From 9476f92029c543a44d975aa8452fd4133a2bb2d5 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Sun, 6 Sep 2026 16:17:45 -0500
Subject: [PATCH] [#825] SOC sweep: UCS machine-account suppression (CR 24) +
 churn root causes

https://projects.knownelement.com/issues/825
---
 docs/wazuh-tuning.md  | 13 +++++++++++++
 rules/local_rules.xml |  6 ++++++
 2 files changed, 19 insertions(+)

diff --git a/docs/wazuh-tuning.md b/docs/wazuh-tuning.md
index f93ba2d..c7f79dc 100644
--- a/docs/wazuh-tuning.md
+++ b/docs/wazuh-tuning.md
@@ -93,3 +93,16 @@ sshd successes: visible for triage, below every notification path.
 5. Re-check email volume at coo@ weekly; tune further only on evidence.
 6. Vulnerability backlog: OpenVAS scans (GLPI-fed targets) → tickets per the triage
    standard; Wazuh vuln alerts feed the same weekly review.
+
+## Sweep additions
+
+**2026-09-06 (CR 24):** rule 100520 (L3) — UCS machine-account SSH probe suppression:
+`tsys-ucs-02$` → tsys-ucs-01 every 20 min is a UCS domain artifact (verified in
+auth.log), not an intrusion. Narrow match: if_sid 5710 + srcip 100.68.10.17 + pcre2
+`Invalid user tsys-ucs-02\$`. All other invalid-user attempts stay L5. Gotchas that
+bit during apply: `srcuser` is not a valid rule element in 4.14 (use regex on the log),
+OSMatch `$` anchors and does not escape reliably — use `<regex type="pcre2">`.
+
+**Known remaining churn (L3, dashboard-only, tracked):** 40704 systemd failures
+dominated by `nut-driver@tripplite.service` (pfv-tsys5) and `dell-fan-control.service`
+(pfv-tsys9) arriving via remote syslog — infra-ops crash-loops, not security.
diff --git a/rules/local_rules.xml b/rules/local_rules.xml
index 9ccf66c..1321f6b 100644
--- a/rules/local_rules.xml
+++ b/rules/local_rules.xml
@@ -159,6 +159,12 @@
     <description>Cloudron: PHP file in uploads dir - #823-pattern webshell staging (41 webshells found there 2026-09-06).</description>
     <mitre><id>T1505.003</id></mitre>
   </rule>
+  <rule id="100520" level="3">
+    <if_sid>5710</if_sid>
+    <srcip>100.68.10.17</srcip>
+    <regex type="pcre2">Invalid user tsys-ucs-02\$</regex>
+    <description>UCS machine-account SSH probe (tsys-ucs-02$ from tsys-ucs-02 every 20min, UCS domain artifact CR 24 - dispositioned L3).</description>
+  </rule>
   <rule id="100510" level="8">
     <if_sid>31100, 31101, 31103, 31104, 31106, 31108, 31109, 31110, 31115, 31120, 31121, 31122, 31123</if_sid>
     <match>uploads/.*\.php</match>