Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ssh recon #323

Merged
merged 9 commits into from
Aug 22, 2019
Merged

Ssh recon #323

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
94c979c
rules to detect untrusted kernel modules being loaded
kravietz Jan 29, 2019
398f2a9
rndg failure
kravietz Jan 29, 2019
0ed79b3
add RAID and disk failure patterns
kravietz Jan 29, 2019
b3ecd31
Add recon group to 5701 Bad protocol version identification
kravietz Mar 18, 2019
1c44567
Fix conflict with mdadm decoder
kravietz Jun 11, 2019
71d967a
Add fixes for RAID events
kravietz Jun 11, 2019
bc1ff61
Add systemd status=1/FAILURE rule
kravietz Jun 11, 2019
a307b29
Add ZFS error message
kravietz Jun 11, 2019
397e91b
Merge branch '3.10' into ssh-recon
chemamartinez Aug 22, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
47 changes: 47 additions & 0 deletions rules/0020-syslog_rules.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -356,6 +356,53 @@
<description>Monitor ADSL line is up.</description>
</rule>

<rule id="5132" level="11">
<if_sid>5100</if_sid>
<match>module verification failed</match>
<description>Unsigned kernel module was loaded</description>
</rule>

<rule id="5133" level="11">
<if_sid>5100</if_sid>
<match>PKCS#7 signature not signed with a trusted key</match>
<description>Signed but untrusted kernel module was loaded</description>
</rule>

<rule id="5134" level="7">
<program_name>^rngd</program_name>
<match>failure</match>
<description>RNGD failure</description>
</rule>

<rule id="5135" level="7">
<if_sid>5100</if_sid>
<match>Disk failure</match>
<description>RAID0/1 disk failure</description>
</rule>

<rule id="5136" level="2">
<program_name>^mdadm</program_name>
<description>General RAID mdadm event</description>
</rule>

<rule id="5137" level="7">
<if_sid>5136</if_sid>
<match>FailSpare</match>
<description>RAID mdadm spare disk failure</description>
</rule>

<rule id="5138" level="7">
<if_sid>5100</if_sid>
<match>ata.+: failed command</match>
<description>General SATA disk failure</description>
</rule>

<rule id="5139" level="7">
<if_sid>5100</if_sid>
<match>device not ready</match>
<description>General device failure</description>
</rule>

<rule id="5200" level="0">
<match>^hpiod: unable to ParDevice</match>
<description>Ignoring hpiod for producing useless logs.</description>
Expand Down
2 changes: 1 addition & 1 deletion rules/0095-sshd_rules.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
<match>Bad protocol version identification</match>
<description>sshd: Possible attack on the ssh server </description>
<description>(or version gathering).</description>
<group>pci_dss_11.4,gpg13_4.12,gdpr_IV_35.7.d,</group>
<group>recon,pci_dss_11.4,gpg13_4.12,gdpr_IV_35.7.d,</group>
</rule>

<rule id="5702" level="5">
Expand Down
2 changes: 2 additions & 0 deletions rules/log-entries/kernel
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
kernel: tcp_parse_options: Illegal window scaling value 200 >14 received.
Jan 29 09:24:16 pax kernel: PKCS#7 signature not signed with a trusted key
Jan 8 18:23:07 worker3 kernel: [ 470.247608] p_lkrg: module verification failed: signature and/or required key missing - tainting kernel