| Les deux révisions précédentesRévision précédente | |
| linux:rewinged [2026/09/18 16:40] – root | linux:rewinged [2026/09/18 17:40] (Version actuelle) – [13.2 Règles personnalisées] root |
|---|
| <file xml /var/ossec/etc/rules/local_rules.xml> | <file xml /var/ossec/etc/rules/local_rules.xml> |
| <group name="winget,rewinged,"> | <group name="winget,rewinged,"> |
| |
| <!-- ============ Journal applicatif rewinged ============ --> | |
| |
| <rule id="100600" level="0"> | <rule id="100600" level="0"> |
| <decoded_as>json</decoded_as> | <decoded_as>json</decoded_as> |
| <field name="message">\.</field> | |
| <location>/var/log/rewinged/rewinged.log</location> | <location>/var/log/rewinged/rewinged.log</location> |
| <description>rewinged: evenement applicatif</description> | <description>rewinged: evenement applicatif</description> |
| <rule id="100601" level="7"> | <rule id="100601" level="7"> |
| <if_sid>100600</if_sid> | <if_sid>100600</if_sid> |
| <field name="level">^error$</field> | <field name="level">error</field> |
| <description>rewinged: erreur applicative - $(message)</description> | <description>rewinged: erreur applicative</description> |
| <group>service_availability,</group> | |
| </rule> | </rule> |
| |
| <if_sid>100601</if_sid> | <if_sid>100601</if_sid> |
| <field name="message">ingestManifests</field> | <field name="message">ingestManifests</field> |
| <description>rewinged: echec d'ingestion des manifests - source potentiellement vide</description> | <description>rewinged: echec ingestion des manifests - $(message)</description> |
| <group>service_availability,</group> | |
| </rule> | </rule> |
| |
| <rule id="100603" level="3"> | |
| <if_sid>100600</if_sid> | |
| <field name="message">found \d+ package manifests</field> | |
| <description>rewinged: rechargement des manifests</description> | |
| </rule> | |
| |
| <!-- ============ Synchronisation ============ --> | |
| |
| <rule id="100610" level="3"> | <rule id="100610" level="3"> |
| <match>Publication verifiee</match> | <match>Publication verifiee</match> |
| <description>winget: publication synchronisee et verifiee</description> | <description>winget: publication synchronisee et verifiee</description> |
| <group>winget_publication,</group> | |
| </rule> | </rule> |
| |
| <program_name>winget-sync</program_name> | <program_name>winget-sync</program_name> |
| <match>SIGNATURE INVALIDE</match> | <match>SIGNATURE INVALIDE</match> |
| <description>winget: commit non signe ou signature invalide - synchronisation annulee</description> | <description>winget: signature invalide - synchronisation annulee</description> |
| <group>attack,winget_publication,</group> | <group>attack,</group> |
| </rule> | </rule> |
| |
| <rule id="100612" level="10" frequency="5" timeframe="1800"> | <rule id="100612" level="10" frequency="5" timeframe="1800"> |
| <if_matched_sid>100601</if_matched_sid> | <if_matched_sid>100601</if_matched_sid> |
| <description>winget: echecs repetes de synchronisation - depot potentiellement fige</description> | <description>winget: erreurs applicatives repetees</description> |
| <group>service_availability,</group> | |
| </rule> | </rule> |
| |
| <!-- ============ Integrite des fichiers ============ --> | |
| |
| <!-- Manifests : bruit attendu a chaque publication. | |
| Niveau informatif, le controle reel est la signature GPG (100611). --> | |
| <rule id="100620" level="3"> | <rule id="100620" level="3"> |
| <if_group>syscheck</if_group> | <if_group>syscheck</if_group> |
| <field name="file">^/srv/winget/manifests/</field> | <field name="file">/srv/winget/manifests/</field> |
| <description>winget: manifest modifie - $(file)</description> | <description>winget: manifest modifie - $(file)</description> |
| <group>winget_publication,</group> | |
| </rule> | </rule> |
| |
| <!-- Installeur modifie : un binaire remplace sans nouveau manifest | |
| est anormal, le SHA256 ne correspondrait plus. --> | |
| <rule id="100621" level="12"> | <rule id="100621" level="12"> |
| <if_group>syscheck</if_group> | <if_group>syscheck</if_group> |
| <field name="file">^/srv/winget/installers/</field> | <field name="file">/srv/winget/installers/</field> |
| <description>winget: installeur modifie ou remplace - $(file)</description> | <description>winget: installeur modifie - $(file)</description> |
| <group>attack,</group> | <group>attack,</group> |
| </rule> | </rule> |
| |
| <!-- Binaire rewinged ou script de synchronisation --> | |
| <rule id="100622" level="14"> | <rule id="100622" level="14"> |
| <if_group>syscheck</if_group> | <if_group>syscheck</if_group> |
| <field name="file">^/usr/local/bin/(rewinged|winget-sync\.sh)$</field> | <field name="file">/usr/local/bin/rewinged</field> |
| <description>winget: binaire de service modifie - $(file)</description> | <description>winget: binaire rewinged modifie - $(file)</description> |
| <group>attack,</group> | <group>attack,</group> |
| </rule> | </rule> |
| |
| <!-- Unites systemd du service --> | |
| <rule id="100623" level="12"> | |
| <if_group>syscheck</if_group> | |
| <field name="file">^/etc/systemd/system/(rewinged|winget-sync)\.</field> | |
| <description>winget: unite systemd modifiee - $(file)</description> | |
| <group>attack,</group> | |
| </rule> | |
| |
| <!-- ============ Disponibilite des services ============ --> | |
| |
| <rule id="100630" level="0"> | <rule id="100630" level="0"> |
| <rule id="100631" level="10"> | <rule id="100631" level="10"> |
| <if_sid>100630</if_sid> | <if_sid>100630</if_sid> |
| <match>inactive|failed|unknown</match> | <regex>inactive|failed|unknown</regex> |
| <description>winget: service rewinged ou timer de synchronisation arrete</description> | <description>winget: service rewinged ou timer arrete</description> |
| <group>service_availability,</group> | |
| </rule> | </rule> |
| |
