Skip to content

Rules

0. 0020-syslog_rules.xml

<!-- temp
  <rule id="5402" level="3">
    <if_sid>5400</if_sid>
    <regex> ; USER=root ; COMMAND=| ; USER=root ; TSID=\S+ ; COMMAND=</regex>
    <description>Successful sudo to ROOT executed.</description>
    <mitre>
      <id>T1548.003</id>
    </mitre>
    <group>pci_dss_10.2.5,pci_dss_10.2.2,gpg13_7.6,gpg13_7.8,gpg13_7.13,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.1>
  </rule>
-->

<!-- temp
  <rule id="5407" level="3">
    <if_sid>5400</if_sid>
    <regex> ; USER=\S+ ; COMMAND=| ; USER=\S+ ; TSID=\S+ ; COMMAND=</regex>
    <description>Successful sudo executed.</description>
    <mitre>
      <id>T1548.003</id>
    </mitre>
    <group>pci_dss_10.2.5,pci_dss_10.2.2,gpg13_7.6,gpg13_7.8,gpg13_7.13,gdpr_IV_32.2,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>
-->

3.

<rule id="5104" level="8">
    <if_sid>5100</if_sid>
    <regex>Promiscuous mode enabled|</regex>
    <regex>device \S+ entered promiscuous mode</regex>
    <description>Interface entered in promiscuous(sniffing) mode.</description>
    <mitre>
      <id>T1040</id>
    </mitre>
    <group>promisc,pci_dss_10.6.1,pci_dss_11.4,gpg13_4.13,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.6,nist_800_53_SI.4,tsc_CC7.2,tsc_CC7.3,tsc_CC6.1,tsc_CC6.8,</group>
  </rule>

4.

   <rule id="2904" level="7">
     <if_sid>2900</if_sid>
     <field name="dpkg_status">^status half-configured$</field>
     <description>Dpkg (Debian Package) half configured.</description>
     <group>config_changed,pci_dss_10.6.1,pci_dss_10.2.7,gpg13_4.10,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.6,nist_800_53_AU.14,tsc_CC7.2,tsc_CC7.3,tsc_CC6.8,tsc_CC8.1,</group>
   </rule>
</group>

1. 0015-ossec_rules.xml

<rule id="533" level="7">
    <if_sid>530</if_sid>
    <match>ossec: output: 'netstat listening ports</match>
    <check_diff />
    <description>Listened ports status (netstat) changed (new port opened or closed).</description>
    <group>pci_dss_10.2.7,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AU.6,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

2.

<rule id="504" level="3">
    <if_sid>500</if_sid>
    <match>Agent disconnected</match>
    <description>Wazuh agent disconnected.</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
    <group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_5>
  </rule>

3.

<!--
  <rule id="531" level="7" ignore="7200">
    <if_sid>530</if_sid>
    <match>ossec: output: 'df -P': /dev/</match>
    <regex>100%</regex>
    <description>Partition usage reached 100% (disk space monitor).</description>
    <group>low_diskspace,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.6,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>
-->

4.

  <rule id="510" level="7">
    <if_sid>509</if_sid>
    <description>Host-based anomaly detection event (rootcheck).</description>
    <group>rootcheck,pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
    <!-- <if_fts />  -->
  </rule>

5.

  <rule id="550" level="7">
    <category>ossec</category>
    <decoded_as>syscheck_integrity_changed</decoded_as>
    <description>Integrity checksum changed.</description>
    <mitre>
      <id>T1565.001</id>
    </mitre>
    <group>syscheck,syscheck_entry_modified,syscheck_file,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,tsc_PI1.4,tsc_PI1.5,tsc_CC6.1,tsc_CC6.8,>
  </rule>

6.

<rule id="751" level="5">
    <category>ossec</category>
    <decoded_as>syscheck_registry_value_deleted</decoded_as>
    <group>syscheck,syscheck_entry_deleted,syscheck_registry,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_1>
    <description>Registry Value Entry Deleted.</description>
    <mitre>
      <id>T1070.004</id>
      <id>T1485</id>
      <id>T1112</id>
    </mitre>
  </rule>

7.

