{"action":"created","issue":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/173","repository_url":"https://api.github.com/repos/wazuh/wazuh","labels_url":"https://api.github.com/repos/wazuh/wazuh/issues/173/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh/issues/173/comments","events_url":"https://api.github.com/repos/wazuh/wazuh/issues/173/events","html_url":"https://github.com/wazuh/wazuh/issues/173","id":253939608,"number":173,"title":"rootcheck on AWS False Positive but configurable ignore rules","user":{"login":"garyfeltham","id":4555938,"avatar_url":"https://avatars2.githubusercontent.com/u/4555938?v=4","gravatar_id":"","url":"https://api.github.com/users/garyfeltham","html_url":"https://github.com/garyfeltham","followers_url":"https://api.github.com/users/garyfeltham/followers","following_url":"https://api.github.com/users/garyfeltham/following{/other_user}","gists_url":"https://api.github.com/users/garyfeltham/gists{/gist_id}","starred_url":"https://api.github.com/users/garyfeltham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garyfeltham/subscriptions","organizations_url":"https://api.github.com/users/garyfeltham/orgs","repos_url":"https://api.github.com/users/garyfeltham/repos","events_url":"https://api.github.com/users/garyfeltham/events{/privacy}","received_events_url":"https://api.github.com/users/garyfeltham/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-08-30T09:46:34Z","updated_at":"2017-09-01T15:26:15Z","closed_at":null,"author_association":"NONE","body":"Hi guys,\r\n\r\nI'm getting a false positive when running a root check as\r\n\r\n> Rule: 510 fired (level 7) -> \"Host-based anomaly detection event (rootcheck).\"\r\n> Portion of the log(s):\r\n> \r\n> File '/dev/.blkid.tab' present on /dev. Possible hidden file.\r\n> title: File present on /dev.\r\n> file: /dev/.blkid.tab\r\n\r\nConfiguration is standard as\r\n\r\n<rootcheck>\r\n  <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>\r\n  <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>\r\n  <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>\r\n  <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit>\r\n</rootcheck>\r\n\r\nThe file /dev/.blkid.tab as I understand, is created by AWS to mount volumes on the device\r\n`<device DEVNO=\"0xca00\" TIME=\"1503999931.820549\" LABEL=\"cloudimg-rootfs\" UUID=\"**redacted**\" TYPE=\"ext4\">/dev/xvda</device>`\r\n\r\nit is constantly being updated and therefore has been added as a FIM ignore rule.\r\n\r\nThe rootkit alert picks up that the file is present howeve as I understand there is no way to add a false positive in configuration.\r\n\r\nThe source file `src/rootcheck/check_rc_dev.c` seems to have this ability hard coded\r\n\r\n```const char *(ignore_dev[]) = {\"MAKEDEV\", \"README.MAKEDEV\",\r\n                                  \"MAKEDEV.README\", \".udevdb\",\r\n                                  \".udev.tdb\", \".initramfs-tools\",\r\n                                  \"MAKEDEV.local\", \".udev\", \".initramfs\",\r\n                                  \"oprofile\", \"fd\", \"cgroup\",```\r\n\r\nor\r\n\r\n```/* Full path ignore */\r\n    const char *(ignore_dev_full_path[]) = {\"/dev/shm/sysconfig\",\r\n                                            \"/dev/bus/usb/.usbfs\",\r\n                                            \"/dev/shm\",\r\n                                            \"/dev/gpmctl\",\r\n                                            NULL\r\n                                           };\r\n```\r\n\r\nIt would be nice to be able to configure these in a .txt file or within the ossec.xml.\r\n\r\nAm I missing a configuration option?\r\n"},"comment":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/comments/326610171","html_url":"https://github.com/wazuh/wazuh/issues/173#issuecomment-326610171","issue_url":"https://api.github.com/repos/wazuh/wazuh/issues/173","id":326610171,"user":{"login":"snaow","id":1519428,"avatar_url":"https://avatars2.githubusercontent.com/u/1519428?v=4","gravatar_id":"","url":"https://api.github.com/users/snaow","html_url":"https://github.com/snaow","followers_url":"https://api.github.com/users/snaow/followers","following_url":"https://api.github.com/users/snaow/following{/other_user}","gists_url":"https://api.github.com/users/snaow/gists{/gist_id}","starred_url":"https://api.github.com/users/snaow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snaow/subscriptions","organizations_url":"https://api.github.com/users/snaow/orgs","repos_url":"https://api.github.com/users/snaow/repos","events_url":"https://api.github.com/users/snaow/events{/privacy}","received_events_url":"https://api.github.com/users/snaow/received_events","type":"User","site_admin":false},"created_at":"2017-09-01T15:26:14Z","updated_at":"2017-09-01T15:26:14Z","author_association":"OWNER","body":"Hi @garyfeltham,\r\n\r\nYou are right, some rootcheck settings (as directory scanned) are hardcoded, we plan to move them out to a configuration file, it could be a txt file or probably we could use ossec.conf.\r\nCreating a while-list for certain directories will be perfect.\r\n\r\nAside of that, you can create a rule to ignore/silence those alerts, following these steps:\r\n\r\nCreate a local rule at `/var/ossec/etc/rules/local_rules.xml` like this one:\r\n\r\n```\r\n<rule id=\"100001\" level=\"0\">\r\n  <if_sid>510</if_sid>\r\n  <match>/dev/.blkid.tab</match> \r\n  <description>Ignore /dev/.blkid.tab</description> \r\n</rule>\r\n```\r\n\r\nLet us know if it works.\r\n\r\nBest regards,\r\nPedro.\r\n\r\n"}}
{"actor":{"display_login":"snaow"}}