Today, we began setting up our dashboards, specifically for failed logins and failed authentications. Using Rule.ID 60122, we were able to filter down to only authentication failure rules. After we created a filter for each device dependent on the workstation name.

Failed Authentication Count

From here, we opened the Threat Hunting Tab and noticed that our login attempts generated multiple MITRE events. One for Brute Force caught my eye and led to the creation of our next dashboard visual. Using the filter for the failed authentication attempts generated by the Threat Hunting Dashboard below, we created a heatmap linking the threat type to the device on which it occurred. Allowing us to accurately determine whether a user forgot their password or if it was a brute-force attempt.

Failed Authentication Threat Hunter

Failed Authentication Heat Map

This authentication dashboard provides both the attempt count and the attempt type, based on alert characteristics. A quick and easy view of failed authentication attempts.

Failed Authentication Dashboard

This first dashboard was a quick attempt to learn how to use the visualizer, walking Emma and me through its creation. Additionally, we were unable to keep the Ubuntu workstation persistent. Since the last time we used our VMs, it has wiped its virtual disk. This leaves us with strict Windows Logs from Windows Event Viewer and the default configured Sysmon. With this, we have just enough logs to create some visualizations and learn Wazuh. With our next dashboard we will attempt to detect process creation, and hopefully find abnormal, or malicious attempts at creating these processes.

Thank you for visiting, with these next few days they will be smaller segments where we focus on one piece of detection at a time. Since we can't copy data out of our VM's due to the isolation between our local devices, server, and VM's we will do our best to describe the visualization creation process.

While looking through Wazuh, we identified a lack of Sysmon events. While researching, we identified that when we configured Sysmon, the agents began collecting logs appropriately. 1. The DC did not have Sysmon, and 2. There were no rules for reporting Sysmon Events. To this end, we used ChatGPT to generate an XML Template for Wazuh. With this, we could now see the following events listed below.

• Process Creation
• Process Terminations
• Network Connections
• Drivers Loading
• Image Loading
• Remote Thread Creation
• Process Access
• Raw Data Access
• Registry Events
• DNS Queries
• File Creation
• File Deletion

Updated Sysmon Items

Negligent power shutdown of our server led to a loss of memory, and we had to re-import our XML Template for Sysmon, this is provided below, compliments of ChatGPT.

                        



< group name="windows,sysmon,custom" >

    < !-- ===================================================== -- >
    < !-- Base Sysmon Rule                                      -- >
    < !-- ===================================================== -- >

    < rule id="100500" level="0" >
        < if_group>sysmon_event< /if_group >
        < description>Custom Sysmon Base Rule< /description >
        < options>no_full_log< /options >
    < /rule >

    < !-- ===================================================== -- >
    < !-- Event ID 1 - Process Creation                         -- >
    < !-- ===================================================== -- >

    < rule id="100501" level="3" >
        < if_sid>100500< /if_sid >

        < field name="win.system.eventID">1< /field >

        < description >
            Sysmon - Process Created
        < /description >

        < group >
            process_creation,
            windows,
            sysmon
        < /group >

        < mitre >
            < id>T1059< /id >
            < id>T1204< /id >
        < /mitre >
    < /rule >

    < !-- ===================================================== -- >
    < !-- Suspicious PowerShell                                 -- >
    < !-- ===================================================== -- >

    < rule id="100510" level="10" >
        < if_sid>100501< /if_sid >

        < field name="win.eventdata.Image" type="pcre2" >
            (?i)powershell\.exe$
        < /field >

        < field name="win.eventdata.CommandLine" type="pcre2" >
            (?i)(-enc|-encodedcommand|iex|invoke-expression|downloadstring|frombase64string)
        < /field >

        < description >
            Suspicious PowerShell Execution
        < /description >

        < group >
            powershell,
            execution,
            attack
        < /group >

        < mitre >
            < id>T1059.001< /id >
        < /mitre >
    < /rule >

    
    
    

    < rule id="100520" level="4" >
        < if_sid>100500< /if_sid >

        < field name="win.system.eventID">3< /field >

        < description >
            Sysmon - Network Connection
        < /description >

        < group >
            network,
            windows,
            sysmon
        < /group >

        < mitre >
            < id>T1049< /id >
        < /mitre >
    < /rule >

    < !-- ===================================================== -- >
    < !-- Outbound Connection to Public IP                      -- >
    < !-- ===================================================== -- >

