commit 45509c286fe1e6dde7c17e43d1118017aa2fb9bd Author: arthur Date: Wed Feb 11 12:05:22 2026 +0100 first commit diff --git a/3cx_Rules.xml b/3cx_Rules.xml new file mode 100644 index 0000000..42ac8a7 --- /dev/null +++ b/3cx_Rules.xml @@ -0,0 +1,110 @@ + + + + 3cx-parent-datetime + Erro + 3CX CallFlow error + 3cx,callflow,error, + + + + + + + 3cx-parent-datetime + Route failed + 3CX routing failure - Appel sortant impossible + 3cx,callflow,routing, + + + + + + + 100201 + 3CX Route failed — communication externe impossible + 3cx,callflow,outage,provider, + + + + + + + 3cx-parent-datetime + ParentConnectionTerminated + 3CX: parent connection terminated (likely trunk/provider issue) + 3cx,callflow,trunk,provider,outage, + + + + + + + + 100202 + 3CX widespread routing failures — probable provider outage + 3cx,callflow,outage,provider, + + + + + + + + 3cx-parent-datetime + Got Unauthorized from FCM + 3CX Push: FCM unauthorized (apps mobile non fonctionnel) + 3cx,push,notification,fcm, + + + + + + + 100207 + 3CX Push: multiples FCM unauthorized (probable panne notifications mobiles) + 3cx,push,notification,fcm,outage, + + + + + + + 100200 + _3CX.HttpClient + failed + 3CX Integration: requête HTTP échouée (CRM) + 3cx,integration,http, + + + + + + + 100209 + 3CX Integration: multiples requêtes HTTP échouées (panne probable du service tiers) + 3cx,integration,http,outage, + + + + + + + 100200 + DBProvPostgress + (BatchUpdate|INSERT FAILED) + 3CX DB: erreur critique PostgreSQL (BatchUpdate/INSERT) + 3cx,db,postgres,error, + + + + + + + 100211 + 3CX DB: erreurs PostgreSQL répétées (instabilité probable) + 3cx,db,postgres,outage, + + + + diff --git a/Brut-force-VPN.xml b/Brut-force-VPN.xml new file mode 100644 index 0000000..f09f476 --- /dev/null +++ b/Brut-force-VPN.xml @@ -0,0 +1,12 @@ + + + + 81614 + data.remip + Fortigate: Multiple firewall SSL VPN failed login events from same source. + + T1110 + T1133 + + + \ No newline at end of file diff --git a/Brut-force-linux.xml b/Brut-force-linux.xml new file mode 100644 index 0000000..f199a38 --- /dev/null +++ b/Brut-force-linux.xml @@ -0,0 +1,23 @@ + + + + + 5503 + srcip + Brut force Linux + + T1110 + + + + + + + 5503 + tty + Brut force Linux + + T1110 + + + \ No newline at end of file diff --git a/Connexion-admin.xml b/Connexion-admin.xml new file mode 100644 index 0000000..7a96df8 --- /dev/null +++ b/Connexion-admin.xml @@ -0,0 +1,94 @@ + + + + + + 60106 + administrateur + Windows Logon Sucess Admin + no_full_log + authentication_success,pci_dss_10.2.5,gpg13_7.1,gpg13_7.2,gdpr_IV_32.2,hipaa_164.312.b,nist_80> + + + + + + + + 92651 + 10 + User: $(win.eventdata.subjectDomainName)\$(win.eventdata.targetUserName) logged using Remote Desktop Connection (RDP) from ip:$(win.eventdata.ipAddress). + + T1021.001 + T1078.002 + + + + + + + + 60103 + ^4672$ + ^S-1-5-18$ + Special privileges assigned to new logon. + + T1484 + + no_full_log + + + + + + + 60103 + ^528$|^540$|^673$|^4624$|^4769$ + Windows Logon Success + no_full_log + + T1078 + + + + + + + + 60103 + ^538$|^551$|^4634$|^4647$ + Windows User Logoff + no_full_log + + + + + + + + + 67028 + + Privileged logon during quiet hours (00:00–05:00 local) + no_full_log + + + + + + + 60137 + administrateur + Windows Logoff Admin + no_full_log + authentication_success,pci_dss_10.2.5,gpg13_7.1,gpg13_7.2,gdpr_IV_32.2,hipaa_164.312.b,nist_80> + + \ No newline at end of file diff --git a/Logon-failure-win.xml b/Logon-failure-win.xml new file mode 100644 index 0000000..65e1b07 --- /dev/null +++ b/Logon-failure-win.xml @@ -0,0 +1,27 @@ + + + + + 60104 + ^529$|^530$|^531$|^532$|^533$|^534$|^535$|^536$|^537$|^539$|^4625$|^4771$ + Windows Logon Failure + no_full_log + authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5,gpg13_7.1,gdpr_IV_35.7.d,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + T1078 + + + + + + + 60105 + ^529$|^4625$|^4771$ + Logon Failure - Unknown user or bad password + no_full_log + authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5,gpg13_7.1,gdpr_IV_35.7.d,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3, + + T1531 + + + diff --git a/README.md b/README.md new file mode 100644 index 0000000..9f4c07e --- /dev/null +++ b/README.md @@ -0,0 +1,57 @@ +# Wazuh - Custom Rules (local_rules) + +Repo de gestion de version pour les **custom rules Wazuh** (et optionnellement decoders / lists). +Objectif : versionner, documenter, tester, et déployer proprement sur un ou plusieurs Wazuh Manager. + +--- + +## Contenu + +- `rules/` : règles locales (`local_rules.xml` ou fichiers découpés par thèmes) +- `decoders/` : decoders locaux (si utilisés) +- `lists/` : CDB lists (si utilisées) +- `tests/` : exemples d'événements/logs de test +- `scripts/` : scripts de validation / déploiement (optionnel) + +--- + +## Prérequis + +- Accès au Wazuh Manager +- Droits root / wazuh selon votre infra +- Connaissance de base Wazuh ruleset (``, ``, ``, etc.) + +Chemins classiques sur le manager : +- Rules locales : `/var/ossec/etc/rules/local_rules.xml` +- Decoders locaux : `/var/ossec/etc/decoders/local_decoder.xml` +- Lists : `/var/ossec/etc/lists/` + +--- + +## Bonnes pratiques + +### 1) Règles : petites et lisibles +- 1 règle = 1 objectif +- Commenter les règles non triviales +- Garder une logique de nommage + +Exemple de convention : +- IDs : réserver une plage (ex: `100000` - `109999`) pour votre org +- Groupes : `local,windows,authentication` / `local,linux,hardening` etc. + +### 2) Ne pas casser le pipeline +- Toujours valider la syntaxe XML +- Tester avec des logs réels/samples avant mise en prod +- Éviter les conditions trop larges (sinon alert storm) + +### 3) Versionner ce qui est "source" +- Versionner : règles, decoders, lists, samples de test +- Ne pas versionner : secrets, exports complets, archives, fichiers temporaires + +--- + +## Déploiement (manuel) + +### 1) Sauvegarde (recommandé) +```bash +sudo cp /var/ossec/etc/rules/local_rules.xml /var/ossec/etc/rules/local_rules.xml.bak.$(date +%F_%H%M) diff --git a/Suricata.xml b/Suricata.xml new file mode 100644 index 0000000..f345692 --- /dev/null +++ b/Suricata.xml @@ -0,0 +1,648 @@ + + + + + + + + + 86601 + ^Not Suspicious Traffic$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 86601 + ^53$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 86601 + ^SURICATA STREAM SHUTDOWN RST invalid ack$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 100510 + flow.src_ip + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 86601 + SURICATA STREAM ESTABLISHED SYNACK resend with different ACK + Suricata: TCP handshake anomaly (retransmission/reordering/capture/offload) - noise reduction + no_full_log + + + + + + + 100512 + flow.src_ip + Suricata: Repeated SYNACK resend anomalies from same host (possible evasion / broken TCP stack / capture issue) + + T1046 + + no_full_log + + + + + + + + + + + 86601 + (Applayer Mismatch|malformed request|unable to match|Sipvicious|SCAN) + + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + + 86601 + ^SURICATA STREAM reassembly overlap with different data$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 100530 + flow.src_ip + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 86601 + ^SURICATA STREAM Packet with invalid ack$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 100532 + flow.src_ip + Suricata: Alert - Multiple TCP ack invalides - Possible ataque TCP + no_full_log + + + + + + + + + 86601 + ^ET INFO TLS Handshake Failure$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 100540 + flow.src_ip + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + + + 86601 + ^ET INFO Microsoft Connection Test$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 100550 + flow.src_ip + Suricata: Alert - NCSI excessif - Problème réseau + no_full_log + + + + + + + + 86601 + ^SURICATA STREAM Packet with invalid timestamp$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 100560 + flow.src_ip + Suricata: Alert - Multiple timestamps invalides - Possible évasion IDS + no_full_log + + + + + + + + + 86601 + ^SURICATA STREAM FIN out of window$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 