  <rule id="750" level="5">
    <category>ossec</category>
    <decoded_as>syscheck_registry_value_modified</decoded_as>
    <group>syscheck,syscheck_entry_modified,syscheck_registry,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_>
    <description>Registry Value Integrity Checksum Changed</description>
    <mitre>
      <id>T1565.001</id>
      <id>T1112</id>
    </mitre>
  </rule>

8.

  <rule id="594" level="5">
    <category>ossec</category>
    <decoded_as>syscheck_registry_key_modified</decoded_as>
    <group>syscheck,syscheck_entry_modified,syscheck_registry,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_>
    <description>Registry Key Integrity Checksum Changed</description>
    <mitre>
      <id>T1565.001</id>
      <id>T1112</id>
    </mitre>
  </rule>

9.

  <rule id="598" level="5">
    <category>ossec</category>
    <decoded_as>syscheck_registry_key_added</decoded_as>
    <group>syscheck,syscheck_entry_added,syscheck_registry,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_164>
    <description>Registry Key Entry Added to the System</description>
    <mitre>
      <id>T1112</id>
    </mitre>
  </rule>

10.

<rule id="752" level="5">
    <category>ossec</category>
    <decoded_as>syscheck_registry_value_added</decoded_as>
    <group>syscheck,syscheck_entry_added,syscheck_registry,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_164>
    <description>Registry Value Entry Added to the System</description>
    <mitre>
      <id>T1112</id>
    </mitre>
  </rule>

11.

<rule id="597" level="5">
    <category>ossec</category>
    <decoded_as>syscheck_registry_key_deleted</decoded_as>
    <group>syscheck,syscheck_entry_deleted,syscheck_registry,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_1>
    <description>Registry Key Entry Deleted.</description>
    <mitre>
      <id>T1070.004</id>
      <id>T1485</id>
      <id>T1112</id>
    </mitre>
  </rule>

2. 0280-attack_rules.xml

1.

<!--tmp disable
  <rule id="40101" level="12">
    <if_group>authentication_success</if_group>
    <user>$SYS_USERS</user>
    <description>System user successfully logged to the system.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>invalid_login,pci_dss_10.2.4,pci_dss_10.2.5,gpg13_7.8,gdpr_IV_35.7.d,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

2.

3. 0560-docker_integration_rules.xml

<rule id="87907" level="3">
        <if_sid>87900</if_sid>
        <field name="docker.status">^exec_start: </field>
        <description>Docker: Command launched in container $(docker.Actor.Attributes.name). Action: "$(docker.Action)"</description>
        <group>gdpr_IV_32.2,</group>
        <options>no_full_log</options>
    </rule>

2.

    <rule id="87907" level="3">
        <if_sid>87900</if_sid>
        <field name="docker.status">^exec_start: </field>
        <description>Docker: Command launched in container $(docker.Actor.Attributes.name). Action: "$(doc>
        <group>gdpr_IV_32.2,</group>
        <options>no_full_log</options>
    </rule>

4. 0520-vulnerability-detector_rules.xml

1.

  <rule id="23504" level="7">
      <if_sid>23501</if_sid>
      <options>no_full_log</options>
      <field name="vulnerability.status">Active</field>
      <field name="vulnerability.severity">Medium|Untriaged</field>
      <description>$(vulnerability.cve) affects $(vulnerability.package.name)</description>
  </rule>

5. 0580-win-security_rules.xml

  <rule id="60227" level="8">
    <if_sid>60103</if_sid>
    <field name="win.system.eventID">^6416$</field>
    <description>A new external device was recognized by the system</description>
    <options>no_full_log</options>
    <mitre>
      <id>T1092</id>
    </mitre>
  </rule>

2.

  <rule id="60106" level="3">
    <if_sid>60103</if_sid>
    <field name="win.system.eventID">^528$|^540$|^673$|^4624$|^4769$</field>
    <description>Windows Logon Success</description>
    <options>no_full_log</options>
    <group>authentication_success,pci_dss_10.2.5,gpg13_7.1,gpg13_7.2,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

3.

