mirror of
https://github.com/socfortress/Wazuh-Rules.git
synced 2025-10-23 00:02:11 +00:00
82 lines
2.6 KiB
XML
82 lines
2.6 KiB
XML
<group name="linux,packetbeat,">
|
|
<rule id="200300" level="3">
|
|
<decoded_as>json</decoded_as>
|
|
<field name="method">QUERY</field>
|
|
<field name="dns.resolved_ip">\.+</field>
|
|
<mitre>
|
|
<id>T1071</id>
|
|
</mitre>
|
|
<description>Linux: DNS Query to $(dns.question.name)</description>
|
|
<options>no_full_log</options>
|
|
<group>dns</group>
|
|
</rule>
|
|
<rule id="200301" level="3">
|
|
<decoded_as>json</decoded_as>
|
|
<field name="event.dataset">tls</field>
|
|
<field name="tls.established">true</field>
|
|
<mitre>
|
|
<id>T1071</id>
|
|
</mitre>
|
|
<description>Linux: HTTPS connection established to $(tls.client.server_name)</description>
|
|
<options>no_full_log</options>
|
|
<group>tls</group>
|
|
</rule>
|
|
<rule id="200302" level="3">
|
|
<decoded_as>json</decoded_as>
|
|
<field name="type">http</field>
|
|
<mitre>
|
|
<id>T1071</id>
|
|
</mitre>
|
|
<description>Linux: HTTP connection established to $(destination.ip)</description>
|
|
<options>no_full_log</options>
|
|
<group>http</group>
|
|
</rule>
|
|
<!-- EXCLUDE PACKETBEAT ICMP -->
|
|
|
|
<rule id="200303" level="1">
|
|
<decoded_as>json</decoded_as>
|
|
<field name="network.transport">icmp</field>
|
|
<mitre>
|
|
<id>T1071</id>
|
|
</mitre>
|
|
<description>Packetbeat: ICMP flow to $(destination.ip)</description>
|
|
<options>no_full_log</options>
|
|
<group>icmp</group>
|
|
</rule>
|
|
|
|
</group>
|
|
|
|
<!-- Rule to exclude noisy logs -->
|
|
<group name="linux,packetbeat,exclude,">
|
|
<rule id="200310" level="1" frequency="2" timeframe="900">
|
|
<if_matched_sid>200300</if_matched_sid>
|
|
<same_field>dns.question.name</same_field>
|
|
<mitre>
|
|
<id>T1071</id>
|
|
</mitre>
|
|
<description>Linux: Frequent DNS Query</description>
|
|
<options>no_log</options>
|
|
<group>dns</group>
|
|
</rule>
|
|
<rule id="200311" level="1" frequency="2" timeframe="900">
|
|
<if_matched_sid>200301</if_matched_sid>
|
|
<same_field>tls.client.server_name</same_field>
|
|
<mitre>
|
|
<id>T1071</id>
|
|
</mitre>
|
|
<description>Linux: Frequent HTTPS Connection</description>
|
|
<options>no_full_log</options>
|
|
<group>tls</group>
|
|
</rule>
|
|
<rule id="200312" level="1" frequency="2" timeframe="900">
|
|
<if_matched_sid>200302</if_matched_sid>
|
|
<same_field>destination.ip</same_field>
|
|
<mitre>
|
|
<id>T1071</id>
|
|
</mitre>
|
|
<description>Linux: Frequent HTTP Connection</description>
|
|
<options>no_full_log</options>
|
|
<group>http</group>
|
|
</rule>
|
|
</group>
|