KNEL/KNELSiem
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cb2a24eaf9690fd852a46c60eb2be4105e00b2ae
KNELSiem/rules/local_rules.xml
T
mrcharles bbbfa9fb90
ci / audit (push) Successful in 23s
Details
SOC: Wazuh alert tuning + #823-pattern detections 
16 level/frequency overrides (overwrite semantics documented), new
100500/100501/100510 WordPress-compromise rules, tuning doc with
before/after numbers. Zero L7+ email after deploy.

https://projects.knownelement.com/issues/825#note-5008
2026-09-06 14:09:49 -05:00

169 lines
8.3 KiB
XML
Raw Blame History

<group name="local,soc,">
<!-- KNEL SOC TUNING 2026-09-06 - Redmine #825, GLPI CR 23 -->
<!-- Overwrite rules: FULL original bodies, level/frequency changes ONLY -->
<!-- (Wazuh overwrite = replace, not merge - verified 2026-09-06). -->
<!-- Email (L7+, coo@) reserved for genuine incidents. -->
<!-- Rationale: KNEL/siem docs/wazuh-tuning.md -->
<rule id="31101" level="0" overwrite="yes">
<if_sid>31100</if_sid>
<id>^4</id>
<description>Web server 400 error code.</description>
<group>attack,pci_dss_6.5,pci_dss_11.4,gdpr_IV_35.7.d,nist_800_53_SA.11,nist_800_53_SI.4,tsc_CC6.6,tsc_CC7.1,tsc_CC8.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
</rule>
<rule id="31120" level="3" overwrite="yes">
<if_sid>31100</if_sid>
<id>^50</id>
<description>Web server 500 error code (server error).</description>
</rule>
<rule id="31122" level="3" overwrite="yes">
<if_sid>31120</if_sid>
<id>^500</id>
<description>Web server 500 error code (Internal Error).</description>
<group>system_error,</group>
</rule>
<rule id="31151" level="6" frequency="40" timeframe="240" overwrite="yes">
<if_matched_sid>31101</if_matched_sid>
<same_source_ip />
<description>Multiple web server 400 error codes </description>
<description>from same source ip.</description>
<mitre>
<id>T1595.002</id>
</mitre>
<group>web_scan,recon,pci_dss_6.5,pci_dss_11.4,gdpr_IV_35.7.d,nist_800_53_SA.11,nist_800_53_SI.4,tsc_CC6.6,tsc_CC7.1,tsc_CC8.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
</rule>
<rule id="5501" level="0" overwrite="yes">
<if_sid>5500</if_sid>
<match>session opened for user </match>
<description>PAM: Login session opened.</description>
<mitre>
<id>T1078</id>
</mitre>
<group>authentication_success,pci_dss_10.2.5,gpg13_7.8,gpg13_7.9,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
</rule>
<rule id="5502" level="0" overwrite="yes">
<if_sid>5500</if_sid>
<match>session closed for user </match>
<description>PAM: Login session closed.</description>
<group>pci_dss_10.2.5,gpg13_7.8,gpg13_7.9,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
</rule>
<rule id="23502" level="0" overwrite="yes">
<if_sid>23501</if_sid>
<options>no_full_log</options>
<field name="vulnerability.status">Solved</field>
<description>The $(vulnerability.cve) that affected $(vulnerability.package.name) was solved due to an update in the agent or feed.</description>
</rule>
<rule id="23503" level="3" overwrite="yes">
<if_sid>23501</if_sid>
<options>no_full_log</options>
<field name="vulnerability.status">Active</field>
<field name="vulnerability.severity">Low</field>
<description>$(vulnerability.cve) affects $(vulnerability.package.name)</description>
</rule>
<rule id="23504" level="4" overwrite="yes">
<if_sid>23501</if_sid>
<options>no_full_log</options>
<field name="vulnerability.status">Active</field>
<field name="vulnerability.severity">Medium|Untriaged</field>
<description>$(vulnerability.cve) affects $(vulnerability.package.name)</description>
</rule>
<rule id="23505" level="6" overwrite="yes">
<if_sid>23501</if_sid>
<options>no_full_log</options>
<field name="vulnerability.status">Active</field>
<field name="vulnerability.severity">High</field>
<description>$(vulnerability.cve) affects $(vulnerability.package.name)</description>
</rule>
<rule id="23506" level="6" overwrite="yes">
<if_sid>23501</if_sid>
<options>no_full_log</options>
<field name="vulnerability.status">Active</field>
<field name="vulnerability.severity">Critical</field>
<description>$(vulnerability.cve) affects $(vulnerability.package.name)</description>
</rule>
<rule id="23507" level="0" overwrite="yes">
<decoded_as>json</decoded_as>