100570 + flow.src_ip + Suricata: Alert - Multiple FIN Anormaux - Possible problème réseau ou attaque + no_full_log + + + + + + + 86601 + ^SURICATA STREAM FIN invalid ack$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 100572 + ^SURICATA STREAM FIN invalid ack$ + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + + + 86601 + ^SURICATA UDPv6 invalid checksum$ + 5353 + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 86601 + ^SURICATA UDPv6 invalid checksum$ + flow.src_ip + Suricata: Alert - IPv6 UDP malformed packet flooding (repeated invalid checksum) + + T1046 + + no_full_log + + + + + + + + 86601 + ^SURICATA SMB too many transactions$ + (10.171.101.36|10.172.101.113) + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 86601 + ^SURICATA SMB too many transactions$ + (10.171.101.36|10.172.101.113) + Suricata: Alert - $(alert.signature) + no_full_log + + + + + + + 100591 + flow.src_ip + 10.171.101.36 + ^SURICATA SMB too many transactions$ + Suricata : Possible SMB enumeration or ransomware activity + + T1021.002 + + no_full_log + + + + + + + + 86601 + ^ET INFO SMB2 NT Create AndX Request For an Executable File$ + Suricata: Filtrage executable file SMB + no_full_log + + + + + + + + 100592 + .+ + Suricata: Filtrage executable file SMB + no_full_log + + + + + + + + + 100593 + (?i)Systeme.*\.exe + + Suricata: Known business software (Sphinx) executed from SMB share + + no_full_log + + + + + + + 100593 + ^ET INFO SMB2 NT Create AndX Request For an Executable File$ + (?i)\.(pdf|docx?|xlsx?|pptx?|txt|jpe?g|png|gif|csv|zip|rar) + Suricata: Fichier executable dans dossier partagé + + + + + + + + + + + + + 86601 + ET INFO SMB2 NT Create AndX Request For a DLL File - Possible Lateral Movement + 10.171.101.36 + Suricata : SMB DLL access on file server (often legitimate shared app/library) + no_full_log + + + + + + + 86601 + ET INFO SMB2 NT Create AndX Request For a DLL File - Possible Lateral Movement + 10.171.101.36 + Suricata : SMB DLL access on file server (often legitimate shared app/library) + no_full_log + + + + + + + + 86601 + SURICATA SMB file overlap + Suricata: SMB file overlap (normal SMB read behaviour) + no_full_log + + + + + + + + 86601 + DoH + Suricata : DNS over HTTPS + no_full_log + + + + + + + 100600 + ^10\.172\.253\. + Suricata DNS over HTTPS VLAN ADMINSYS + + T1071.004 + + no_full_log + + + + + + + + + 86601 + SURICATA STREAM bad window update + Suricata : Network/offloading/capture noiseS + no_full_log + + + + + + + 100610 + src_ip + High rate of TCP bad window updates from same host (possible local network stack/capture issue) + + T1071.004 + + no_full_log + + + + + + + + + + 86601 + SURICATA UDPv4 invalid checksum + Suricata : UDPv4 invalid checksum - likely NIC offload/SPAN capture noise (often QUIC) + no_full_log + + + + + + + 100620 + flow.src_ip + High rate of UDPv4 invalid checksum from same host (possible malformed UDP flood / DoS) + no_full_log + + + + + + + + 86601 + + + SURICATA STREAM CLOSEWAIT FIN out of window + + + + Suricata: TCP CLOSEWAIT FIN anomaly on known supervision traffic (likely FP) + + + no_full_log + + + + + + + + + 100630 + + src_ip + + + Suricata: Repeated TCP CLOSEWAIT FIN anomalies from same host (possible evasion or broken TCP stack) + + + T1046 + + no_full_log + + + + + + + + 86601 + SURICATA STREAM ESTABLISHED packet out of window + Suricata: TCP stream out-of-window (likely retransmission/capture/offload) - noise reduction + no_full_log + + + + + + + + + 100632 + flow.src_ip + Suricata: Repeated TCP out-of-window packets from same host (possible evasion / unstable TCP stack / capture issue) + + T1046 + + no_full_log + + + + + + + + + + 86601 + ET INFO Session Traversal Utilities for NAT (STUN Binding Response) + Suricata: STUN binding response (likely WebRTC/VoIP) + no_full_log + + + + + + + 100640 + 192\.168\.12\.* + Suricata: STUN binding response (likely WebRTC/VoIP) - noise reduction + no_full_log + + + + + + + 100640 + 10\.17[0-9]\.