Skip to content

local_rules.xml

Regras de correlação customizadas (IDs 100200 a 100214), aplicadas em /var/ossec/etc/rules/local_rules.xml.

<!--
  Wazuh 4.14.4 - Regras customizadas Windows + Linux
  Destino no manager: /var/ossec/etc/rules/local_rules.xml
  Validar antes de aplicar: /var/ossec/bin/wazuh-logtest
  Reiniciar apos aplicar: systemctl restart wazuh-manager
-->
<group name="local,windows,linux,">

  <!-- ===================== WINDOWS ===================== -->

  <rule id="100200" level="12">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^4104$</field>
    <field name="win.eventdata.ScriptBlockText" type="pcre2">(?i)(-enc\b|-EncodedCommand|FromBase64String|IEX\s*\(|DownloadString|Invoke-Expression)</field>
    <description>Windows PowerShell: possivel comando ofuscado/codificado em execucao</description>
    <mitre>
      <id>T1059.001</id>
    </mitre>
    <group>powershell,windows,attack,</group>
  </rule>

  <rule id="100201" level="10">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^4732$</field>
    <field name="win.eventdata.TargetGroupName">Administrators</field>
    <description>Windows: usuario $(win.eventdata.MemberName) adicionado ao grupo local Administrators</description>
    <mitre>
      <id>T1098</id>
    </mitre>
    <group>windows,privilege_escalation,</group>
  </rule>

  <rule id="100202" level="12">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^7036$</field>
    <field name="win.eventdata.param1" type="pcre2">(?i)(Windows Defender|Security Center|Sense|WinDefend)</field>
    <field name="win.eventdata.param2">stopped</field>
    <description>Windows: servico de seguranca $(win.eventdata.param1) foi parado</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
    <group>windows,defense_evasion,</group>
  </rule>

  <rule id="100203" level="5">
    <if_group>windows</if_group>
    <field name="win.system.eventID">^4625$</field>
    <description>Windows: tentativa de logon falhou para usuario $(win.eventdata.TargetUserName)</description>
    <group>windows,authentication_failed,</group>
  </rule>

  <rule id="100204" level="12" frequency="8" timeframe="120">
    <if_matched_sid>100203</if_matched_sid>
    <description>Windows: multiplas tentativas de logon falhas (possivel brute force) de $(win.eventdata.IpAddress)</description>
    <mitre>
      <id>T1110</id>
    </mitre>
    <group>windows,authentication_failures,</group>
  </rule>

  <!-- ===================== LINUX ===================== -->

  <rule id="100210" level="10">
    <if_group>sudo</if_group>
    <match>COMMAND=/bin/bash|COMMAND=/bin/sh|COMMAND=/usr/bin/su|COMMAND=/bin/su</match>
    <description>Linux: sudo usado para abrir shell interativo/su por $(dstuser)</description>
    <mitre>
      <id>T1548.003</id>
    </mitre>
    <group>linux,privilege_escalation,</group>
  </rule>

  <rule id="100211" level="12" frequency="8" timeframe="120">
    <if_matched_group>authentication_failed</if_matched_group>
    <match>sshd</match>
    <same_source_ip />
    <description>Linux: possivel brute force SSH a partir de $(srcip)</description>
    <mitre>
      <id>T1110</id>
    </mitre>
    <group>linux,authentication_failures,</group>
  </rule>

  <rule id="100212" level="12">
    <if_sid>550, 554</if_sid>
    <match>/etc/passwd|/etc/shadow|/etc/sudoers|/etc/ssh/sshd_config</match>
    <description>Linux: arquivo critico do sistema modificado - $(file)</description>
    <mitre>
      <id>T1098</id>
    </mitre>
    <group>linux,syscheck,</group>
  </rule>

  <rule id="100213" level="8">
    <if_group>syslog,linux</if_group>
    <match>new user|useradd</match>
    <description>Linux: nova conta de usuario criada no sistema</description>
    <mitre>
      <id>T1136.001</id>
    </mitre>
    <group>linux,account_changed,</group>
  </rule>

  <rule id="100214" level="10">
    <if_group>syslog,linux</if_group>
    <match>ufw disable|Firewall stopped|iptables: Flushing firewall rules</match>
    <description>Linux: firewall local desabilitado ou zerado</description>
    <mitre>
      <id>T1562.004</id>
    </mitre>
    <group>linux,defense_evasion,</group>
  </rule>

</group>