ooniagbi
commented
3 months ago Initial test
I tested the documentation on my current Wazuh setup (v4.7.4), and everything works, as seen in the screenshot below:
This implies that the error is not from the rule or the steps in the documentation.
Alert log
{
"_index": "wazuh-alerts-4.x-2024.07.25",
"_id": "UV2z6ZABrUKp1xjkGupd",
"_version": 1,
"_score": null,
"_source": {
"input": {
"type": "log"
},
"agent": {
"ip": "192.168.56.172",
"name": "DESKTOP-I1PBMQ1",
"id": "002"
},
"manager": {
"name": "wazuh-server"
},
"data": {
"win": {
"eventdata": {
"image": "C:\\\\Windows\\\\system32\\\\services.exe",
"targetObject": "HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\PSEXESVC\\\\ObjectName",
"processGuid": "{66774b51-6c61-66a2-0b00-000000000e00}",
"processId": "708",
"utcTime": "2024-07-25 08:50:48.923",
"ruleName": "technique_id=T1543,technique_name=Service Creation",
"details": "LocalSystem",
"eventType": "SetValue",
"user": "NT AUTHORITY\\\\SYSTEM"
},
"system": {
"eventID": "13",
"keywords": "0x8000000000000000",
"providerGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
"level": "4",
"channel": "Microsoft-Windows-Sysmon/Operational",
"opcode": "0",
"message": "\"Registry value set:\r\nRuleName: technique_id=T1543,technique_name=Service Creation\r\nEventType: SetValue\r\nUtcTime: 2024-07-25 08:50:48.923\r\nProcessGuid: {66774b51-6c61-66a2-0b00-000000000e00}\r\nProcessId: 708\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\PSEXESVC\\ObjectName\r\nDetails: LocalSystem\r\nUser: NT AUTHORITY\\SYSTEM\"",
"version": "2",
"systemTime": "2024-07-25T08:50:48.9367520Z",
"eventRecordID": "23679",
"threadID": "4800",
"computer": "DESKTOP-I1PBMQ1",
"task": "13",
"processID": "3420",
"severityValue": "INFORMATION",
"providerName": "Microsoft-Windows-Sysmon"
}
}
},
"rule": {
"firedtimes": 7,
"mail": false,
"level": 10,
"description": "PsExec service running as NT AUTHORITY\\\\SYSTEM has been created on DESKTOP-I1PBMQ1.",
"groups": [
"windows",
"sysmon",
"privilege-escalation"
],
"mitre": {
"technique": [
"Windows Service"
],
"id": [
"T1543.003"
],
"tactic": [
"Persistence",
"Privilege Escalation"
]
},
"id": "110011"
},
"location": "EventChannel",
"decoder": {
"name": "windows_eventchannel"
},
"id": "1721897449.6317303",
"timestamp": "2024-07-25T08:50:49.715+0000"
},
"fields": {
"timestamp": [
"2024-07-25T08:50:49.715Z"
]
},
"highlight": {
"agent.id": [
"@opensearch-dashboards-highlighted-field@002@/opensearch-dashboards-highlighted-field@"
],
"manager.name": [
"@opensearch-dashboards-highlighted-field@wazuh-server@/opensearch-dashboards-highlighted-field@"
]
},
"sort": [
1721897449715
]
}
cborla
During the https://github.com/wazuh/wazuh/issues/24852, I deployed a distributed Wazuh (one server for each central component) using the Offline Installation method step by step.
The related documentation is here: https://documentation-dev.wazuh.com/v4.9.0-alpha3/deployment-options/offline-installation/step-by-step.html
After a successful installation, I execute the MITRE ATT&CK Customization.
The related documentation is here: https://documentation-dev.wazuh.com/v4.9.0-alpha3/user-manual/ruleset/mitre.html#customization
After executing each step, I found that no alert was present in the dashboard with rule.id "110011", which is expected to be generated in this test. The test was done in a first attempt using an agent Windows Server 2019. In a second attempt using an agent Windows 11 as the documentation describes. In both cases, no alerts with rule.id "110011" were present on the dashboard.