-
Notifications
You must be signed in to change notification settings - Fork 7
/
symantec-epm.rules
165 lines (157 loc) · 8.14 KB
/
symantec-epm.rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
#FULLNAME: Symantec EPM
#VERSION: 1.0
#DESCRIPTION: Symantec Endpoint Protection is an antivirus and personal firewall software for centrally managed corporate environments providing security for both servers and workstations.
#####
#
# Copyright (C) 2012 Seguridadx <operador@seguridadx.com>
# twitter: <www.twitter.com/seguridad_x>
# All Rights Reserved
#
# Copyright (C) 2014-2020 CS GROUP - France <support.prelude@csgroup.eu>
# All Rights Reserved.
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####
#DESCRIPTION:Allowed Messages
#CATEGORY:Update
#LOG:Dec 1 12:23:14 SymantecServer antivirus.example.com: Site: PLESSIS,Server: antivirus.example.com,Successfully downloaded the Virus and Spyware definitions
regex=SymantecServer \S+:; \
classification.reference(0).origin=vendor-specific; \
id=172000000; \
chained; silent; \
revision=1; \
analyzer(0).name=Symantec Antivirus; \
analyzer(0).manufacturer=www.symantec.com; \
analyzer(0).class=Antivirus
#DESCRIPTION:Symantec Virus and Spyware definitions have been updated
#CATEGORY:Update
#LOG:Dec 1 12:23:14 SymantecServer antivirus.example.com: Site: PLESSIS,Server: antivirus.example.com,Successfully downloaded the Virus and Spyware definitions
regex=Site: (\S+),Server: (\S+),Successfully downloaded the Virus and Spyware definitions; \
classification.text=Virus and Spyware definition update; \
id=172000100; \
revision=2; \
assessment.impact.severity=info; \
assessment.impact.type=other; \
assessment.impact.completion=succeeded; \
assessment.impact.description=Symantec Virus and Spyware definitions have been updated; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address=$2; \
additional_data(0).type=string; \
additional_data(0).meaning=Site Name; \
additional_data(0).data=$1; \
goto=172000000; \
last
#DESCRIPTION:SONAR definitions have been updated
#CATEGORY:Update
#LOG:Dec 1 12:23:14 SymantecServer antivirus.example.com: Site: PLESSIS,Server: antivirus.example.com,Successfully downloaded the SONAR
regex=Site: (\S+),Server: (\S+),Successfully downloaded the SONAR; \
classification.text=SONAR definition update; \
id=172000101; \
revision=2; \
assessment.impact.severity=info; \
assessment.impact.type=other; \
assessment.impact.completion=succeeded; \
assessment.impact.description=SONAR definitions have been updated; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address=$2; \
additional_data(0).type=string; \
additional_data(0).meaning=Site Name; \
additional_data(0).data=$1; \
goto=172000000; \
last
#DESCRIPTION:Intrusion Prevention signatures definitions have been updated
#CATEGORY:Update
#LOG:Dec 1 12:23:14 SymantecServer antivirus.example.com: Site: PLESSIS,Server: antivirus.example.com,Successfully downloaded the Intrusion Prevention signatures
regex=Site: (\S+),Server: (\S+),Successfully downloaded the Intrusion Prevention signatures; \
classification.text=Intrusion Prevention signatures definition update; \
id=172000102; \
revision=2; \
assessment.impact.severity=info; \
assessment.impact.type=other; \
assessment.impact.completion=succeeded; \
assessment.impact.description=Intrusion Prevention signatures definitions have been updated; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address=$2; \
additional_data(0).type=string; \
additional_data(0).meaning=Site Name; \
additional_data(0).data=$1; \
goto=172000000; \
last
#DESCRIPTION:Successfully downloaded the Revocation Data security definitions
#CATEGORY:Update
#LOG:Apr 9 10:47:33 SymantecServer antivirus.example.com: Site: PLESSIS,Server: antivirus.example.com,Successfully downloaded the Revocation Data security definitions from LiveUpdate
