D-11
User Guide for Cisco Security MARS Local Controller
78-17020-01
Appendix D System Rules and Reports
List of System Rules
This correlation rule detects specific attacks on a FTP server followed by suspicious activity on the
targeted host. Suspicious activity may include the host scanning the network, creating excessive
firewall deny traffic, a backdoor opening up at the server etc. The attack may be preceded by
reconnaissance attempts targeted to that host. The attacks to a FTP server include buffer overflows,
remote command execution attempts using FTP server privileges, denial of service attempts.
•
System Rule: Server Attack: Login - Attempt.
This correlation rule detects attacks on login services on a host, preceded by reconnaissance
attempts targeted to that host, if any. Login services include Telnet, SSH, R-protocols such as Rsh,
Rlogin, Rexec etc. The attacks include buffer overflows, privilege escalation attempts to become
root, denial of service attempts etc.
•
System Rule: Server Attack: Login - Success Likely.
This correlation rule detects specific attacks on login services on a host (e.g. Telnet, SSH,
R-protocols such as Rsh, Rlogin, Rexec etc.) followed by suspicious activity on the targeted host.
Suspicious activity may include the host scanning the network, creating excessive firewall deny
traffic, a backdoor opening up at the server etc. The attack may be preceded by reconnaissance
attempts targeted to that host. The attacks to a login server include buffer overflows, remote
command execution attempts using the server privileges, denial of service attempts.
•
System Rule: Server Attack: Mail - Attempt.
This correlation rule detects attacks on mail services (SMTP, POP, IMAP) on a host, preceded by
reconnaissance attempts targeted to that host, if any. The attacks to mail services include buffer
overflows, remote command execution attempts, privilege escalation attempts to become root,
denial of service attempts etc.
•
System Rule: Server Attack: Mail - Success Likely.
This correlation rule detects specific attacks on mail services (SMTP, POP, IMAP) on a host
followed by suspicious activity on the targeted host. Suspicious activity may include the host
scanning the network, creating excessive firewall deny traffic, a backdoor opening up at the server
etc. The attack may be preceded by reconnaissance attempts targeted to that host. The attacks to a
mail server include buffer overflows, remote command execution attempts using server privileges,
denial of service attempts.
•
System Rule: Server Attack: Misc. - Attempt.
This correlation rule detects attacks on miscellaneous services (i.e. other than DNS, FTP, HTTP,
Mail, FTP, RPC, Telnet, SSH, R-protocols) on a host, preceded by reconnaissance attempts targeted
to that host, if any. The attacks include buffer overflows, remote command execution attempts,
privilege escalation attempts to become root, denial of service attempts etc.
•
System Rule: Server Attack: Misc. - Success Likely.
This correlation rule detects specific attacks on miscellaneous services (i.e. other than DNS, FTP,
HTTP, Mail, FTP, RPC, Telnet, SSH, R-protocols) on a host followed by suspicious activity on the
targeted host. Suspicious activity may include the host scanning the network, creating excessive
firewall deny traffic, a backdoor opening up at the server etc. The attack may be preceded by
reconnaissance attempts targeted to that host. The attacks include buffer overflows, remote
command execution attempts using server privileges, denial of service attempts etc.
•
System Rule: Server Attack: RPC - Attempt.
This correlation rule detects attacks on RPC services on a host, preceded by reconnaissance attempts
targeted to that host, if any. The attacks include buffer overflows, remote command execution
attempts, privilege escalation attempts to become root, denial of service attempts etc.
•
System Rule: Server Attack: RPC - Success Likely.
