
#
# Please submit any custom rules or ideas to sagan-submit@quadrantsec.com or the sagan-sigs mailing list
#
#*************************************************************
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
# following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
# disclaimer.
# * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
# following disclaimer in the documentation and/or other materials provided with the distribution.
# * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#*************************************************************
# Windows based rules.
# Eventlog to syslog service. This is what we primarily use.
# http://code.google.com/p/eventlog-to-syslog/
# MSSQL$SERVER| 18456: Login failed for user 'DOMAIN\user'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors. [CLIENT: <local machine>]
# MSSQL$XXX| 18453: Login succeeded for user 'DOMAIN\user'. Connection: trusted. [CLIENT: <local machine>]
# MSSQLSERVER| 18456: Login failed for user 'BOB'. Reason: Failed to open the explicitly specified database. [CLIENT: 10.5.5.6]
# |MSSQLSERVER| 19030: SQL Trace ID 2 was started by login "DOMAIN\user".
# MSSQLSERVER| 19031: SQL Trace stopped. Trace ID = '2'. Login Name = 'DOMAIN\user'.
# MSSQL$XXX| 833: SQL Server has encountered 1 occurrence(s) of I/O requests taking longer than 15 seconds to complete on file [E:\\Data\test.mdf] in database [<Database name is not available>] (17). The OS file handle is 0x0000000000000AF8. The offset of the latest long I/O is: 0x0000003a7a0000
# |MSSQLSERVER| 18451: Login failed for user 'DOMAIN\users'. Only administrators may connect at this time. [CLIENT: 10.1.6.1]
# |MSSQLSERVER| 26022: Server is listening on
# MSSQLSERVER| 18452: Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. [CLIENT: 10.1.3.9]
# MSSQLSERVER| 17147: SQL Server is terminating because of a system shutdown. This is an informational message only. No user action is required.
# 17162: SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-MSSQL] Login Failure"; content: " 18456|3a| "; default_proto: tcp; default_dst_port: $MSSQL_PORT; classtype: unsuccessful-user; program: MSSQL*|Application; reference: url,wiki.quadrantsec.com/bin/view/Main/5001640; sid: 5001640; rev:6;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-MSSQL] Login Failure - Brute force [25/1]"; content: " 18456|3a| "; content:!"local machine"; content:!"named pipe"; parse_src_ip: 1; default_proto: tcp; default_dst_port: $MSSQL_PORT; classtype: unsuccessful-user; program: MSSQL*|Application; xbits: set,brute_force,21600; after: track by_src, count 25, seconds 300; threshold: type limit, track by_src, count 1, seconds 86400; fwsam: src, 1 day; reference: url,wiki.quadrantsec.com/bin/view/Main/5001641; sid: 5001641; rev:13;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-MSSQL] Login Failure from non-trusted connection - Brute force [25/1]"; content: " 18452|3a| "; parse_src_ip: 1; default_proto: tcp; default_dst_port: $MSSQL_PORT; classtype: unsuccessful-user; program: MSSQL*|Application; xbits: set,brute_force,21600; after: track by_src, count 25, seconds 300; threshold: type limit, track by_src, count 1, seconds 86400; fwsam: src, 1 day; reference: url,wiki.quadrantsec.com/bin/view/Main/5002402; sid:5002402; rev:4;)
|