<options>no_full_log</options>
<field name="vulnerability.status">Clear</field>
<description>Vulnerabilities cleared</description>
</rule>
<rule id="19007" level="5" overwrite="yes">
<if_sid>19006</if_sid>
<field name="sca.check.result">^failed</field>
<options>no_full_log</options>
<description>$(sca.policy): $(sca.check.title)</description>
</rule>
<rule id="2902" level="3" overwrite="yes">
<if_sid>2900</if_sid>
<field name="dpkg_status">^status installed$</field>
<description>New dpkg (Debian Package) installed.</description>
<group>config_changed,pci_dss_10.6.1,pci_dss_10.2.7,gpg13_4.10,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.6,nist_800_53_AU.14,tsc_CC7.2,tsc_CC7.3,tsc_CC6.8,tsc_CC8.1,</group>
</rule>
<rule id="2904" level="3" overwrite="yes">
<if_sid>2900</if_sid>
<field name="dpkg_status">^status half-configured$</field>
<description>Dpkg (Debian Package) half configured.</description>
<group>config_changed,pci_dss_10.6.1,pci_dss_10.2.7,gpg13_4.10,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.6,nist_800_53_AU.14,tsc_CC7.2,tsc_CC7.3,tsc_CC6.8,tsc_CC8.1,</group>
</rule>
<rule id="550" level="5" overwrite="yes">
<category>ossec</category>
<decoded_as>syscheck_integrity_changed</decoded_as>
<description>Integrity checksum changed.</description>
<mitre>
<id>T1565.001</id>
</mitre>
<group>syscheck,syscheck_entry_modified,syscheck_file,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,tsc_PI1.4,tsc_PI1.5,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
</rule>
<rule id="2502" level="5" overwrite="yes">
<match>more authentication failures;|REPEATED login failures</match>
<description>syslog: User missed the password more than one time</description>
<mitre>
<id>T1110</id>
</mitre>
<group>authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5,gpg13_7.8,gdpr_IV_35.7.d,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
</rule>
<rule id="5551" level="6" frequency="8" timeframe="180" overwrite="yes">
<if_matched_sid>5503</if_matched_sid>
<same_source_ip />
<description>PAM: Multiple failed logins in a small period of time.</description>
<mitre>
<id>T1110</id>
</mitre>
<group>authentication_failures,pci_dss_10.2.4,pci_dss_10.2.5,pci_dss_11.4,gpg13_7.8,gdpr_IV_35.7.d,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14,nist_800_53_AC.7,nist_800_53_SI.4,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
</rule>
<rule id="31510" level="6" frequency="20" timeframe="120" overwrite="yes">
<if_matched_sid>31509</if_matched_sid>
<same_source_ip />
<description>CMS (WordPress or Joomla) brute force attempt.</description>
<mitre>
<id>T1110</id>
</mitre>
<group>pci_dss_6.5,pci_dss_11.4,pci_dss_6.5.10,pci_dss_10.2.4,pci_dss_10.2.5,gdpr_IV_35.7.d,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_SA.11,nist_800_53_SI.4,nist_800_53_AU.14,nist_800_53_AC.7,tsc_CC6.6,tsc_CC7.1,tsc_CC8.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
</rule>
<rule id="40704" level="3" overwrite="yes">
<if_sid>40700</if_sid>
<match>status=1/FAILURE</match>
<description>Systemd: Service exited due to a failure.</description>
<group>gpg13_4.3,gdpr_IV_35.7.d,</group>
</rule>
<!-- SOC DETECTIONS - #823 ezeda.org WordPress compromise pattern -->
<rule id="100500" level="12">
<if_group>syscheck</if_group>
<field name="file">wp-config\.php$</field>
<description>Cloudron: wp-config.php changed - #823-pattern persistence vector (backdoor was injected here). Verify the change is sanctioned.</description>
<mitre><id>T1505.003</id></mitre>
</rule>
<rule id="100501" level="10">
<if_group>syscheck</if_group>
<field name="file">uploads/.*\.php$</field>
<description>Cloudron: PHP file in uploads dir - #823-pattern webshell staging (41 webshells found there 2026-09-06).</description>
<mitre><id>T1505.003</id></mitre>
</rule>
<rule id="100510" level="8">
<if_sid>31100, 31101, 31103, 31104, 31106, 31108, 31109, 31110, 31115, 31120, 31121, 31122, 31123</if_sid>
<match>uploads/.*\.php</match>
<description>Cloudron: web request to PHP inside uploads - possible webshell access (#823 pattern).</description>
<mitre><id>T1505.003</id></mitre>
</rule>
</group>
Reference in New Issue View Git Blame Copy Permalink