From 2b4f8096bf88a971b421d7f6be807ddbf0bd6222 Mon Sep 17 00:00:00 2001 From: AlfonsoRBJ Date: Wed, 29 Aug 2018 12:37:17 +0200 Subject: [PATCH 1/5] New junos rules and decoders We have created rules and decoders for Junos IDS. --- decoders/0485-junos_decoders.xml | 272 +++++++++++++++++++++++++++++++ rules/0575-junos_rules.xml | 33 ++++ 2 files changed, 305 insertions(+) create mode 100644 decoders/0485-junos_decoders.xml create mode 100644 rules/0575-junos_rules.xml diff --git a/decoders/0485-junos_decoders.xml b/decoders/0485-junos_decoders.xml new file mode 100644 index 000000000..f1b2509b7 --- /dev/null +++ b/decoders/0485-junos_decoders.xml @@ -0,0 +1,272 @@ + + + + + + junos-ids + + + + + junos-ids + IP spoofing + (\.+) (\S+) - (\S+) [\S+ attack-name="(\.+)" source-address="(\S+)" destination-address="(\S+)" protocol-id="(\S+)" source-zone-name="(\S+)" interface-name="(\S+)" action="(\S+)"] + firewall_name, cat, sub_cat, attack.name, srcip, dstip, protocol_id, source_zone, interface, action + + + + + junos-ids + No TCP flag + (\.+) (\S+) - (\S+) [\S+ attack-name="(\.+)" source-address="(\S+)" source-port="(\S+)" destination-address="(\S+)" destination-port="(\S+)" source-zone-name="(\S+)" interface-name="(\S+)" action="(\S+)"] + firewall_name,cat, sub_cat, attack.name, srcip, srcport, dstip, dstport, source_zone, interface, action + + + + + junos-ids + (\.+) (\S+) - (\S+) [\S+ attack-name="(\.+)" source-address="(\S+)" + firewall_name,cat, sub_cat, attack.name, srcip + + + + junos-ids + destination-address="(\S+)" + dstip + + + + + + + + junos-flow + + + + + + + junos-rt-flow + RT_FLOW_SESSION_CREATE + (\.+) (\S+) - (\S+) \S+ source-address="(\S+)" + firewall_name,cat, subcat,srcip + + + + junos-rt-flow + source-port="(\S+)" + srcport + + + + junos-rt-flow + destination-address="(\S+)" + dstip + + + + junos-rt-flow + destination-port="(\S+)" + dstport + + + + junos-rt-flow + service-name="(\S+)" + service_name + + + + junos-rt-flow + nat-source-address="(\S+)" nat-source-port="(\S+)" nat-destination-address="(\S+)" nat-destination-port="(\S+)" src-nat-rule-name="(\S+)" dst-nat-rule-name="(\S+)" protocol-id="(\S+)" policy-name="(\S+)" source-zone-name="(\S+)" destination-zone-name="(\S+)" session-id-32="(\S+)" username="(\S+)" roles="(\S+)" packet-incoming-interface="(\S+)" application="(\S+)" + nat_srcip,nat_srcport,nat_dstip,nat_dstport,src_nat_rule_name,dst_nat_rule_name,protocol_id,policy_name,source_zone,destination_zone,session_id_32,username,roles,packet_incoming_interface,application + + + + + + junos-rt-flow + RT_FLOW_SESSION_DENY + (\.+) (\S+) - (\S+) \S+ source-address="(\S+)" + firewall_name,cat, subcat,srcip + + + + junos-rt-flow + source-port="(\S+)" + srcport + + + + junos-rt-flow + destination-address="(\S+)" + dstip + + + + junos-rt-flow + destination-port="(\S+)" + dstport + + + + junos-rt-flow + service-name="(\S+)" + service_name + + + + junos-rt-flow + protocol-id="(\S+)" icmp-type="(\S+)" policy-name="(\S+)" source-zone-name="(\S+)" destination-zone-name="(\S+)" application="(\S+)" nested-application="(\S+)" username="(\S+)" roles="(\S+)" packet-incoming-interface="(\S+)" encrypted="(\S+)" reason="(\.+)"] + protocol_id,icm_type,policy_name,source_zone,destination_zone,application,nested_application,username,roles,packet_incoming_interface,encrypted + + + + junos-rt-flow + reason="(\.+)" + reason + + + + + + + junos-rt-flow + RT_FLOW_SESSION_CLOSE + (\.+) (\S+) - (\S+) \S+ reason="(\.+)" + firewall_name,cat, subcat,reason + + + + junos-rt-flow + source-address="(\S+)" + srcip + + + + junos-rt-flow + source-port="(\S+)" + srcport + + + + junos-rt-flow + destination-address="(\S+)" + dstip + + + + junos-rt-flow + destination-port="(\S+)" + dstport + + + + junos-rt-flow + service-name="(\S+)" + service_name + + + + junos-rt-flow + nat-source-address="(\S+)" nat-source-port="(\S+)" nat-destination-address="(\S+)" nat-destination-port="(\S+)" src-nat-rule-name="(\S+)" dst-nat-rule-name="(\S+)" protocol-id="(\S+)" policy-name="(\S+)" source-zone-name="(\S+)" destination-zone-name="(\S+)" session-id-32="(\S+)" packets-from-client="(\S+)" bytes-from-client="(\S+)" packets-from-server="(\S+)" bytes-from-server="(\S+)" + nat_srcip,nat_srcport,nat_dstip,nat_dstport,src_nat_rule_name,dst_nat_rule_name,protocol_id,policy_name,source_zone,destination_zone,session_id_32,packets_from_client,bytes_from_client,packets_from_serve,bytes_from_server + + + + + + + junos-rt-flow + FLOW_REASSEMBLE_FAIL + (\.