[1|2]\. + Suricata: STUN binding response (likely WebRTC/VoIP) - noise reduction + no_full_log + + + + + + + + + 100640 + flow.src_ip + Suricata: Abnormal STUN activity burst (possible tunneling / unauthorized VoIP / P2P) + + T1071 + + no_full_log + + + + + + + + 86601 + SURICATA STREAM ESTABLISHED invalid ack + 8007 + + Ignore Suricata invalid ack between PBS during replication + no_full_log + + + + + + + 86601 + SURICATA STREAM ESTABLISHED invalid ack + 8007 + + Ignore Suricata invalid ack between PBS during replication + no_full_log + + + + + + + + 86601 + SURICATA STREAM ESTABLISHED packet out of window + 8007 + + Ignore Suricata out of window between PBS during replication + no_full_log + + + + + + + 86601 + SURICATA STREAM ESTABLISHED packet out of window + 8007 + + Ignore Suricata out of window between PBS during replication + no_full_log + + + diff --git a/brut-force.xml b/brut-force.xml new file mode 100644 index 0000000..529ed11 --- /dev/null +++ b/brut-force.xml @@ -0,0 +1,26 @@ + + + + 60122 + win.eventdata.ipAddress + Brut force + + + + + + + 100150 + ^Sandrine$ + Brut force + + + + + + + win.eventdata.ipAddress + 60105 + Brut force + + \ No newline at end of file diff --git a/local_rules.xml b/local_rules.xml new file mode 100644 index 0000000..f671193 --- /dev/null +++ b/local_rules.xml @@ -0,0 +1,60 @@ + + + + + + + + + + + 5716 + 1.1.1.1 + sshd: authentication failed from IP 1.1.1.1. + authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5, + + + + + + + + 60103 + ^4663$ + Alerte fichier modifié + + + + + + + + 60103 + ^4659$ + Alerte fichier supprimé + + + + + + + + 100146 + Écriture données (ou ajout fichier) + Alerte fichier Créé + + + + + + + 100146 + win.eventdata.subjectUserName + Fichier modifier en masse + + + + + diff --git a/unifi-rules.xml b/unifi-rules.xml new file mode 100644 index 0000000..941dcba --- /dev/null +++ b/unifi-rules.xml @@ -0,0 +1,175 @@ + + + + + unifi + reporter_save_config + UniFi noise: save_config + + + + + + unifi + need_cfg_save + UniFi noise: need_cfg_save + + + + + + unifi + use cached dns record + UniFi noise: cached dns record + + + + + + unifi + authkey: + UniFi sensitive: authkey ignored + + + + + + unifi + down + ^USW + UniFi Switch: port link DOWN (site=$(site), device=$(device), port=$(port)) + + + + + + unifi + down + ^SW + UniFi Switch: port link DOWN (site=$(site), device=$(device), port=$(port)) + + + + + + 100410 + site + device + port + UniFi Switch: port FLAPPING (3x DOWN/5min) site=$(site) device=$(device) port=$(port) + + + + + + 100411 + site + device + port + UniFi Switch: port FLAPPING (3x DOWN/5min) site=$(site) device=$(device) port=$(port) + + + + + + unifi + ^SW + Blocking + UniFi Switch: STP moved to BLOCKING (boucle réseau) site=$(site) device=$(device) port=$(port) + + + + + + unifi + ^USW + Blocking + UniFi Switch: STP moved to BLOCKING (boucle réseau) site=$(site) device=$(device) port=$(port) + + + + + + unifi + .+ + UniFi: DNS controller resolve failed for $(dns_host) (site=$(site), device=$(device)) + + + + + + unifi + .+ + UniFi: Impossible de contacter le controlleur ($(inform_error)) url=$(inform_url) (site=$(site), device=$(device)) + + + + + + unifi + Selfrun + UniFi: device switched to SELF-RUN (controller lost?) site=$(site) device=$(device) + + + + + + unifi + failure + UniFi WiFi: assoc/auth failure sta=$(sta_mac) vap=$(vap) ap=$(device) site=$(site) wpa_auth_failures=$(wpa_auth_failures) + + + + + + unifi + disassociated + UniFi WiFi: STA $(wifi_event) sta=$(sta_mac) vap=$(vap) ap=$(device) site=$(site) + + + + + + unifi + deauthenticated + UniFi WiFi: STA $(wifi_event) sta=$(sta_mac) vap=$(vap) ap=$(device) site=$(site) + + + + + + 100430 + site + sta_mac + UniFi WiFi: repeated auth failures (5x/2min) sta=$(sta_mac) site=$(site) vap=$(vap) + + + + + + 100430 + site + UniFi WiFi: many auth failures on site (30x/5min) site=$(site) + + + + + + + unifi + ath_bstuck_tasklet + UniFi WiFi: radio stuck beacon/reset (radio wifi répond pas = reset) (site=$(site)) msg=$(msg) + + + + + + 100440 + site + UniFi WiFi: repeated stuck beacon/reset (3x/10min) site=$(site) + +