##### # # Copyright (C) 2003 Stephane Loeuillet (stephane.loeuillet@tiscali.fr) # All Rights Reserved # # This file is part of the Prelude-LML program. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; see the file COPYING. If not, write to # the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. # ##### # 1) Scan : # source regex : portsentry\[?(\d+)+\]?:.* attackalert: (\S+) scan from host: (\S+)/($IP) to (TCP|UDP) port: (\d+) # Sample matching logs : #LOG:May 11 23:29:48 icecube portsentry[791]: attackalert: SYN/Normal scan from host: server1.miniclip.com/64.23.60.30 to TCP port: 443 #LOG:May 8 08:58:22 icecube portsentry[795]: attackalert: UDP scan from host: 193.63.249.24/193.63.249.24 to UDP port: 177 #LOG:Apr 18 10:42:51 20.0.0.3 portsentry[2549]: attackalert: TCP SYN/Normal scan from host: 2.0.0.3/2.0.0.3 to TCP port: 119 regex=attackalert:.*?(\S+) scan from\s+host: (\S+)/([\d\.]+|[\dA-Fa-f\:]+) to (TCP|UDP) port: (\d+); \ classification.text=$1 Scan; \ id=1500; \ revision=1; \ analyzer(0).name=PortSentry; \ analyzer(0).manufacturer=sentrytools.sourceforge.net; \ analyzer(0).class=HIDS; \ assessment.impact.completion=succeeded; \ assessment.impact.type=other; \ assessment.impact.severity=medium; \ assessment.impact.description=PortSentry found someone performed a '$1' scan; \ source(0).node.address(0).category=ipv4-addr; \ source(0).node.address(0).address=$3; \ source(0).node.name=$2; \ source(0).service.iana_protocol_name=$4; \ target(0).service.iana_protocol_name=$4; \ source(0).service.port=$5; \ last; # 2) Connection : # # source regex : portsentry\[?(\d+)+\]?:.* attackalert: Connect from host: (\S+)/($IP) to (TCP|UDP) port: (\d+) # #LOG:Mar 28 00:03:25 hoste portsentry[103]: attackalert: Connect from host: 217.33.28.29/217.33.28.29 to TCP port: 111 # regex=attackalert: Connect from host: (\S+)/([\d\.]+|[\dA-Fa-f\:]+) to (TCP|UDP) port: (\d+); \ classification.text=Connection logged; \ id=1501; \ revision=1; \ analyzer(0).name=PortSentry; \ analyzer(0).manufacturer=sentrytools.sourceforge.net; \ analyzer(0).class=HIDS; \ assessment.impact.completion=succeeded; \ assessment.impact.type=other; \ assessment.impact.severity=low; \ assessment.impact.description=PortSentry found someone connecting to port $3/$4; \ source(0).node.address(0).category=ipv4-addr; \ source(0).node.address(0).address=$2; \ source(0).node.name=$1; \ source(0).service.iana_protocol_name=$3; \ target(0).service.iana_protocol_name=$3; \ target(0).service.port=$4; \ last; # 3) Rules : # #LOG:Oct 15 13:50:07 basile portsentry[28412]: attackalert: Host 195.220.107.15 has been blocked via dropped route using command: "/sbin/ipchains -I input -s 195.220.107.15 -j DENY" # regex=attackalert: Host ([\d\.]+) has been blocked via dropped route using command: "([^"]+)"; \ classification.text=Host blocked; \ id=1502; \ revision=1; \ analyzer(0).name=PortSentry; \ analyzer(0).manufacturer=sentrytools.sourceforge.net; \ analyzer(0).class=HIDS; \ assessment.impact.completion=failed; \ assessment.impact.type=other; \ assessment.impact.severity=low; \ assessment.impact.description=PortSentry saw your firewall blocked a host via : $2; \ source(0).node.address(0).category=ipv4-addr; \ source(0).node.address(0).address=$1; \ last; # Copyright (C) 2004-2005 G Ramon Gomez <gene at gomezbrothers dot com> # All Rights Reserved #LOG:Apr 18 10:42:51 20.0.0.3 portsentry[2549]: attackalert: Host: 2.0.0.3/2.0.0.3 is already blocked Ignoring regex=attackalert: Host: (\S+)/([\d\.]+) is\s+already blocked; \ classification.text=Host blocked; \ id=1503; \ revision=1; \ analyzer(0).name=PortSentry; \ analyzer(0).manufacturer=sentrytools.sourceforge.net; \ analyzer(0).class=HIDS; \ assessment.impact.completion=failed; \ assessment.impact.type=other; \ assessment.impact.severity=medium; \ assessment.impact.description=PortSentry saw your firewall blocked a host.; \ source(0).node.address(0).category=ipv4-addr; \ source(0).node.address(0).address=$2; \ source(0).node.name=$1; \ last;