Version	Component	Core issue	Core development branch	QA development branch
4.4	Active Response	https://github.com/wazuh/wazuh/issues/8400

Type	Value
Debug mode	1
Log message	"Repeated offender. Setting timeout to '%ds'"

Update 2022/09/13

manager-side configuration test

<active-response>
  <disabled>no</disabled>
  <command>netsh</command>
  <location>defined-agent</location>
  <agent_id>002</agent_id>
  <rules_id>60122</rules_id>
  <timeout>5</timeout>
</active-response>

Windows agent-side configuration test

<active-response>
  <disabled>no</disabled>
  <repeated_offenders>1,2,3</repeated_offenders>
</active-response>

local_internal_option configuration

windows.debug=1

Logs expected on the agent side (`ossec.log`)

2022/08/30 15:57:16 wazuh-execd: INFO: Adding offenders timeout: 1 (for #1)
2022/08/30 15:57:16 wazuh-execd: INFO: Adding offenders timeout: 2 (for #2)
2022/08/30 15:57:16 wazuh-execd: INFO: Adding offenders timeout: 3 (for #3)

It has attempted an rdp attack. To do so:

hydra -l <user> -p <wrong-password> rdp://<IP>

Case 1: If there is a recurrence before the timeout expires

For this case, it was expected to get blocked the IP as follows:

Fist attack 5 seconds (manager active-response timeout)
Second attack 1 minute (repeated_offender value 1)
Third attack 2 minute (repeated_offender value 2)
Fourth attack 3 minutes (repeated_offender value 3)
Fiveth attack 3 minutes (repeated_offender value 3) if the attack is before the 3 minutes timeout, otherwise start all over again (5 seconds, 1 min, 2 min ...), but it does not respond as is expected

Test

First rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 17:06:41 wazuh-agent[580] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:06:41.252+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":1,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663088801.7374934","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:06:40.5779621Z","eventRecordID":"61809","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '5s'. ``` #### End active-response ``` 2022/09/13 17:06:47 wazuh-agent[580] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:06:41.252+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":1,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663088801.7374934","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:06:40.5779621Z","eventRecordID":"61809","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '5s' ```

Second rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 17:06:56 wazuh-agent[580] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '60s' 2022/09/13 17:06:56 wazuh-agent[580] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:06:56.400+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":2,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663088816.7399328","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:06:55.7351659Z","eventRecordID":"61810","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '60s'. ``` #### End active-response ``` 2022/09/13 17:07:57 wazuh-agent[580] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:06:56.400+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":2,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663088816.7399328","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:06:55.7351659Z","eventRecordID":"61810","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '60s' ```

Third rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 17:08:05 wazuh-agent[580] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '120s' 2022/09/13 17:08:05 wazuh-agent[580] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:08:04.808+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":3,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663088884.7423722","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:08:04.1630799Z","eventRecordID":"61811","processID":"712","threadID":"4100","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '120s'. ``` #### End active-response ``` 2022/09/13 17:10:06 wazuh-agent[580] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:08:04.808+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":3,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663088884.7423722","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:08:04.1630799Z","eventRecordID":"61811","processID":"712","threadID":"4100","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '120s' ```

Fourth rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 17:10:18 wazuh-agent[580] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '180s' 2022/09/13 17:10:18 wazuh-agent[580] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:10:17.996+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":4,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663089017.7448122","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:10:17.3354683Z","eventRecordID":"61812","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '180s'. ``` #### End active-response ``` 2022/09/13 17:13:19 wazuh-agent[580] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:10:17.996+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":4,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663089017.7448122","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:10:17.3354683Z","eventRecordID":"61812","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '180s' ```

Fiveth rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 17:13:42 wazuh-agent[580] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '180s' 2022/09/13 17:13:42 wazuh-agent[580] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:13:42.268+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":5,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663089222.7487160","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:13:41.5911700Z","eventRecordID":"61817","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '180s'. ``` #### End active-response ``` 2022/09/13 17:16:43 wazuh-agent[580] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:13:42.268+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":5,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663089222.7487160","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:13:41.5911700Z","eventRecordID":"61817","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '180s' ```

Sixth rdp attack (when the waiting time was longer than the last timeout (> 3 min). output log (agent side):

#### Start active-response ``` 2022/09/13 17:22:23 wazuh-agent[580] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '180s' 2022/09/13 17:22:23 wazuh-agent[580] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:22:23.366+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":6,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663089743.7511554","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:22:22.7141305Z","eventRecordID":"61818","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '180s'. ``` #### End active-response ``` 2022/09/13 17:25:24 wazuh-agent[580] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:22:23.366+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":6,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663089743.7511554","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:22:22.7141305Z","eventRecordID":"61818","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '180s' ```

Case 2: Timeout negative value.

manager-side configuration test

<timeout>-5</timeout>

There is no information in ossec.log about the negative value.