    < rule id="100521" level="7" >
        < if_sid>100520< /if_sid >

        < field name="win.eventdata.DestinationIp" type="pcre2" >
            ^(?!10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.)
        < /field >

        < description >
            Outbound Connection to External IP
        < /description >

        < group >
            network,
            outbound
        < /group >

        < mitre >
            < id>T1071< /id >
        < /mitre >
    < /rule >

    < !-- ===================================================== -- >
    < !-- Event ID 7 - Image Loaded                             -- >
    < !-- ===================================================== -- >

    < rule id="100530" level="5" >
        < if_sid>100500< /if_sid >

        < field name="win.system.eventID">7< /field >

        < description >
            Sysmon - Image Loaded
        < /description >

        < group >
            dll,
            image_load
        < /group >
    < /rule >

    < !-- ===================================================== -- >
    < !-- Event ID 8 - Create Remote Thread                     -- >
    < !-- ===================================================== -- >

    < rule id="100540" level="12" >
        < if_sid>100500< /if_sid >

        < field name="win.system.eventID">8< /field >

        < description >
            Sysmon - Create Remote Thread
        < /description >

        < group >
            process_injection
        < /group >

        < mitre >
            < id>T1055< /id >
        < /mitre >
    < /rule >

    
    
    

    < rule id="100550" level="8" >
        < if_sid>100500< /if_sid >

        < field name="win.system.eventID">10< /field >

        < description >
            Sysmon - Process Access
        < /description >

        < group >
            credential_access
        < /group >

        < mitre >
            < id>T1003< /id >
        < /mitre >
    < /rule >

    < !-- LSASS Access -- >

    < rule id="100551" level="15" >
        < if_sid>100550< /if_sid >

        < field name="win.eventdata.TargetImage" type="pcre2" >
            (?i)lsass\.exe$
        < /field >

        < description >
            Possible Credential Dumping (LSASS Access)
        < /description >

        < group >
            credential_dumping
        < /group >

        < mitre >
            < id>T1003.001< /id >
        < /mitre >
    < /rule >

    < !-- ===================================================== -- >
    < !-- Event ID 11 - File Creation                           -- >
    < !-- ===================================================== -- >

    < rule id="100560" level="4" >
        < if_sid>100500< /if_sid >

        < field name="win.system.eventID">11< /field >

        < description >
            Sysmon - File Created
        < /description >

        < group >
            file_creation
        < /group >
    < /rule >

    < !-- ===================================================== -- >
    < !-- Event ID 13 - Registry Modification                   -- >
    < !-- ===================================================== -- >

    < rule id="100570" level="6" >
        < if_sid>100500< /if_sid >

        < field name="win.system.eventID">13< /field >

        < description >
            Sysmon - Registry Modification
        < /description >

        < group >
            registry
        < /group >

         < mitre >
            < id>T1112< /id >
        < /mitre >
    < /rule >

    < !-- Run Key Persistence -- >

    < rule id="100571" level="10" >
        < if_sid>100570< /if_sid >

        < field name="win.eventdata.TargetObject" type="pcre2" >
            (?i)(Run|RunOnce|CurrentVersion\\Run)
        < /field >

        < description >
            Registry Run Key Persistence
        < /description >

        < mitre >
            < id>T1547.001< /id >
        < /mitre >
    < /rule >

    < !-- ===================================================== -- >
    < !-- Event ID 22 - DNS Query                               -- >
    < !-- ===================================================== -- >

    < rule id="100580" level="3" >
        < if_sid>100500< /if_sid >

        < field name="win.system.eventID">22< /field >

        < description >
            Sysmon - DNS Query
        < /description >

        < group >
            dns
        < /group >
    < /rule >

    < !-- Suspicious DNS -- >

    < rule id="100581" level="8" >
        < if_sid>100580< /if_sid >

        < field name="win.eventdata.QueryName" type="pcre2" >
            (?i)(duckdns|ngrok|trycloudflare|pastebin|discordapp|raw\.githubusercontent)
        < /field >

        < description >
            DNS Query to Suspicious Domain
        < /description >

        < mitre >
            < id>T1071.004< /id >
        < /mitre >
    < /rule >

< /group >
                    
    

Unfortunately due to conflicts in scheduling, alongside work, school, and life, balancing between the two of us. The past few days have been slightly busy. With that we were only able to get this item completed. Alongside some some course work, and backlogged work items for myself.

We appreciate the visit, and hope to see you again.

