Skip to content

Commit

Permalink
more bro patterns
Browse files Browse the repository at this point in the history
  • Loading branch information
@ChrisRimondi
ChrisRimondi committed Aug 22, 2013
1 parent 006bb61 commit 4c7e1cd
Show file tree
Hide file tree
Showing 2 changed files with 136 additions and 5 deletions.
106 changes: 105 additions & 1 deletion bro_patterns.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@
<test_value name="s0">HTTP::BROWSER</test_value>
<!-- name -->
<test_value name="s1">MSIE</test_value>
<!-- version -->
<!-- version_major -->
<test_value name="i2">5</test_value>
<!-- version_minor -->
<test_value name="i3">1</test_value>
Expand Down Expand Up @@ -205,4 +205,108 @@
</examples>
</rule>
</rules>
</ruleset>
<ruleset>
<pattern>bro_irc</pattern>
<rules>
<rule class="10027" id="10027">
<patterns>
<!-- start securityonion -->
<pattern>@ESTRING::|@@ESTRING:s0:|@@ESTRING:i0:|@@ESTRING:i1:|@@ESTRING:i2:|@@ESTRING:i3:|@@ANYSTRING:s1:@</pattern>
<!-- end securityonion -->
</patterns>
<examples>
<example>
<test_message program="bro_irc">1352413490.163439|FB2AqwMeEy4|192.168.1.12|1045|212.48.121.249|5050|NEW-[USA|00|P|23733]|XP-1630|JOIN|#!nn!| with channel key: 'test'|-|-|-|-</test_message>
<!-- eventid -->
<test_value name="s0">FB2AqwMeEy4</test_value>
<!-- srcip -->
<test_value name="i0">192.168.1.12</test_value>
<!-- srcport -->
<test_value name="i1">1045</test_value>
<!-- dstip -->
<test_value name="i2">212.48.121.249</test_value>
<!-- dstport -->
<test_value name="i3">5050</test_value>
<!-- bro_syslog_facility -->
<test_value name="s1">NEW-[USA|00|P|23733]|XP-1630|JOIN|#!nn!| with channel key: 'test'|-|-|-|-</test_value>
</example>
</examples>
</rule>
</rules>
</ruleset>
<ruleset>
<pattern>bro_known_cert</pattern>
<rules>
<rule class="10028" id="10028">
<patterns>
<!-- start securityonion -->
<pattern>@ESTRING::|@@ESTRING:i0:|@@ESTRING:i1:|@@ESTRING::CN=@@ESTRING:s0:,@@ESTRING::OU=@@ESTRING:s1:@@ESTRING::O=@@ESTRING:s2:,@@ESTRING::emailAddress=@@ESTRING:s3:,@</pattern>
<pattern>@ESTRING::|@@ESTRING:i0:|@@ESTRING:i1:|@@ESTRING::CN=@@ESTRING:s0:,@@ESTRING::OU=@@ESTRING:s1:@@ESTRING::O=@@ESTRING:s2:,@</pattern>
<!-- end securityonion -->
</patterns>
<examples>
<example>
<test_message program="bro_known_cert">1360154644.236015|10.2.20.60|443|
[email protected],CN=dox.site,OU=web server,O=SuSE Linux Web Server,L=unknown,ST=unknown,C=XY [email protected],CN=dox.site,OU=CA,O=SuSE Linux Web Server,L=unknown,ST=unknown,C=XY 02</test_message>
<!-- srcip -->
<test_value name="i0">10.2.20.60</test_value>
<!-- srcport -->
<test_value name="i1">443</test_value>
<!-- common_name -->
<test_value name="s0">dox.site</test_value>
<!-- organizational unit -->
<test_value name="s1">web server</test_value>
<!-- organization -->
<test_value name="s2">SuSE Linux Web Server</test_value>
<!-- email_address -->
<test_value name="s3">[email protected]</test_value>
</example>
</examples>
</rule>
</rules>
</ruleset>
<ruleset>
<pattern>bro_known_hosts</pattern>
<rules>
<rule class="10029" id="10029">
<patterns>
<!-- start securityonion -->
<pattern>@ESTRING::|@@ESTRING:i0:@</pattern>
<!-- end securityonion -->
</patterns>
<examples>
<example>
<test_message program="bro_known_hosts">1360154565.568704|192.168.3.35</test_message>
<!-- srcip -->
<test_value name="i0">192.168.3.35</test_value>
</example>
</examples>
</rule>
</rules>
</ruleset>
<ruleset>
<pattern>bro_known_services</pattern>
<rules>
<rule class="10030" id="10030">
<patterns>
<!-- start securityonion -->
<pattern>@ESTRING::|@@ESTRING:i0:|@@ESTRING:i1:|@@ESTRING:i2:|@@ESTRING:s0:@</pattern>
<!-- end securityonion -->
</patterns>
<examples>
<example>
<test_message program="bro_known_cert">1360154567.821951|192.168.10.100|2869|tcp|HTTP</test_message>
<!-- srcip -->
<test_value name="i0">192.168.10.100/test_value>
<!-- srcport -->
<test_value name="i1">2869</test_value>
<!-- proto -->
<test_value name="i2">tcp</test_value>
<!-- service -->
<test_value name="s0">HTTP</test_value>
</example>
</examples>
</rule>
</rules>
</ruleset>
35 changes: 31 additions & 4 deletions bro_schema.sql
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,18 @@ INSERT INTO fields (field, field_type, pattern_type) VALUES ("username", "string
INSERT INTO fields (field, field_type, pattern_type) VALUES ("password", "string", "QSTRING");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("command", "string", "QSTRING");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("arg", "string", "QSTRING");
#already a version field that's a string - INSERT INTO fields (field, field_type, pattern_type) VALUES ("version", "int", "NUMBER");

