Hub configuration

Name: smb-logs
Author: crowdsecurity

More info

smb-logs Log Parser by crowdsecurity | CrowdSec Hub

« smb-logs »
v0.2 by crowdsecurity
Attack scenario

Parse SMB logs

Installation

cscli parsers install crowdsecurity/smb-logs

YAML Configuration

1onsuccess: next_stage
2name: crowdsecurity/smb-logs
3filter: evt.Parsed.program == 'smb'
4description: "Parse SMB logs"
5pattern_syntax:
6  SMB_BAD_PASSWORD: "Auth:%{GREEDYDATA} user \\[%{DATA:smb_domain}\\]\\\\\\[%{DATA:user}\\]%{GREEDYDATA} status \\[NT_STATUS_WRONG_PASSWORD\\]%{GREEDYDATA} remote host \\[ipv4:%{IP:ip_source}"
7nodes:
8 - grok:
9    name: "SMB_AUTH_FAIL"
10    apply_on: message
11    statics:
12      - meta: subtype
13        value: smb_bad_user
14 - grok:
15    name: "SMB_BAD_PASSWORD"
16    apply_on: message
17    statics:
18      - meta: subtype
19        value: smb_bad_password
20statics:
21  - meta: log_type
22    value: smb_failed_auth
23  - meta: source_ip
24    expression: "evt.Parsed.ip_source"
25  - meta: user
26    expression: "evt.Parsed.user"

Hub configuration

« smb-logs »v0.2 by crowdsecurityAttack scenario

« smb-logs »
v0.2 by crowdsecurity
Attack scenario