While teaching others, take note of what you do know. Teach them to teach themselves and guide them using information you understand, rather than attempting to guide them directly. Emma did this next section. Using ChatGPT, with a custom system prompt, she was able to facilitate the creation of this dashboard.

After updating our rules in Sysmon, we were able to get more granular with the events we were finding. With this, Emma was able to use the filters provided to her to set up visualizations that recorded events and counts of the following. Top Executed Processes, Process Activity Timeline, Top Parent Processes, PowerShell Activity, Suspicious Living Off the Land Binaries, Top Hosts, High Severity Process Alerts, and MITRE ATT&CK Coverage. Below are a few snips of the created items. Alongside brief descriptions of what is used.

Top Processes

By aggregating terms related to data.win.eventdata.image the visualization presents top ran processes.

Process Timeline

By filtering by our custom Sysmon Rule.ID 100501 for process creation, we can visualize a timeline.

MITRE ID's

By filtering by mitre.id, we can visualize a pie chart of our top 10 alerts.

The Dashboard

A snip of visualized data on the newly created Dashboard

I was able to update Day 2 by emailing myself the XML used, as well Emma was able to interact more with Wazuh thanks to ChatGPTs guidance. With that we appreciate the time you took to read through our entries. Thank you for visiting, enjoy your weekend!

Another short entry, today Emma took the helm and did most of the work while I did some labs for Computer Architecture!

Emma was able to use the filters provided to her to set up visualizations that recorded Network Connections. Including Network Connections Over Time, Active IP Connections, Active IP Ports, and Active Connections per Process. Below are a few snips of the created items. Alongside brief descriptions of what is used.

Network Connections Over Time

By monitoring our Network Rule.ID we're able to monitor the connections over time.

IP Connections

By filtering our Network Data for IP Connections we're able to see active ones.

IP Ports

By filtering our Network Data for IP Ports in use, we can see active ports.

Processes with Active Connections

By filtering our Network Rule, against Process Images, we can see active connections per process.

The Dashboard

A snip of visualized data on the newly created Dashboard

Take your time learning new information, once you get the hang of it, it'll become easier, even if learning it starts out rough. Additionally, the dashboard has the wrong process view, we apologize! Thank you for visiting, enjoy your weekend!

We had to create a rule group for malware detection, once again to our benefit ChatGPT generate a quick template. Unfortunately for us, or fortunately, we do not have Malware on our Virtual Machines.

                    

                           
                        < group name="windows,sysmon,malware" >

    < !--
        Malware Detection Template
        Description:
        Detects suspicious process execution, encoded PowerShell,
        LOLBins, suspicious file locations, and other malware behaviors.
    -- >

    < !-- Suspicious PowerShell -- >
    < rule id="100500" level="12" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.Image" type="pcre2" >(?i)powershell(\.exe)?$< /field >
        < field name="win.eventdata.CommandLine" type="pcre2" >(?i)(-enc|-encodedcommand|frombase64string|iex|invoke-expression)< /field >
        < description >Potential malicious PowerShell execution detected.< /description >
        < mitre >
            < id >T1059.001< /id >
        < /mitre >
        < options >no_full_log< /options >
    < /rule >

    < !-- LOLBin Abuse -- >
    < rule id="100501" level="10" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.Image" type="pcre2" >
            (?i)(certutil|mshta|regsvr32|rundll32|wmic|bitsadmin|installutil|msbuild)\.exe$
        < /field >
        < description >Potential Living-Off-the-Land Binary (LOLBin) execution.< /description >
        < mitre >
            < id >T1218< /id >
        < /mitre >
    < /rule >

    < !-- Suspicious Executable Location -- >
    < rule id="100502" level="10" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.Image" type="pcre2" >
            (?i)\\Users\\.*\\AppData\\(Local|Roaming)\\.*\.exe$
        < /field >
        < description >Executable launched from user AppData directory.< /description >
        < mitre >
            < id >T1204< /id >
        < /mitre >
    < /rule >

    < !-- Execution from Temp -- >
    < rule id="100503" level="10" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.Image" type="pcre2" >
            (?i)\\Temp\\.*\.exe$
        < /field >
        < description >Executable launched from Temp directory.< /description >
        < mitre >
            < id >T1204< /id >
        < /mitre >
    < /rule >

    < !-- Encoded Command -- >
    < rule id="100504" level="12" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.CommandLine" type="pcre2" >
            (?i)(base64|encodedcommand|-enc)
        < /field >
        < description >Encoded command execution detected.< /description >
        < mitre >
            < id >T1027< /id >
        < /mitre >
    < /rule >

