-
Notifications
You must be signed in to change notification settings - Fork 27
/
azureEventHub_windows-mssql.rules
56 lines (43 loc) · 5.26 KB
/
azureEventHub_windows-mssql.rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
# Sagan windows-mssql.rules
# Copyright (c) 2009-2023. Quadrant Information Security <www.quadrantsec.com>
# All rights reserved.
#
# Please submit any custom rules or ideas to sagan-submit@quadrantsec.com or the sagan-sigs mailing list
#
#*************************************************************
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
# following conditions are met:
#
# 4798.rules all_windows.rules azureEventHub_notes.txt logs rules test.rules to_azureEventHub.sh Redistributions of source code must retain the above copyright notice, this list of conditions and the following
# disclaimer.
# 4798.rules all_windows.rules azureEventHub_notes.txt logs rules test.rules to_azureEventHub.sh Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
# following disclaimer in the documentation and/or other materials provided with the distribution.
# 4798.rules all_windows.rules azureEventHub_notes.txt logs rules test.rules to_azureEventHub.sh Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#*************************************************************
# Windows based rules.
# Eventlog to syslog service. This is what we primarily use.
# http://code.google.com/p/eventlog-to-syslog/
# MSSQL$SERVER| 18456: Login failed for user 'DOMAIN\\user'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors. [CLIENT: <local machine>]
# MSSQL$XXX| 18453: Login succeeded for user 'DOMAIN\\user'. Connection: trusted. [CLIENT: <local machine>]
# MSSQLSERVER| 18456: Login failed for user 'BOB'. Reason: Failed to open the explicitly specified database. [CLIENT: 10.5.5.6]
# |MSSQLSERVER| 19030: SQL Trace ID 2 was started by login "DOMAIN\\user".
# MSSQLSERVER| 19031: SQL Trace stopped. Trace ID = '2'. Login Name = 'DOMAIN\\user'.
# MSSQL$XXX| 833: SQL Server has encountered 1 occurrence(s) of I/O requests taking longer than 15 seconds to complete on file [E:\\Data\\test.mdf] in database [<Database name is not available>] (17). The OS file handle is 0x0000000000000AF8. The offset of the latest long I/O is: 0x0000003a7a0000
# |MSSQLSERVER| 18451: Login failed for user 'DOMAIN\\users'. Only administrators may connect at this time. [CLIENT: 10.1.6.1]
# |MSSQLSERVER| 26022: Server is listening on
# MSSQLSERVER| 18452: Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. [CLIENT: 10.1.3.9]
# MSSQLSERVER| 17147: SQL Server is terminating because of a system shutdown. This is an informational message only. No user action is required.
# 17162: SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-MSSQL] Login Failure"; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id: 18456; default_proto: tcp; default_dst_port: $MSSQL_PORT; classtype: unsuccessful-user; program: MSSQL*|Application; sid:5009302; metadata: created_on 2022_11_22, old_sid 5001640; rev:7;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-MSSQL] Login Failure - Brute force [25/1]"; json_map:"event_id",".EventID"; json_map:"username",".Computer"; json_map:"message",".RenderedDescription"; event_id: 18456; content:!"local machine"; content:!"named pipe"; content:!"Failed to open the explicitly specified database"; parse_src_ip: 1; default_proto: tcp; default_dst_port: $MSSQL_PORT; classtype: brute-force; program: MSSQL*|Application; xbits: set,brute_force,track ip_src, expire 21600; after: track by_username, count 25, seconds 300; threshold: type suppress, track by_username, count 1, seconds 86400; sid:5009303; metadata: created_on 2022_11_22, old_sid 5001641; rev:18;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-MSSQL] Login Failure from non-trusted connection - Brute force [25/1]"; json_map:"event_id",".EventID"; json_map:"username",".Computer"; json_map:"message",".RenderedDescription"; event_id: 18452; parse_src_ip: 1; default_proto: tcp; default_dst_port: $MSSQL_PORT; classtype: unsuccessful-user; program: MSSQL*|Application; xbits: set,brute_force,track ip_src, expire 21600; after: track by_username, count 25, seconds 300; threshold: type suppress, track by_username, count 1, seconds 86400; sid:5009304; metadata: created_on 2022_11_22, old_sid 5002402; rev:7;)