INSERT INTO fields (field, field_type, pattern_type) VALUES ("version_major", "int", "NUMBER");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("version_minor", "int", "NUMBER");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("direction", "string", "QSTRING");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("client", "string", "QSTRING");
/*just added */
INSERT INTO fields (field, field_type, pattern_type) VALUES ("bro_syslog_facility", "string", "QSTRING");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("bro_syslog_severity", "string", "QSTRING");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("bro_syslog_message", "string", "QSTRING");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("common_name", "string", "QSTRING");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("organizational_unit", "string", "QSTRING");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("organization", "string", "QSTRING");
INSERT INTO fields (field, field_type, pattern_type) VALUES ("email_address", "string", "QSTRING");


INSERT INTO classes (id, class, parent_id) VALUES(10021, "BRO_FTP", 0);
Expand Down Expand Up @@ -47,7 +51,7 @@ INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SOFTWARE"), (SELECT id FROM fields WHERE field="srcport"), 6);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SOFTWARE"), (SELECT id FROM fields WHERE field="type"), 11);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SOFTWARE"), (SELECT id FROM fields WHERE field="name"), 12);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SOFTWARE"), (SELECT id FROM fields WHERE field="version"), 7);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SOFTWARE"), (SELECT id FROM fields WHERE field="version_major"), 7);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SOFTWARE"), (SELECT id FROM fields WHERE field="version_minor"), 8);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SOFTWARE"), (SELECT id FROM fields WHERE field="product"), 13);

Expand All @@ -63,7 +67,6 @@ INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SSH"), (SELECT id FROM fields WHERE field="server"), 15);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SSH"), (SELECT id FROM fields WHERE field="conn_bytes"), 9);

/*just added */
INSERT INTO classes (id, class, parent_id) VALUES(10026, "BRO_SYSLOG", 0);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SYSLOG"), (SELECT id FROM fields WHERE field="eventid"), 11);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SYSLOG"), (SELECT id FROM fields WHERE field="srcip"), 5);
Expand All @@ -75,3 +78,27 @@ INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SYSLOG"), (SELECT id FROM fields WHERE field="bro_syslog_severity"), 13);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_SYSLOG"), (SELECT id FROM fields WHERE field="bro_syslog_message"), 14);

INSERT INTO classes (id, class, parent_id) VALUES(10027, "BRO_IRC", 0);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_IRC"), (SELECT id FROM fields WHERE field="eventid"), 11);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_IRC"), (SELECT id FROM fields WHERE field="srcip"), 5);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_IRC"), (SELECT id FROM fields WHERE field="srcport"), 6);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_IRC"), (SELECT id FROM fields WHERE field="dstip"), 7);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_IRC"), (SELECT id FROM fields WHERE field="dstport"), 8);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_IRC"), (SELECT id FROM fields WHERE field="desc"), 12);

INSERT INTO classes (id, class, parent_id) VALUES(10028, "BRO_KNOWN_CERTS", 0);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_CERTS"), (SELECT id FROM fields WHERE field="srcip"), 5);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_CERTS"), (SELECT id FROM fields WHERE field="srcport"), 6);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_CERTS"), (SELECT id FROM fields WHERE field="common_name"), 11);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_CERTS"), (SELECT id FROM fields WHERE field="organizational_unit"), 12);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_CERTS"), (SELECT id FROM fields WHERE field="organization"), 13);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_CERTS"), (SELECT id FROM fields WHERE field="email_address"), 14);

INSERT INTO classes (id, class, parent_id) VALUES(10029, "BRO_KNOWN_HOSTS", 0);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_HOSTS"), (SELECT id FROM fields WHERE field="srcip"), 5);

INSERT INTO classes (id, class, parent_id) VALUES(10030, "BRO_KNOWN_SERVICES", 0);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_SERVICES"), (SELECT id FROM fields WHERE field="srcip"), 5);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_SERVICES"), (SELECT id FROM fields WHERE field="srcport"), 6);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_SERVICES"), (SELECT id FROM fields WHERE field="proto"), 7);
INSERT INTO fields_classes_map (class_id, field_id, field_order) VALUES ((SELECT id FROM classes WHERE class="BRO_KNOWN_SERVICES"), (SELECT id FROM fields WHERE field="service"), 11);

0 comments on commit 4c7e1cd

Please sign in to comment.