[ossec-list] IIS 6 log decoder issue

["Worawit Wang" <worawita@xxxxxxxxx>]

Hi all,

I've just found bug in decoder.xml, named web-accesslog-iis6. cs-uri-query field is not included in URL field.

Here is a original decoder:
<decoder name="web-accesslog-iis6">
  <parent>windows-date-format</parent>
  <type>web-log</type>
  <use_own_name>true</use_own_name>
  <prematch offset="after_parent">^W3SVC\d+ \S+ \S+ \S+ </prematch>
  <regex offset="after_prematch">^(\S+) \S+ \d+ \S+ (\d+.\d+.\d+.\d+) </regex>
  <regex>\S+ \S+ \S+ \S+ \S+ (\d+) </regex>
  <order>url, srcip, id</order>
</decoder>

line: <regex offset="after_prematch">^(\S+) \S+ \d+ \S+ (\d+.\d+.\d+.\d+) </regex>
need to be: <regex offset="after_prematch">^(\S+ \S+) \d+ \S+ (\d+.\d+.\d+.\d+) </regex>

I hope this issue will be fixed in next version.

Also I have a request about web rules. Can you modify OSSEC to matching url rule case insensitively? Because it's very easy to evade detection, such as using "SeLeCt" for doing sql injection

Thanks,
Worawit