postfix rules

[George Paun]

Hi guys,

I'm trying to create some rules for Postfix or Rspamd that will trigger when someone sends multiple emails with the same subject in a short period of time, and another one for when someone sends a large volume of emails with different subjects. I have created the following decoders and rules.

Thanks,

George

[George Paun]

Also i put in Ossec:

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/exim_mainlog</location>
</localfile>

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/maillog</location>
</localfile>

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/mail.log</location>
</localfile>

<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/rspamd/rspamd.log</location>
</localfile>

[hasitha.u...@wazuh.com]

Hi George,

Please let me know if you encounter any issues with the shared custom ruleset or if you need any assistance improving the decoders or rules.

If you are still unable to get the expected results, could you please share the sample logs for each detection requirement separately? Also, please provide a clear description of the issue you are facing, including what you expected to happen and what result you are currently getting.

For example, you can refer to below documents to have more details regarding decoders and rules:

• Custom Decoder
• Decoder syntax
• Custom decoder and rule creation blog
• Rule syntax
• Custom rules

Let me know the update on this, with sample logs so we can check further.

[George Paun]

Hy Hasitha,

The rules dont trigger and i dont know if i do something wrong or i miss something

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/CfhCsaUSHOw/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/e0d8459c-bf02-4572-98df-ec77c31bafebn%40googlegroups.com.

[hasitha.u...@wazuh.com]

Hi George,

Thanks for the update.

To replicate this scenario on my end and review it properly, could you please share a few sample logs in text format? Please make sure to mask or remove any sensitive information before sharing them.

Without the sample logs, I won’t be able to accurately validate the decoders and rules or confirm what needs to be adjusted.

You can also test the sample logs using the wazuh-logtest tool to check how Wazuh is currently decoding and matching them.

Please let me know once you have an update, and I’ll be happy to check further.

[hasitha.u...@wazuh.com]

Hi George,

If you still need help with this, please feel free to share some sample logs. I’ll review them and try to replicate the issue on my end.

Thanks!

[George Paun]

Hi Hashita,

i put here the logo from server and the decoders i make . i need to  make a rule for sender(from=) tu see if anyone make spam .

Thanks,

George

[hasitha.u...@wazuh.com]

Hi George,

It looks like the decoders and rules were generated by an LLM. Initially, the decoder you shared wasn't matching at all, but after some testing I was able to get it working.

You can replace your existing custom decoders with the ones below. The custom decoder files are located in:

/var/ossec/etc/decoders

1. <decoder name="custom-postfix-base">
2.   <prematch>\.+postfix</prematch>
3. </decoder>
4.  
5. <decoder name="postfix-mail-child">
6.   <parent>custom-postfix-base</parent>
7.   <regex>\.+postfix/\S+[(\d+)]:</regex>
8.   <order>queue_id</order>
9. </decoder>
10.  
11. <decoder name="postfix-mail-child">
12.   <parent>custom-postfix-base</parent>
13.   <regex>from=(\.+)\s\S+=</regex>
14.   <order>srcuser</order>
15. </decoder>
16.  
17. <decoder name="postfix-mail-child">
18.   <parent>custom-postfix-base</parent>
19.   <regex>to=(\.+)\s\S+=</regex>
20.   <order>user</order>
21. </decoder>
22.  
23. <decoder name="postfix-mail-child">
24.   <parent>custom-postfix-base</parent>
25.   <regex>subject="(\.+)"\s\S+=</regex>
26.   <order>subject</order>
27. </decoder>

I modified the parent rule to use the parent decoder; otherwise, they won't be linked correctly. You can replace the custom rule you've added in the /var/ossec/etc/rules/ folder with this one.

1. <group name="custom-alert">
2.  
3. <rule id="102008" level="1">
4.     <decoded_as>custom-postfix-base</decoded_as>
5.     <match>from=</match>
6.     <description>Postfix email detected</description>
7. </rule>
8.  
9.  
10. <rule id="102009" level="12" frequency="1000" timeframe="60">
11.     <if_matched_sid>102008</if_matched_sid>
12.     <description>Posibil spam - volum mare emailuri Postfix</description>
13. </rule>
14.  
15. </group>

I tested it, and it looks like the last rule isn't working. I haven't found the root cause yet, but once I figure out a workaround, I'll share it with you.

Ref:
Decoders Syntax - Ruleset XML syntax
Custom Decoders
Wazuh Regex
Custom rules
Rule syntax

[George Paun]

Hy Hashita, 

Thx for response. And now with the new decoders can i make a rule for bulk massages from an user/sender?

Thx,

George

To view this discussion visit https://groups.google.com/d/msgid/wazuh/fe354a0f-35b1-418b-882c-fe9695eb4fddn%40googlegroups.com.

[George Paun]

Hy Hashita,

When i put the decoders in custom decoders i have syntax error. I modify the name (i  I thought that the name is the cause) and i have same error.

Thx, George

[hasitha.u...@wazuh.com]

Hi George,

Apologies for the delay. If you change the decoder name, it may affect the child decoders if they are not updated accordingly. Similarly, changing the parent decoder name may also affect the parent rules.

Before adding these custom rules, we first need to identify what is causing the syntax error and find the root cause. Please share the manager's ossec.log after restarting the Wazuh manager.

Please run the following commands and share the output:

systemctl restart wazuh-manager
systemctl status wazuh-manager -l
cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"

If the syntax issue has already been resolved, please proceed with updating the rules I shared below. 
 You can update the custom rules in the following path for Postfix:

/var/ossec/etc/rules

1. <group name="postfix,mail">
2.  
3.  <!-- Same, for logs whose syslog header does not pre-decode -->
4.   <rule id="100630" level="5">
5.     <decoded_as>custom-postfix-base</decoded_as>
6.     <description>Postfix: message rejected by milter from $(srcuser) ($(srcip))</description>
7.     <group>mail_rejected,milter_rejected,spam,</group>
8.   </rule>
9.  
10.   <!-- Many milter rejections for the SAME sender -->
11.   <rule id="100621" level="10" frequency="10" timeframe="120">
12.     <if_matched_group>milter_rejected</if_matched_group>
13.     <same_srcuser />
14.     <description>Postfix: possible spam - sender $(srcuser) had many messages rejected by the milter</description>
15.     <group>mail_spam,</group>
16.   </rule> </group>

Then test with wazuh-logtest to verify updated rules are working.
/var/ossec/bin/wazuh-logtest

Please let me know the update once this has been completed.

Ref:

Decoders Syntax - Ruleset XML syntax
Custom Decoders
Wazuh Regex
Custom rules
Rule syntax