All right.
Now that we have everything configured to be able to detect both
the T1136 and the T1074 attack techniques,
we just need to create some alerts for them in our SIEM tool.
And since we're using Kibana, I'm just going to copy this big query that we have.
Run over to the Security tab in the alerts, and let's configure some rules.
So this rule, we're just going to do a custom query,
and we can get rid of all of these index patterns.
And what we want is filebeat‑osquery. In the custom query, we're just
going to put what we created previously since we know it works. And you
can modify this based on your environment or based on what you actually
want to see if you want to see modified files, if you want to see it
moved from or moved to.
We can create detections for new files being created in
specific directories or all of the files coming together
into a specific directory as well.
So, the sky's the limit with what you can do with these custom
queries. For this one, we're just going to use what we have
created previously with the target path being monitored and
either moved from or created.
Now let's preview the results, and we can continue.
We can put the rule name too.
So, if we wanted to, we can do the shield technique.
All right.
And we can change the severity. We can tag it if we wanted to,
and we can schedule it to run after a certain amount of time. And
let's create and activate the rule.
Now, we can go ahead and create another one as well for the
other technique that we were talking about,
the T1136. We'll go custom query. We'll get rid of all those indexes as well.
We'll go filebeat‑osquery. And then, for the custom
search, we'll do the same thing.
We'll do osquery.result.name : users and osquery.result.action : added.
Or we can also look for the specific user add command as well, like we talked
about earlier. And we can preview the results if we wanted to.
Let's create the rule for DTE0033, which is SOP! Unauthorized user created.
And we'll create and activate that rule.
And let's try to go generate some of those alerts.
So, let's add another user, and let's move a file. Let's move
that PII file over to the temp directory. And now we have those
alerts set up to run every 5 minutes.
So we're going to fast forward the video, and we'll see if we
get the alerts after the 5‑minute period.
All right.
And after a couple minutes,
as you can see, we already have one alert for the DTE0030,
which is the pocket litter one.
So, if we switch our view to the event render view,
we have the event that was created from that alert.
So, that is so awesome that we were able to see this.
And now that the alert was created,
we can go investigate it further to validate if this was legitimate activity.
Maybe somebody in HR had requested permission to move that file so they can
add their own into there, or maybe somebody on the security team is moving
around the files just to mix it up a little bit.
In any case,
we have our alerts, and we see that we can
investigate it further via the timeline.
We already have the host that it was on,
so we can just go investigate the events for that host
specifically as we're diving deeper into it.