Proj 6x: Monitoring File Integrity with Wazuh 3 (15 pts.)

What you need

Purpose

To practice using Wazuh to detect suspicious events on the Windows Server.

In this project, you monitor activity in a single folder.

Creating a Folder to Monitor

On your Windows Server, open File Explorer.

Right-click an empty portion of the window and click New, Folder.

Give the new folder a name of YOURNAME, replacing "YOURNAME" with your own name, as shown below.

Double-click the YOURNAME folder.

Right-click an empty portion of the window and click New, "Text Document".

Give the new file a name of YOURNAME-SECRETS, replacing "YOURNAME" with your own name, as shown below.

Repeat the process to make another text file named YOURNAME-IMPORTANT, replacing "YOURNAME" with your own name, as shown below.

Launching ossec_agents

In File Explorer, navigate to this folder, as shown below.
C:\Program Files (x86)\ossec-agent
Double-click win32ui.

(Note: the Start menu no longer works on Windows Server 2016. This is a feature, not a bug.)

Configuring Folder Monitoring

In "Wazah Agent Manager", from the menu bar, click View, "View Config", as shown below.

In the "ossec.conf" window, scroll down to the "Syscheck" section, as shown below.

Backing Up the Configuration File

In the "ossec.conf" window, from the menu bar, click File, "Save As...". Save the file as ossec.conf.bak

Close the "ossec.conf" window.

In "Wazah Agent Manager", from the menu bar, click View, "View Config"

Configuring Monitoring of the C:\YOURNAME Folder

Checking the system every 12 hours might be good to avoid wasting resources on a busy server, but we want to see results quickly for this project. So make these changes to the "ossec.conf" file, as shown below.

Change the frequency to 120

Add this line below the "<disabled>no</disabled>" line:

<directories report_changes="yes" check_all="yes" realtime="yes">C:\YOURNAME</directories>

In the "ossec.conf" window, from the menu bar, click File, Save.

Close the "ossec.conf" window.

Restarting the Wazuh Agent

In "Wazah Agent Manager", from the menu bar, click Manage, Restart. Click OK.

Unfortunately, the Wazuh agent frequently fails to start. To check it, click Manage, Status.

If the box says "Agent stopped", Click OK and then click Manage, Start.

Viewing Wazuh Logs

In "Wazah Agent Manager", from the menu bar, click View, "View Logs".

An "ossec - Notepad" window opens. Scroll to the bottom. You should see the message "Syscheck scan frequency: 120 seconds", as shown below.

Scroll up a page or two. You should see the message "Monitoring directory: 'C:\YOURNAME'", as shown below.

Modifying the Monitored Folder

In File Explorer, navigate to this folder, as shown below.
C:\YOURNAME
Right-click an empty portion of the window and click New, "Text Document".

Name the new file YOURNAME-NEW.

Right-click the YOURNAME-IMPORTANT file and click Delete.

Double-click the YOURNAME-SECRETS file. Type a new line in that file, click File, Save, and close Notepad.

Your window should now look like the example below.

Viewing Wazuh Alerts

In the Wazuh web administration page, at the top, click AGENTS.

In the next page, click Win-YOURNAME, as shown below.

In the next page, you should see some colorful circular charts at the bottom, as shown below.

If you don't, see the Troubleshooting box below.

Troubleshooting

If you see no results, first try changing the time interval.

At the top right, click the time range, which may say "Last 15 minutes" or some other time range, as shown below.

On the next page, at the top right, click Quick. Click "This week", as shown below.

If you still see no events, try creating another file in the C:\YOURNAME folder, and restarting the agent again.

It seems unreliable--it did not detect all the changes I made.

Viewing File Integrity Alerts

At the top, to the right of "GENERAL", click "FILE INTEGRITY.

Below the word "GENERAL", in the search bar, type

YOURNAME

Press Enter.

You should see some events, in the charts, as shown below.

Scroll to the bottom to see the alerts.

You should see alerts about the files in C:\YOURNAME, as shown below.

Saving a Screen Image

Make sure at least one alert about a file in C:\YOURNAME is visible, as shown in the image above.

Capture a whole-desktop image.

Save the image with the filename "Your Name Proj 6xa". Use your real name, not the literal text "Your Name".

YOU MUST SUBMIT AN IMAGE OF THE WHOLE DESKTOP TO GET FULL CREDIT!

Turning in your Project

Send the image to: cnit.50sam@gmail.com with a subject line of "Proj 6x From Your Name", replacing Your Name with your own first and last name. Send a Cc to yourself.

Sources

Wazuh v3.0 released!

Docs: Welcome to Wazuh

Posted 12-26-17 by Sam Bowne