Help in modifying rules.

[DIWAHAR RAHAWID]

Hi Team,

I have a custom rule configured to monitor logon failures on the servers. Currently, the rule generates alerts for both user logon failures and system internal logon failures, where the system failures appear with the username WINDOWS$.

I would like to split this into two separate rules:

• One rule to monitor only user logon failures

• Another rule to monitor system internal logon failures

The existing rule is shown below for reference. Please share your suggestions or best practices to implement this effectively.

<group name="RemoteLogon"> 

 <!-- Detects Windows failed logons (Event ID 4625) with remote source info --> 

<rule id="100888" level="16"> 

 <if_sid>60122</if_sid>

<field name="win.system.eventID">^4625$</field> 

<description> Windows logon failure by user $(win.eventdata.targetUserName) from source IP $(win.eventdata.ipAddress) (Workstation: $(win.eventdata.workstationName)) </description> 

 <mitre> 

 <id>T1110</id> 

 <id>T1078</id> 

 </mitre> 

 <group>windows, authentication, logon failure, remote</group> 

 </rule> 

</group>

Your suggestions would be greatly appreciated.

[Stuti Gupta]

Hi,

You can split your existing custom rule into two separate rules using the win.eventdata.targetUserName field in Wazuh. This allows you to differentiate between user logon failures from system internal logon failures (machine accounts like WINDOWS$). You can custom rule for the  system internal logon failures 

<group name="RemoteLogon">

  <rule id=" 100888" level="16">
    <if_sid>60122</if_sid>
    <field name="win.system.eventID">^4625$</field>

    <!-- Exclude machine/system accounts ending with $ -->
    <field name="win.eventdata.targetUserName">SYSTEM</field>
    <description>Windows user logon failure: $(win.eventdata.targetUserName) from IP $(win.eventdata.ipAddress)</description>
  </rule>
</group>

For the user logon failures, the default rule ID 60122  will trigger. To know more about custom rules: https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rules.html