Merge pull request #1 from gkissand/gkissand-perdition-patch-1

adding perdition
wazuh · Aug 23, 2019 · 1b56215 · 1b56215
2 parents 766e0b5 + abd5d76
commit 1b56215
Showing 1 changed file with 23 additions and 0 deletions.
diff --git a/rules/0020-syslog_rules.xml b/rules/0020-syslog_rules.xml
@@ -762,6 +762,29 @@
 
 </group>
 
+<group name="syslog,perdition,">
+  <rule id="2962" level="0">
+    <decoded_as>perdition</decoded_as>
+    <description>Perdition custom app group.</description>
+  </rule>
+
+  <rule id="2963" level="3">
+    <if_sid>2962</if_sid>
+    <match>Connect: </match>
+    <description>perdition: New connection.</description>
+    <group>connection_attempt,pci_dss_10.6.1,</group>
+  </rule>
+
+  <rule id="2964" level="10" frequency="4" timeframe="30">
+    <if_matched_sid>2963</if_matched_sid>
+    <same_source_ip />
+    <description>perdition: Multiple connection attempts from same source.</description>
+    <group>recon,pci_dss_11.4,</group>
+  </rule>
+
+
+</group>
+
 <group name="syslog,perdition,">
   <rule id="2962" level="0">
     <decoded_as>perdition</decoded_as>