Alright, onto the good stuff.
Let's log into the Wazuh manager's Kibana UI.
Okay, and admin, admin is the username and password.
Obviously, if this is a production environment, that wouldn't be the case.
Sweet, looks like our victim agent has checked in.
Let's click on Total agents here and drill in further.
Okay, let's drill in a little bit further. These graphs,
so pretty. We can see some recent FIM events.
Let's go into the Security events tab.
Let's drill in a little bit further and go into the Events.
Perfect, now we can see all the alert text. I'm going to scroll
down to the beginning of the alert chain.
By default, Wazuh checks netstat for changes every 6 minutes. Within
this course, I changed this to be every 5 seconds,
so it's easy to see what's going on.
This can be configured within Wazuh's main configuration file.
So long story short, the reason why you're seeing all the netstat alerts
is because we're firing that check every 5 seconds.
Okay, let's drill into this netstat alert.
Notice the udp6 entry. That correlates to the Merlin agent
instantiating a network connection; however,
you do not see the Merlin agent's name anywhere within the
output. That is due to our foothold script.
Let's go back to the file alerts.
Let's start with File added to the system.
Here we see the preload file being added.
Now let's check out the Integrity checksum alert.
We see the /etc/bash.bashrc file being modified.
Even better, if we scroll down a little bit,
we can see the actual text that was changed.
That's awesome. Anyhow, Wazuh caught the foothold script being
added. In the real world, this script would have an innocuous
name such as package updater. Okay,
now it's time to zoom out a little bit here and do some reflection.
I'm going to collapse these alerts.
Let's quickly go through the rest of the alerts here. We see a bunch of CIS
benchmark checks. That's outside of the scope of this tutorial.
As we reflect on these alerts,
it's important to notice what alerts were not generated. In the beginning of
this tutorial, I spoke about Wazuh's rootkit functionality,
where it gives an explicit alert for finding rootkits or
cloaked processes. While Wazuh's rootkit functionality does
look for hidden processes, in this case,
it doesn't flag anything. Even if we increase the
frequency of the rootkit scans, Wazuh will not
consistently find the cloaked Merlin process.
So, what gives?
Does this mean Wazuh is complete garbage?
Absolutely not, because perfection is an illusion,
and it's my job to show the pros and cons of a given tool.
So how do we get around this? When creating alerts,
we should focus on the true foundation of the alert.
Like many attacks, the foothold attack is based within the file system.
Luckily for us, file integrity monitoring,
or FIM,
is a strength of Wazuh. And as we just saw, FIM con
give us hints that malware is present.
Let's explore Wazuh's file integrity monitoring in more detail.