Thread by @maikroservice

Day 1️⃣3️⃣ - Becoming a SOC analyst 💙

How to supercharge your AD log collection with sysmon:

You have a shiny new toy - a SIEM for your HomeLab 🎉

But some of you wondered, What now?
What do you do with the SIEM and the agents?

Allow me to share:

Generally the @wazuh agents come with some pre-configurations out-of-the-box

You for example have an individual CIS hardening guide for your operating system

find them here: learn.cisecurity.org/benchmarks

@wazuh HUH?
How do I look at the scores of those?

You open the wazuh dashboard and click on one of the agents

@wazuh In the bottom right corner you will now see the CIS score

Ouch, 33% out-of-the-box for the windows 10 machine - not great, but kinda expected 😅

@wazuh If you are a system administrator or generally the only one caring about security at your company…

You might want to look into the failed options

If you want another hardening guide, look here: bsi.bund.de/EN/Service-Nav…

@wazuh Ok long story short, there are some tests being run by wazuh without you needing to know anything about security 🌈

But what if you know something about security?!

What can you do with a SIEM?

@wazuh You would usually have two-three stages of an attack from a high-level view

1. Preparation 👩‍🍳
2. Incident/Detection 🕵️‍♀️
3. Cleanup/Postmortem ☠️

I dont like the sound of the last word.

Fear not, we will handle it together

@wazuh The SIEM has a couple of concepts that allow it to detect malware / hackers.

(Detection) Rules

We call the means of detections rules, each rule (usually) identifies 1 piece of malware / malicious action

@wazuh Secret-Time: There is one magical tool that helps defenders with the “fun” that is windows log collection

It is part of the sysinternals collection by @markrussinovich - the name is sysmon

& you can get it here:
technet.microsoft.com/en-us/sysinter…

@wazuh @markrussinovich Download the sysmon64.exe and you could run it with the default configuration

BUT DONT!

There is a repository that was started by the great @SwiftOnSecurity (github.com/SwiftOnSecurit…)

BUT

@wazuh @markrussinovich @SwiftOnSecurity that one is outdated / not maintained anymore 😭

Hold your horses - someone took over the reigns and keeps it alive here: github.com/Neo23x0/sysmon…

or a modular approach:
github.com/olafhartong/sy…

now download the xml raw.githubusercontent.com/olafhartong/sy…

@wazuh @markrussinovich @SwiftOnSecurity You are now well prepared, all you have to do is open a (administrator) terminal & run

sysmon64.exe -i sysmonconfig.xml

pointing it to the sysmonconfig.xml that you downloaded

@wazuh @markrussinovich @SwiftOnSecurity Once that is done you should see similar output to the screenshot below

@wazuh @markrussinovich @SwiftOnSecurity Wonderful,

Now sysmon is installed and …

Huh? What now?

We need to tell the wazuh agent to monitor sysmon events

but how?!?!!??!!

@wazuh @markrussinovich @SwiftOnSecurity go to c:\windows\ and right click “notepad.exe” - open as administrator

then file → open → open the ossec.conf in c:\program files(x86)\ossec-agent

and change the following

@wazuh @markrussinovich @SwiftOnSecurity below the first Log Analysis entry add:

<localfile>
<location>Microsoft-Windows-Sysmon/Operational</location>
<log_format>eventchannel</log_format>
</localfile>

@wazuh @markrussinovich @SwiftOnSecurity cool cool cool 😎

the last step for today is to change the local_rules.xml on the wazuh server machine

@wazuh @markrussinovich @SwiftOnSecurity <group name="sysmon,">
<rule id="255000" level="10">
<if_group>sysmon_event1</if_group>
<field name="sysmon.image">\\powershell.exe||\\.ps1</field>
<description>Sysmon - Event 1: Bad exe: $(sysmon.image)</description>
<group>sysmon_event1,powershell_exec,</group>
</rule>
</group>

@wazuh @markrussinovich @SwiftOnSecurity add this and restart wazuh-manager with

systemctl stop wazuh-manager
systemctl start wazuh-manager

@wazuh @markrussinovich @SwiftOnSecurity In the next thread 🧵 we go over the command and see what it does

… or you can post it in the replies for the others to see how smart you are! 🤓

@wazuh @markrussinovich @SwiftOnSecurity If you liked this thread
→ follow me @maikroservice for frequent updates on the course(s) I am building

If you want to have regular updates with more text/pictures
(every first Saturday)
→ head to:
subscribepage.io/maikroservice-…

@wazuh @markrussinovich @SwiftOnSecurity @threadreaderapp unroll