  <rule id="60103" level="0">
    <if_sid>60001</if_sid>
    <field name="win.system.severityValue">^AUDIT_SUCCESS$|^success$</field>
    <description>Windows audit success event</description>
    <options>no_full_log</options>
  </rule>

4.

<rule id="60104" level="5">
    <if_sid>60001</if_sid>
    <field name="win.system.severityValue">^AUDIT_FAILURE$|^failure$</field>
    <description>Windows audit failure event</description>
    <group>pci_dss_10.6.1,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.6,tsc_CC7.2,tsc_CC7.3,</group>
    <options>no_full_log</options>
  </rule>

5.

  <rule id="60132" level="5">
    <if_sid>60103</if_sid>
    <field name="win.system.eventID">^520$|^4616$</field>
    <description>System time changed</description>
    <options>no_full_log</options>
    <group>time_changed,pci_dss_10.6.1,gpg13_1.3,gpg13_4.13,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.>
  </rule>

6. 0585-win-application_rules.xml

  <rule id="60602" level="9">
    <if_sid>60003</if_sid>
    <field name="win.system.severityValue">^ERROR$</field>
    <options>no_full_log</options>
    <description>Windows application error event.</description>
    <group>gdpr_IV_35.7.d,gpg13_4.3,system_error,</group>
  </rule>

2.

  <rule id="60807" level="3">
    <if_sid>60795</if_sid>
    <field name="win.system.eventID">^300$</field>
    <options>no_full_log</options>
    <description>The database engine is initiating recovery steps.</description>
  </rule>

  <rule id="60808" level="3">
    <if_sid>60795</if_sid>
    <field name="win.system.eventID">^301$</field>
    <options>no_full_log</options>
    <description>The database engine is replaying log file C:\Winnt\system32\wins\j50.log.</description>
  </rule>

  <rule id="60809" level="3">
    <if_sid>60795</if_sid>
    <field name="win.system.eventID">^302$</field>
    <options>no_full_log</options>
    <description>The database engine has completed recovery steps.</description>
  </rule>

  <rule id="60810" level="5">
    <if_sid>60795</if_sid>
    <field name="win.system.eventID">^411$</field>
    <options>no_full_log</options>
    <description>Log version stamp does not match database engine version stamp.</description>
  </rule>

  <rule id="60811" level="5">
    <if_sid>60795</if_sid>
    <field name="win.system.eventID">^427$</field>
    <options>no_full_log</options>
    <description>The database engine could not access a file.</description>
  </rule>

2.

  <rule id="60805" level="3">
    <if_sid>60795</if_sid>
    <field name="win.system.eventID">^102$</field>
    <options>no_full_log</options>
    <description>The database engine is starting a new instance.</description>
  </rule>

3.

  <rule id="60775" level="5">
    <if_sid>60774</if_sid>
    <field name="win.system.eventID">^6000$</field>
    <options>no_full_log</options>
    <description>$(win.eventdata.data) was unavailable to handle a notification event.</description>
  </rule>

  <rule id="60776" level="7">
    <if_sid>60774</if_sid>
    <field name="win.system.eventID">^6003$</field>
    <options>no_full_log</options>
    <description>$(win.eventdata.data) was unavailable to handle a critical notification event.</descripti>
  </rule>

  <rule id="60777" level="3">
    <if_sid>60774</if_sid>
    <field name="win.system.eventID">^7002$</field>
    <options>no_full_log</options>
    <description>User logoff notification for customer experience improvement program.</description>
  </rule>

7. 0315-apparmor_rules.xml

  <rule id="52002" level="3">
    <if_sid>52000</if_sid>
    <status>DENIED</status>
    <match> apparmor=</match>
    <description>Apparmor DENIED</description>
  </rule>

2.

  <rule id="52000" level="3">
    <decoded_as>kernel</decoded_as>
    <match> apparmor=</match>
    <description>Apparmor messages grouped.</description>
  </rule>

8. 0590-win-system_rules.xml

  <rule id="61104" level="3">
    <if_sid>61100</if_sid>
    <field name="win.system.eventID">^7040$</field>
    <group>policy_changed,pci_dss_10.6,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.6,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
    <description>Service startup type was changed</description>
    <options>no_full_log</options>
    <info type="text">This does not appear to be logged on Windows 2000</info>
  </rule>

2.

