Suspicious Named Error

 1title: Suspicious Named Error
 2id: c8e35e96-19ce-4f16-aeb6-fd5588dc5365
 3status: test
 4description: Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
 5references:
 6    - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml
 7author: Florian Roth (Nextron Systems)
 8date: 2018/02/20
 9modified: 2022/10/05
10tags:
11    - attack.initial_access
12    - attack.t1190
13logsource:
14    product: linux
15    service: syslog
16detection:
17    keywords:
18        - ' dropping source port zero packet from '
19        - ' denied AXFR from '
20        - ' exiting (due to fatal error)'
21    condition: keywords
22falsepositives:
23    - Unknown
24level: high

References

• ossec-hids/etc/rules/named_rules.xml at 1ecffb1b884607cb12e619f9ab3c04f530801083 · ossec/ossec-hids

  

  OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. - os...

  
  Read More

Related rules

• Hack Tool User Agent
• Suspicious MSExchangeMailboxReplication ASPX Write
• Suspicious OpenSSH Daemon Error
• Suspicious VSFTPD Error Messages
• Django Framework Exceptions