All right. Welcome back to the lab.
And in this one,
we're going to be looking specifically for MITRE
SHIELD defense technique DTE0033, which helps us with the MITRE ATT&CK technique,
T1136.
And what this is is the standard operating procedure one
where we want to detect user accounts that were created
outside of the acceptable process.
What does that mean to us, and how can we actually do it with osquery?
Well,
if we think about a typical enterprise organization
or a typical small business even,
there's usually a process for actually creating user accounts.
Much of the time, we're not using local accounts.
We're using some sort of account management tool,
Active Directory,
maybe a different cloud‑hosted service for managing user accounts,
something along those lines.
In our organization for Globomantics, we're actually doing the same thing.
We have our Linux box here that is tied to Active Directory,
so only local accounts that have been precreated and
Active Directory accounts can log into it.
So first off,
let's check out the specific configuration that's going to
help us identify this kind of stuff.
And we're going to look at the osquery.conf file again,
and I need to be in the right directory for it.
There we go.
And I jumped straight to this users one right here because these
are what's going to be querying the Linux box for all of the
user account information activity.
So, we are selecting all of the events from users,
and this is specifically for local system users,
not Active Directory users.
So,
the theory behind this is if we have this configured like this and
we're pulling all of the user events from osquery,
sending it up to Kibana,
we're looking for any type of account creation or deletion
that's occurring for localized accounts.
This won't work with Active Directory accounts the way it's configured.
So, since we're using Active Directory,
any local account that's created on the system should be in violation of
this unless we have preapproval. And if that's the case, then we'll get the
single alarm for it, and we'll investigate it,
make sure that it was legitimate activity.
But anything else outside of those instances, it could
be considered a potential event.
So, let's try it out.
Let's test it out here.
We're going to do a useradd friendlyuser as the
username. And then now, as you can see, I have that interval set to 60 seconds.
So, I'm going to fast‑forward the video a little bit. That way, the query can
run, and we'll hop into the Kibana instance in a minute.
All right, and by now, we should have had the query run, and we should have
some information. How we can validate that real quick before we hop over to
Kibana is by looking in that log directory,
the osqueryd.results. log. Now,
as you can see, there's a lot of it here, so let's go ahead and grep for
friendlyuser. And as you can see, we have some events.
If we had something like jQ on this box,
we can actually make the output a little bit prettier, and let's set that up
real quick so we can use it and then run our command again.
So, as you can see here,
we have some friendlyuser output that we had coming in, and we have all
of the field names already prebuilt, the values inside there, and you
see we have commands that were given to add the friendlyuser account.
And then, we also have other events from the users showing that the
friendlyuser was added.
Now, let's go check this out in Kibana real quick.
So, the first query that I'm going to run is osquery.result.name, and
I'm looking for the actual users for the query.
Remember, we're looking for those user events.
All right, and as you can see, we have one here. Let's check it out.
And in the event action right here, we have the added value,
which means that a user was just added. And we have the file directory and
everything like that, so we know the user's name. And right here, we also
have the osquery.result.columns.username field as friendlyuser. So, we can
use some of this information to create alerts inside of a SIEM tool or Kibana
and be able to notify us whenever a user is added to this specific box or a
certain number of boxes.
So, as you can see,
we just detected or validated that we can detect a user account being
created outside of our acceptable process of using Active Directory or
following a specific operating procedure.