+) (\S+) - (\S+) \S+ source-address="(\S+)" + firewall_name,cat, subcat,srcip + + + + junos-rt-flow + destination-address="(\S+)" + dstip + + + + + junos-rt-flow + assembly-id="(\S+)" + assembly_id + + + + + + junos-rt-flow + FLOW_REASSEMBLE_SUCCEED + (\.+) (\S+) - (\S+) \S+ source-address="(\S+)" + firewall_name,cat, subcat,srcip + + + + junos-rt-flow + destination-address="(\S+)" + dstip + + + + + junos-rt-flow + assembly-id="(\S+)" + assembly_id + + + + + + junos-rt-flow + FLOW_MCAST_RPF_FAIL + (\.+) (\S+) - (\S+) \S+ interface-name="(\S+)" + firewall_name,cat, subcat,interface + + + + junos-rt-flow + source-address="(\S+)" + srcip + + + + junos-rt-flow + destination-address="(\S+)" + dstip + + + + junos-rt-flow + protocol-name="(\S+)"] + protocol_name + \ No newline at end of file diff --git a/rules/0575-junos_rules.xml b/rules/0575-junos_rules.xml new file mode 100644 index 000000000..a74f0e467 --- /dev/null +++ b/rules/0575-junos_rules.xml @@ -0,0 +1,33 @@ + + + + + + junos-ids + Junos IDS + + + + 200100 + Junos IDS: $(attack.name) + + + + + + + + junos-rt-flow + Junos RT Flow + + + + 130000 + Junos RT flow: $(subcat) + + + From 2bfcad7033b359097656472be9986c255b702141 Mon Sep 17 00:00:00 2001 From: K-Embee Date: Thu, 12 Mar 2020 16:14:52 +0000 Subject: [PATCH 2/5] Update to 3.12 + Changelog --- CHANGELOG.md | 2 +- rules/{0575-junos_rules.xml => 0655-junos_rules.xml} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename rules/{0575-junos_rules.xml => 0655-junos_rules.xml} (100%) diff --git a/CHANGELOG.md b/CHANGELOG.md index fb7f46173..d953963ea 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ All notable changes to this project will be documented in this file. - Extend the rules to detect shellshock attacks (by @iasdeoupxe). ([#459](https://github.com/wazuh/wazuh-ruleset/pull/479)) - Update Roundcube decoder to support versions greater than 1.4 (by @iasdeoupxe). ([#537](https://github.com/wazuh/wazuh-ruleset/pull/537)) - +- New junos rules and decoders (by @SitioRJB). ([#180](https://github.com/wazuh/wazuh-ruleset/pull/180)) ### Fixed diff --git a/rules/0575-junos_rules.xml b/rules/0655-junos_rules.xml similarity index 100% rename from rules/0575-junos_rules.xml rename to rules/0655-junos_rules.xml From bc53bf29e46901ffa0bdea2086f4939ae7e75f40 Mon Sep 17 00:00:00 2001 From: K-Embee Date: Thu, 12 Mar 2020 16:44:18 +0000 Subject: [PATCH 3/5] Fixes decoder number --- decoders/{0485-junos_decoders.xml => 0490-junos_decoders.xml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename decoders/{0485-junos_decoders.xml => 0490-junos_decoders.xml} (100%) diff --git a/decoders/0485-junos_decoders.xml b/decoders/0490-junos_decoders.xml similarity index 100% rename from decoders/0485-junos_decoders.xml rename to decoders/0490-junos_decoders.xml From 3cc7715db2359cd0727d8a688434b8342f1ea9b2 Mon Sep 17 00:00:00 2001 From: Jose Manuel Lopez Date: Thu, 12 Mar 2020 19:49:21 +0100 Subject: [PATCH 4/5] Fix typo --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d953963ea..430fdc638 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ All notable changes to this project will be documented in this file. - Extend the rules to detect shellshock attacks (by @iasdeoupxe). ([#459](https://github.com/wazuh/wazuh-ruleset/pull/479)) - Update Roundcube decoder to support versions greater than 1.4 (by @iasdeoupxe). ([#537](https://github.com/wazuh/wazuh-ruleset/pull/537)) -- New junos rules and decoders (by @SitioRJB). ([#180](https://github.com/wazuh/wazuh-ruleset/pull/180)) +- New junos rules and decoders (by @SitoRBJ). ([#180](https://github.com/wazuh/wazuh-ruleset/pull/180)) ### Fixed From 49d89c8dd822c90d9dfd304b75c22c4786367b1d Mon Sep 17 00:00:00 2001 From: joselopezrio Date: Thu, 12 Mar 2020 20:23:01 +0100 Subject: [PATCH 5/5] Formatting of rules and decoders --- decoders/0490-junos_decoders.xml | 6 ++++-- rules/0655-junos_rules.xml | 19 ++++++++++--------- 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/decoders/0490-junos_decoders.xml b/decoders/0490-junos_decoders.xml index f1b2509b7..d1b6ec2c4 100644 --- a/decoders/0490-junos_decoders.xml +++ b/decoders/0490-junos_decoders.xml @@ -1,8 +1,10 @@ - junos-ids diff --git a/rules/0655-junos_rules.xml b/rules/0655-junos_rules.xml index a74f0e467..8d146c5f3 100644 --- a/rules/0655-junos_rules.xml +++ b/rules/0655-junos_rules.xml @@ -1,18 +1,19 @@ - + junos-ids Junos IDS - - 200100 + + 67100 Junos IDS: $(attack.name) @@ -20,13 +21,13 @@ - + junos-rt-flow Junos RT Flow - - 130000 + + 67102 Junos RT flow: $(subcat)