  <rule id="61102" level="5">
    <if_sid>60002</if_sid>
    <field name="win.system.severityValue">^ERROR$</field>
    <description>Windows System error event</description>
    <options>no_full_log</options>
    <group>system_error,gpg13_4.3,gdpr_IV_35.7.d,</group>
  </rule>

9. 0960-macos_rules.xml

  <rule id="89603" level="3">
    <decoded_as>macOS_loginwindow</decoded_as>
    <regex type="pcre2">sendBSDNotification: \w+.\w+.\w+.screenIsLocked</regex>
    <description>Screen locked with userID:$(userID).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_success,gdpr_IV_32.2,gpg13_7.1,gpg13_7.2,hipaa_164.312.b,nist_800_53_AC.7,nist_800_53_AU.14,pci_dss_10.2.5,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

2.

  <rule id="89602" level="3">
    <decoded_as>macOS_loginwindow</decoded_as>
    <regex type="pcre2">sendBSDNotification: \w+.\w+.\w+.screenIsUnlocked</regex>
    <description>Screen unlocked with userID:$(userID).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_success,gdpr_IV_32.2,gpg13_7.1,gpg13_7.2,hipaa_164.312.b,nist_800_53_AC.7,nist_800_53_AU.14,pci_dss_10.2.5,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

10. 0085-pam_rules.xml

  <rule id="5502" level="3">
    <if_sid>5500</if_sid>
    <match>session closed for user </match>
    <description>PAM: Login session closed.</description>
    <group>pci_dss_10.2.5,gpg13_7.8,gpg13_7.9,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

2.

  <rule id="5501" level="3">
    <if_sid>5500</if_sid>
    <match>session opened for user </match>
    <description>PAM: Login session opened.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_success,pci_dss_10.2.5,gpg13_7.8,gpg13_7.9,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

11. 0375-usb_rules.xml

    <rule id="81101" level="3">
        <if_sid>81100</if_sid>
        <match>New USB device found</match>
        <description>Attached USB Storage</description>
        <group>gpg13_4.8,</group>
    </rule>

    <rule id="81102" level="3">
        <if_sid>81100</if_sid>
        <match>USB disconnect</match>
        <description>USB device disconnected</description>
        <group></group>
    </rule>

12. 0955-WEF-baseline_rules.xml

1.

  <rule id="67028" level="3">
    <if_sid>60103</if_sid>
    <field name="win.system.eventID">^4672$</field>
    <field name="win.eventdata.subjectUserSid" negate="yes">^S-1-5-18$</field>
    <description>Special privileges assigned to new logon.</description>
    <mitre>
      <id>T1484</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="67028" level="3">
    <if_sid>60103</if_sid>
    <field name="win.system.eventID">^4672$</field>
    <field name="win.eventdata.subjectUserSid" negate="yes">^S-1-5-18$</field>
    <description>Special privileges assigned to new logon.</description>
    <mitre>
      <id>T1484</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

13. 0285-systemd_rules.xml

  <rule id="40704" level="5">
    <if_sid>40700</if_sid>
    <match>status=1/FAILURE</match>
    <description>Systemd: Service exited due to a failure.</description>
    <group>gpg13_4.3,gdpr_IV_35.7.d,</group>
  </rule>

14. 0840-win_event_channel.xml

  <rule id="92651" level="0">
    <if_sid>60106</if_sid>
    <field name="win.eventdata.ipAddress" type="pcre2">(?:[0-9]{1,3}\.){3}[0-9]{1,3}</field>
    <field name="win.eventdata.ipAddress" type="pcre2" negate="yes">127\.0\.0\.1</field>
    <description>Successful Remote Logon by user:$(win.eventdata.targetDomainName)\$(win.eventdata.targetU>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_success,gdpr_IV_32.2,gpg13_7.1,gpg13_7.2,hipaa_164.312.b,nist_800_53_AC.7,nist_8>
  </rule>