{"id":56,"date":"2010-03-15T18:34:01","date_gmt":"2010-03-15T18:34:01","guid":{"rendered":"https:\/\/defragged.org\/ossec\/?p=56"},"modified":"2020-07-01T18:35:45","modified_gmt":"2020-07-01T18:35:45","slug":"detecting-usb-storage-usage-with-ossec","status":"publish","type":"post","link":"https:\/\/defragged.org\/ossec\/2010\/03\/detecting-usb-storage-usage-with-ossec\/","title":{"rendered":"Detecting USB Storage Usage with OSSEC"},"content":{"rendered":"\n

Xavier<\/a> wrote a very interesting article on Detecting USB Storage Usage with OSSEC<\/a>. He used our policy auditing module for that, but I think USB monitoring can be done in a much easier way with our new check_diff<\/a> feature. You need our latest snapshot for it to work (or wait until v2.4 is out).<\/p>\n\n\n\n

To get started, first configure your Windows agents to monitor the USBSTOR registry entry using the reg command:<\/p>\n\n\n\n

<agent_config os=\"windows\">\n  <localfile>\n    <log_format>full_command<\/log_format>\n    <command>reg QUERY HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR<\/command>\n  <\/localfile>\n\n<\/agent_config><\/code><\/pre>\n\n\n\n
Next create a local rule for that command:<\/p>\n\n\n\n
<rule id=\"140125\" level=\"7\">\n    <if_sid>530<\/if_sid>\n    <match>ossec: output: 'reg QUERY<\/match>\n    <check_diff \/>\n    <description>New USB device connected<\/description>\n  <\/rule><\/code><\/pre>\n\n\n\n
Now after a few minutes you will see a directory at \/var\/ossec\/queue\/diff\/[agent_name]\/[rule_id] with the current snapshot of this command. Once someone adds a new USB device you will get this alert:<\/p>\n\n\n\n
** Alert 1268687754.35062: mail  - local,syslog,\n2010 Mar 15 18:15:54 (xx-netbook) any->reg QUERY HKLMSYSTEMCurrentControlSetEnumUSBSTOR\nRule: 140125 (level 7) -> 'New USB device connected'\nSrc IP: (none)\nUser: (none)\nossec: output: 'reg QUERY HKLMSYSTEMCurrentControlSetEnumUSBSTOR':! REG.EXE VERSION 3.0\n\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_&Prod_USB_Flash_Memory&Rev_5.00\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_Generic&Prod_Flash_Disk&Rev_8.0\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_Hitachi&Prod_HTS543225L9A300&Rev_\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_LEXAR&Prod_JD_FIREFLY&Rev_1100\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_SAMSUNG&Prod_HM160JC&Rev_0000\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_Sony&Prod_DSC&Rev_1.00\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_TomTom&Prod_ONE_XXL_IQ_Rts\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_USB_2.0&Prod_USB_Flash_Drive&Rev_0.00\n\nPrevious output:\n\nossec: output: 'reg QUERY HKLMSYSTEMCurrentControlSetEnumUSBSTOR':\n! REG.EXE VERSION 3.0\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_&Prod_USB_Flash_Memory&Rev_5.00\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_Generic&Prod_Flash_Disk&Rev_8.07\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_Hitachi&Prod_HTS543225L9A300&Rev_\nHKEY_LOCAL_ACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_SAMSUNG&Prod_HM160JC&Rev_0000\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_Sony&Prod_DSC&Rev_1.00\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_TomTom&Prod_ONE_XXL_IQ_Rts\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORDisk&Ven_USB_2.0&Prod_USB_Flash_Drive&R<\/code><\/pre>\n\n\n\n
I think we can expand this to create all sort of nice rules\u2026<\/p>\n","protected":false},"excerpt":{"rendered":"
Xavier wrote a very interesting article on Detecting USB Storage Usage with OSSEC. He used our policy auditing module for that, but I think USB monitoring can be done in a much easier way with our new check_diff feature. You need our latest snapshot for it to work (or wait until v2.4 is out). To get started, first configure […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/56"}],"collection":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/comments?post=56"}],"version-history":[{"count":1,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/56\/revisions"}],"predecessor-version":[{"id":57,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/56\/revisions\/57"}],"wp:attachment":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/media?parent=56"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/categories?post=56"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/tags?post=56"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}