Let's check out the victim's Wazuh configuration file.
Let's scroll down to syscheck. Syscheck houses the
configurations for Wazuh's file integrity monitoring.
Here, we see the default FIM rules with two slight modifications.
Report_changes allows us to see the actual text in the file that changes.
This allowed us to see the foothold script being injected in the Kibana UI.
Realtime allows us to see the alerts in real time.
Makes sense, right?
Let's check out the netstat command.
The netstat alerts we saw in the Kibana UI correlate to the
setting. By default, Wazuh runs netstat every 360 seconds and will
alert if the output of the command changes.
In other words, it will alert if the listening ports change.
While netstat found signs that malware was present, it's best for us
to focus our main efforts on the source of truth,
which, in our foothold example is the file system.
When we previously looked at Kibana,
we saw two file system alerts that had to do with the foothold script.
While generating alerts is good,
automatic remediation is even better. If evidence
of an invisible process exists,
we should have a script that automatically kills that process.
Luckily for us, Wazuh has an active response feature that allows
us to trigger scripts when an alert occurs.
First, to implement active response,
we need to create a granular rule that only triggers when
evidence of a hidden process exists.
Let's go back into Kibana so we can dive a little deeper into this.