    < !-- Suspicious Network Connection -- >
    < rule id="100505" level="9" >
        < if_group >sysmon_event3< /if_group >
        < field name="win.eventdata.Image" type="pcre2" >
            (?i)(powershell|cmd|wscript|cscript|rundll32)\.exe$
        < /field >
        < description >Suspicious process initiated an outbound network connection.< /description >
        < mitre >
            < id >T1071< /id >
        < /mitre >
    < /rule >

    < !-- Process Injection -- >
    < rule id="100506" level="14" >
        < if_group >sysmon_event8< /if_group >
        < description >Possible process injection detected.< /description >
        < mitre >
            < id >T1055< /id >
        < /mitre >
    < /rule >

    < !-- DLL Load -- >
    < rule id="100507" level="8" >
        < if_group >sysmon_event7< /if_group >
        < field name="win.eventdata.ImageLoaded" type="pcre2" >
            (?i)\\Users\\.*\\AppData\\.*\.dll$
        < /field >
        < description >DLL loaded from a user-writable directory.< /description >
        < mitre >
            < id >T1574< /id >
        < /mitre >
    < /rule >

    < !-- Persistence via Registry -- >
    < rule id="100508" level="11" >
        < if_group >sysmon_event13< /if_group >
        < field name="win.eventdata.TargetObject" type="pcre2" >
            (?i)\\Run(|Once)$
        < /field >
        < description >Registry Run key modification detected.< /description >
        < mitre >
            < id >T1547.001< /id >
        < /mitre >
    < /rule >

    < !-- Windows Security Log Example -- >
    < rule id="100509" level="8" >
        < if_group >windows< /if_group >
        < field name="win.system.eventID" >4688< /field >
        < field name="win.eventdata.NewProcessName" type="pcre2" >
            (?i)(powershell|cmd|mshta|regsvr32|certutil)\.exe$
        < /field >
        < description >Windows process creation of a potentially suspicious binary.< /description >
        < mitre >
            < id >T1059< /id >
        < /mitre >
    < /rule >

< /group >

< group name="windows,sysmon,malware" >

    < !-- ========================================================= -- >
    < !-- Ransomware Detection -- >
    < !-- ========================================================= -- >

    < rule id="100600" level="14" >
        < if_group >sysmon_event11< /if_group >
        < field name="win.eventdata.TargetFilename" type="pcre2" >
            (?i).*\.(locked|locky|crypt|encrypted|ryk|conti|akira|blackcat|3am|play)$
        < /field >
        < description >Possible ransomware encrypted file detected.< /description >
        < mitre >
            < id >T1486< /id >
        < /mitre >
        < group >ransomware,malware< /group >
    < /rule >

    < rule id="100601" level="13" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.CommandLine" type="pcre2" >
            (?i)(vssadmin\s+delete\s+shadows|wbadmin\s+delete|bcdedit.*recoveryenabled\s+no)
        < /field >
        < description >Potential ransomware attempting to disable recovery.< /description >
        < mitre >
            < id >T1490< /id >
        < /mitre >
        < group >ransomware< /group >
    < /rule >

    < !-- ========================================================= -- >
    < !-- Credential Theft -- >
    < !-- ========================================================= -- >

    < rule id="100610" level="15" >
        < if_group >sysmon_event10< /if_group >
        < field name="win.eventdata.TargetImage" type="pcre2" >
            (?i)lsass\.exe$
        < /field >
        < description >Possible credential dumping targeting LSASS.< /description >
        < mitre >
            < id >T1003.001< /id >
        < /mitre >
        < group >credential_access,mimikatz< /group >
    < /rule >

    < rule id="100611" level="15" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.CommandLine" type="pcre2" >
            (?i)(sekurlsa|lsadump|privilege::debug|mimikatz)
        < /field >
        < description >Potential Mimikatz execution.< /description >
        < mitre >
            < id >T1003< /id >
        < /mitre >
        < group >mimikatz,credential_access< /group >
    < /rule >

    < !-- ========================================================= -- >
    < !-- Remote Access Trojan (RAT) -- >
    < !-- ========================================================= -- >

    < rule id="100620" level="12" >
        < if_group >sysmon_event3< /if_group >
        < field name="win.eventdata.Image" type="pcre2" >
            (?i)(powershell|wscript|mshta|rundll32)\.exe$
        < /field >
        < description >Possible Remote Access Trojan network communication.< /description >
        < mitre >
            < id >T1071< /id >
        < /mitre >
        < group >rat,c2< /group >
    < /rule >

