# A tuned copy of a noisy authentication rule, with two narrow exclusions.
#
# Companion to https://maheshtata.com/wazuh/wazuh-false-positives/
#
# HOW TO USE
#   1. Create this in the DRAFT space, under the same integration as the rule
#      you are replacing:
#      Security Analytics > Detection > Rules > Draft > Actions > Create
#   2. Promote Draft -> Test and validate with the Log test tool.
#   3. Promote Test -> Custom. Only Custom content is active in the engine.
#   4. Edit the detector that runs the original standard rule and remove that
#      rule from its selection. Skip this and you get two findings per event.
#
# WHY A COPY
#   The Standard space is read-only content synced from Wazuh CTI. Built-in
#   rules cannot be edited in place.
#
# FORMAT
#   Field names, modifiers and block structure from
#   https://documentation.wazuh.com/5.0-beta/user-manual/data-analysis/rules.html
#   Every field referenced in `detection` is validated against the Wazuh
#   Common Schema at creation time; an unknown field is rejected with a
#   structured error naming it.
#
# BEFORE YOU PROMOTE
#   Replace the `id` with your own UUIDv4. Replace `sigma_id` with the
#   identifier of the upstream rule you are shadowing, or delete the line.
#   Confirm event.action, user.name and source.ip actually carry the values
#   below on YOUR events; read one real document in Discover first.

metadata:
  title: Failed authentication, excluding service accounts and scanners
  author: Security Operations <secops@example.com>
  date: "2026-09-22"
  modified: "2026-09-22"
  description: >-
    Local copy of the standard failed-authentication rule with two exclusions.
    Replaces the upstream rule in this environment; the upstream rule is
    removed from the detector.
  documentation: https://internal.example/wazuh/exceptions/EX-2026-014

id: 00000000-0000-4000-8000-000000000000   # REPLACE with your own UUIDv4
sigma_id: 00000000-0000-4000-8000-000000000001   # upstream rule id, or delete
status: test
level: medium
enabled: true

tags:
  - attack.credential-access

logsource:
  product: linux
  category: authentication
  service: sshd
  definition: >-
    Requires sshd authentication logs to be collected by the agent.

detection:
  selection:
    event.action: authentication-failure

  # EXCLUSION 1: scheduled service accounts.
  # startswith, not contains: `contains: svc` would also match a user called
  # "jsvcott". Narrow the modifier to the narrowest one that works.
  filter_service_accounts:
    user.name|startswith: "svc-"

  # EXCLUSION 2: the authenticated vulnerability scanner subnet.
  # cidr is the durable form for address ranges. It survives a rename;
  # a hostname substring does not.
  filter_scanner:
    source.ip|cidr: 10.42.99.0/24

  condition: selection and not (filter_service_accounts or filter_scanner)

# Known sources of false positives. This field is part of the rule format:
# keep it current, because it is what the next analyst reads.
falsepositives:
  - Scheduled service accounts prefixed svc-
  - Authenticated vulnerability scanning from 10.42.99.0/24

mitre:
  tactic:
    - TA0006
  technique:
    - T1110
  subtechnique: []

# Framework keys supported by the rule format: gdpr, pci_dss, cmmc,
# nist_800_53, nist_800_171, hipaa, iso_27001, nis2, tsc, fedramp.
# Each value is an array of requirement ID strings. The two below are
# placeholders: replace them with the control references your own audit
# scope actually uses, or remove the block.
compliance:
  pci_dss:
    - "REPLACE_WITH_YOUR_CONTROL_REFERENCE"
  iso_27001:
    - "REPLACE_WITH_YOUR_CONTROL_REFERENCE"