Thanks to everyone who gave advice. If nothing else I am learning a lot. I
set the new rules but I am not getting any alarms but my event view is getting
pounded by more failed logon attempts. This time by a device call \\ENDO.
My snort is working I am getting other netbios alarms from another rule set:
[**] [1:530:3] NETBIOS NT NULL session [**]
[Classification: Attempted Information Leak] [Priority: 2]
01/26-12:22:32.905683 192.168.38.45:1382 -> 172.30.10.12:139
TCP TTL:123 TOS:0x0 ID:35000 IpLen:20 DgmLen:216 DF
***AP*** Seq: 0x37BEFB5 Ack: 0xC460D626 Win: 0x21D1 TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS204][Xref =>
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0347][Xref =>
http://www.securityfocus.com/bid/1163]
[**] [1:538:1] NETBIOS SMB IPC$access [**]
[Classification: Attempted Information Leak] [Priority: 2]
01/26-12:22:32.905683 192.168.38.45:1382 -> 172.30.10.12:139
TCP TTL:123 TOS:0x0 ID:35000 IpLen:20 DgmLen:216 DF
***AP*** Seq: 0x37BEFB5 Ack: 0xC460D626 Win: 0x21D1 TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS334]
These I think are from old Windows NT servers trying to establish a null or
anonymous connection. I think that is normal.
Is there any other rules out there or is it possible to right a new rule that
can catch this event so I can find a source IP address?
Here is the latest event:
Event Type: Audit Failure
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 1/26/2005
Time: 7:22:29 AM
User: SYSTEM
Computer: COM1
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: uucp
Source Workstation: \\ENDO
Error Code: 0xC0000064
Thanks,
Brian
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