    < !-- ========================================================= -- >
    < !-- Banking Trojan -- >
    < !-- ========================================================= -- >

    < rule id="100630" level="12" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.CommandLine" type="pcre2" >
            (?i)(webinject|formgrab|injectbrowser|credentialgrab)
        < /field >
        < description >Possible banking trojan activity detected.< /description >
        < mitre >
            < id >T1056< /id >
        < /mitre >
        < group >banking_trojan< /group >
    < /rule >

    < !-- ========================================================= -- >
    < !-- Downloader -- >
    < !-- ========================================================= -- >

    < rule id="100640" level="11" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.CommandLine" type="pcre2" >
            (?i)(invoke-webrequest|wget|curl|bitsadmin|certutil.*-urlcache)
        < /field >
        < description >Possible malware downloader execution.< /description >
        < mitre >
            < id >T1105< /id >
        < /mitre >
        < group >downloader< /group >
    < /rule >

    < !-- ========================================================= -- >
    < !-- Cryptominer -- >
    < !-- ========================================================= -- >

    < rule id="100650" level="10" >
        < if_group >sysmon_event1< /if_group >
        < field name="win.eventdata.CommandLine" type="pcre2" >
            (?i)(stratum\+tcp|xmrig|nanominer|lolminer|phoenixminer)
        < /field >
        < description >Possible cryptocurrency miner detected.< /description >
        < mitre >
            < id >T1496< /id >
        < /mitre >
        < group >cryptominer< /group >
    < /rule >

    < !-- ========================================================= -- >
    < !-- Worm -- >
    < !-- ========================================================= -- >

    < rule id="100660" level="12" >
        < if_group >sysmon_event3< /if_group >
        < field name="win.eventdata.DestinationPort" >
            445
        < /field >
        < description >Possible worm propagation using SMB.< /description >
        < mitre >
            < id >T1021.002< /id >
        < /mitre >
        < group >worm,lateral_movement< /group >
    < /rule >

    < !-- ========================================================= -- >
    < !-- Spyware / Keylogger -- >
    < !-- ========================================================= -- >

    < rule id="100670" level="13" >
        < if_group >sysmon_event8< /if_group >
        < description >Possible keylogger or spyware injection activity.< /description >
        < mitre >
            < id >T1056.001< /id >
        < /mitre >
        < group >spyware,keylogger< /group >
    < /rule >

    < !-- ========================================================= -- >
    < !-- Rootkit -- >
    < !-- ========================================================= -- >

    < rule id="100680" level="15" >
        < if_group >sysmon_event6< /if_group >
        < field name="win.eventdata.SignatureStatus" >
            Invalid
        < /field >
        < description >Unsigned or suspicious kernel driver loaded.< /description >
        < mitre >
            < id >T1542< /id >
        < /mitre >
        < group >rootkit< /group >
    < /rule >

    < !-- ========================================================= -- >
    < !-- Backdoor -- >
    < !-- ========================================================= -- >

    < rule id="100690" level="12" >
        < if_group >sysmon_event3< /if_group >
        < field name="win.eventdata.Image" type="pcre2" >
            (?i)(cmd|powershell|rundll32|regsvr32)\.exe$
        < /field >
        < description >Possible backdoor command-and-control communication.< /description >
        < mitre >
            < id >T1071< /id >
        < /mitre >
        < group >backdoor,c2< /group >
    < /rule >

< /group >

                    
    

Continuing with previous the previous trend, Emma has created malware detection visualizations. These assist in monitoring Malware Alert Timelines, Malware Family Distributions, Top Suspicious Processes, and File Creation Activity. Due to not having any active malware (or creating files recently), and just now configuring these rules. We are unable to provide visuals of the visualizations. However, we can provide the filters, and rules used with-in them.

All filters, outside of the File Creation visualization, use Rule.Groups is malware for Malware Family Types, it splits this by using terms in Rule.Description. Network Connections use the previously created Rule.ID 100560 alongside the malware group.

With this a dashboard was created, however there is no data to visualize at this point in time. We can only have faith in the condition our lab environment was infected Wazuh would detect it. Or if skilled enough download some Malware and run it within our lab, and remediate it after logging occurs. (Due to skill level and safety concerns we will not be doing this.)

We appreciate the visit, we apologize that we have not infected ourselves and are unable to perform a safe test in order to confirm visualizations are functioning appropraitely. Thank you for your time, and have a wonderful day.