regex=Site: (\S+),Server: (\S+),Successfully downloaded the Revocation Data security definitions from LiveUpdate; \
classification.text=Revocation Data security definitions; \
id=172000103; \
revision=2; \
assessment.impact.severity=info; \
assessment.impact.type=other; \
assessment.impact.completion=succeeded; \
assessment.impact.description=Successfully downloaded the Revocation Data security definitions; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address=$2; \
additional_data(0).type=string; \
additional_data(0).meaning=Site Name; \
additional_data(0).data=$1; \
goto=172000000; \
last
#DESCRIPTION:Virus found
#CATEGORY:Malware
#LOG:Dec 12 17:07:08 SymantecServer antivirus.example.com: Virus found,Computer name: A01LTFW21052,Source: Real Time Scan,Risk name: W32.Downadup!autorun,Occurrences: 1,E:\autorun.inf,"",Actual action: Cleaned by deletion
regex=Virus found.+Computer name: (\S+),.+,Risk name: ([^,]+),Occurrences: (\d+),.+,Actual action: ([^,]+); \
classification.text=Virus found; \
id=172000104; \
revision=2; \
assessment.impact.severity=high; \
assessment.impact.type=file; \
assessment.impact.completion=succeeded; \
assessment.impact.description=Virus found, Computer name: $2; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address=$1; \
additional_data(0).type=string; \
additional_data(0).meaning=Risk name; \
additional_data(0).data=$2; \
additional_data(1).type=integer; \
additional_data(1).meaning=Occurrences; \
additional_data(1).data=$3; \
additional_data(2).type=string; \
additional_data(2).meaning=Actual action; \
additional_data(2).data=$4; \
goto=172000000; \
last
#DESCRIPTION:SONAR threat detected
#CATEGORY:Malware
#LOG:Dec 12 17:07:08 SymantecServer antivirus.example.com: ,Forced SONAR threat detected,Computer name: A01LTFW21052,Detection type: Heuristic,First Seen: Reputation was not used in this detection.,Application name: MAGic Screen Magnification,Application type: Trojan Worm,Application version: "11, 0, 4356, 400",Hash type: SHA-1,Application hash: 1ce39d44cc735db5788f07b25c5bb32c6ca48c09,Company name: "Freedom Scientific BLV Group, LLC",File size (bytes): 421144,Sensitivity: 0,Detection score: 0,COH Engine Version: ,Detection Submissions No,Permitted application reason: MDS,Disposition: Reputation was not used in this detection.,Download site: ,Web domain: ,Downloaded by: ,Prevalence: Reputation was not used in this detection.,Confidence: Reputation was not used in this detection.,URL Tracking Status: Off,Risk Level: N/A,Detection Source: N/A,Source: Heuristic Scan,Risk name: ,Occurrences: 1,c:\program files\freedom scientific\magic\11.0\magengnt\mag.exe,"c:\program files\freedom scientific\magic\11.0\magengnt\mag.exe",Actual action: Left alone,Requested action: Left alone,Secondary action: Forced detection using file name,Event time: 2013-01-09 12:57:51,Inserted: 2013-01-09 12:58:47,End: 2013-01-09 12:57:51,Domain: Default,Group: My Company\klient\All Laptops\LaptopsW7,Server: a01mmfw016,User: R117493,Source computer: ,Source IP:
regex=Forced SONAR threat detected,Computer name: (\S+),Detection type: (\S+),First Seen: Reputation was not used in this detection\.,Application name: ([^,]+); \
classification.text=Forced SONAR threat detected; \
id=172000200; \
revision=2; \
assessment.impact.severity=high; \
assessment.impact.type=file; \
assessment.impact.completion=succeeded; \
assessment.impact.description=SONAR threat detected, Computer name: $1; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address=$1; \
additional_data(0).type=string; \
additional_data(0).meaning=Detection type; \
additional_data(0).data=$2; \
additional_data(1).type=string; \
additional_data(1).meaning=Application name; \
additional_data(1).data=$3; \
goto=172000000; \
last