# Sagan digitalpersona.rules
# Copyright (c) 2009-2020. Quadrant Information Security <www.quadrantsec.com>
# All rights reserved.
#
# Please submit any custom rules or ideas to sagan-submit@quadrantsec.com or the sagan-sigs mailing list
#
#*************************************************************
#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
#  following conditions are met:
#
#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
#    disclaimer.
#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
#    following disclaimer in the documentation and/or other materials provided with the distribution.
#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
#    from this software without specific prior written permission.
#
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#*************************************************************
# Digitalpersona two factor (finger print) authentication systems. 

# Champ Clark III - 07/30/2012

# DigitalPersona_Pro: 1025: NT AUTHORITY\SYSTEM: User name: bob Domain: MASTER Credentials verified for logon: Password: No Fingerprint: Yes Smartcard: No Fingerprint PIN: No
# ^^ Logins need normalization

#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] User login"; content: " 1024: "; classtype: successful-user; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001435; sid: 5001435; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] OTS Started"; content: " 1281: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001436; sid: 5001436; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Fingerprint reader connected"; content: " 1793: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001437; sid: 5001437; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Fingerprint reader disconnected"; content: " 1794: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001438; sid: 5001438; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] One-to-one fingerprint match failed [5/5]"; content: " 2049: "; classtype: unsuccessful-user; program: DigitalPersona* after: track by_src, count 5, seconds 300; threshold: type suppress, track by_src, count 5, seconds 300; reference: url,wiki.quadrantsec.com/bin/view/Main/5001439; sid: 5001439; rev:4;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] System unlocked"; content: " 1031: "; classtype: successful-user; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001440; sid: 5001440; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Kiosk Login"; content: " 1026: "; classtype: successful-user; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001441; sid: 5001441; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Logoff"; content: " 1027: "; classtype: successful-user; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001442; sid: 5001442; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Kiosk Logoff"; content: " 1028: "; classtype: successful-user; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001443; sid: 5001443; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] System locked"; content: " 1029: "; classtype: successful-user; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001444; sid: 5001444; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Kiosk locked"; content: " 1030: "; classtype: successful-user; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001445; sid: 5001445; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] System unlocked"; content: " 1031: "; classtype: successful-user; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001446; sid: 5001446; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Kiosk unlocked"; content: " 1032: "; classtype: successful-user; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001447; sid: 5001447; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Registered PIN"; content: " 1033: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001448; sid: 5001448; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Changed PIN"; content: " 1034: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001449; sid: 5001449; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] FP used to unlocked smart card"; content: " 1035: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001450; sid: 5001450; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Shared account problem"; content: " 1036: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001451; sid: 5001451; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Shared account missing"; content: " 1037: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001452; sid: 5001452; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] OTS Stopped"; content: " 1281: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001453; sid: 5001453; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Agent cannot start"; content: " 1283: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001454; sid: 5001454; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Password changed canceled by user"; content: " 1285: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001455; sid: 5001455; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Inital fillin was preformed"; content: " 1288: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001456; sid: 5001456; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Fillin was preformed"; content: " 1289: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001457; sid: 5001457; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Account data could not be modified"; content: " 1290: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001458; sid: 5001458; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Account data successfully modified"; content: " 1291: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001459; sid: 5001459; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] CRC check failure"; content: " 1292: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001460; sid: 5001460; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] User added to Kiosk ID list"; content: " 1537: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001461; sid: 5001461; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] User deleted to Kiosk ID list"; content: " 1538: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001462; sid: 5001462; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] User pushed out of the User ID list"; content: " 1539: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001463; sid: 5001463; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Kiosk ID list created"; content: " 1540: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001464; sid: 5001464; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Kiosk ID list deleted"; content: " 1541: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001465; sid: 5001465; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] DPHost started"; content: " 1795: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001466; sid: 5001466; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] DPHost cannot started"; content: " 1797: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001467; sid: 5001467; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Connection to server succeeded"; content: " 1798: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001468; sid: 5001468; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Connection to server failed"; content: " 1799: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001469; sid: 5001469; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Server busy"; content: " 1800: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001470; sid: 5001470; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] One-to-many matched failed"; content: " 2050: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001471; sid: 5001471; rev:3;)
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] Account locked out"; content: " 2051: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001472; sid: 5001472; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] License quota exceeded"; content: " 4097: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001473; sid: 5001473; rev:3;)
#alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIGITALPERSONA] License quota near limit"; content: " 4098: "; classtype: system-event; program: DigitalPersona* reference: url,wiki.quadrantsec.com/bin/view/Main/5001474; sid: 5001474; rev:3;)