Test

First rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 17:54:21 wazuh-agent[1600] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:54:21.421+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":2,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663091661.7566626","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:54:20.7641548Z","eventRecordID":"61850","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '-5s'. 2022/09/13 17:54:22 wazuh-agent[1600] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:54:21.421+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":2,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663091661.7566626","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:54:20.7641548Z","eventRecordID":"61850","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '-5s' ``` #### End active-response ``` nothing here ```

Second rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 17:57:03 wazuh-agent[1600] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '60s' 2022/09/13 17:57:03 wazuh-agent[1600] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:57:03.157+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":3,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663091823.7591020","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:57:02.4618801Z","eventRecordID":"61851","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '60s'. ``` #### End active-response ``` 2022/09/13 17:58:04 wazuh-agent[1600] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:57:03.157+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":3,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663091823.7591020","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:57:02.4618801Z","eventRecordID":"61851","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '60s' ```

Third rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 17:58:22 wazuh-agent[1600] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '120s' 2022/09/13 17:58:22 wazuh-agent[1600] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:58:21.795+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":4,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663091901.7606259","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:58:21.1377326Z","eventRecordID":"61852","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '120s'. ``` #### End active-response ``` 2022/09/13 18:00:23 wazuh-agent[1600] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T17:58:21.795+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":4,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663091901.7606259","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T17:58:21.1377326Z","eventRecordID":"61852","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '120s' ```

Fourth rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 18:00:40 wazuh-agent[1600] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '180s' 2022/09/13 18:00:40 wazuh-agent[1600] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:00:39.959+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":1,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092039.7630653","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:00:39.2187990Z","eventRecordID":"61853","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '180s'. ``` #### End active-response ``` 2022/09/13 18:03:41 wazuh-agent[1600] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:00:39.959+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":1,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092039.7630653","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:00:39.2187990Z","eventRecordID":"61853","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '180s' ```

The first attack does not execute the active response.

Manager side (alerts.json for the first attack):

``` {"timestamp":"2022-09-13T18:04:40.424+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":2,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092280.7664880","full_log":"{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4625\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8010000000000000\",\"systemTime\":\"2022-09-13T18:04:39.6723561Z\",\"eventRecordID\":\"61864\",\"processID\":\"712\",\"threadID\":\"764\",\"channel\":\"Security\",\"computer\":\"EC2AMAZ-N9OLJ1L\",\"severityValue\":\"AUDIT_FAILURE\",\"message\":\"\\\"An account failed to log on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Type:\\t\\t\\t3\\r\\n\\r\\nAccount For Which Logon Failed:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\tqa\\r\\n\\tAccount Domain:\\t\\t\\r\\n\\r\\nFailure Information:\\r\\n\\tFailure Reason:\\t\\tUnknown user name or bad password.\\r\\n\\tStatus:\\t\\t\\t0xC000006D\\r\\n\\tSub Status:\\t\\t0xC000006A\\r\\n\\r\\nProcess Information:\\r\\n\\tCaller Process ID:\\t0x0\\r\\n\\tCaller Process Name:\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tip-172-31-1-106\\r\\n\\tSource Network Address:\\t172.31.1.106\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tNtLmSsp \\r\\n\\tAuthentication Package:\\tNTLM\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\\r\\n\\r\\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe Process Information fields indicate which account and process on the system requested the logon.\\r\\n\\r\\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-0-0\",\"targetUserName\":\"qa\",\"status\":\"0xc000006d\",\"failureReason\":\"%%2313\",\"subStatus\":\"0xc000006a\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"ip-172-31-1-106\",\"keyLength\":\"0\",\"processId\":\"0x0\",\"ipAddress\":\"172.31.1.106\",\"ipPort\":\"0\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:04:39.6723561Z","eventRecordID":"61864","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"} {"timestamp":"2022-09-13T18:04:41.179+0000","agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092281.7664880","full_log":"2022/09/13 18:04:40 active-response/bin/netsh.exe: Starting","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"location":"active-response\\active-responses.log"} {"timestamp":"2022-09-13T18:04:41.179+0000","rule":{"level":3,"description":"Active response: active-response/bin/netsh.exe - add","id":"657","firedtimes":3,"mail":false,"groups":["ossec","active_response"],"pci_dss":["11.4"],"gdpr":["IV_35.7.d"],"nist_800_53":["SI.4"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3","CC7.4"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092281.7670973","full_log":"2022/09/13 18:04:40 active-response/bin/netsh.exe: {\"version\":1,\"origin\":{\"name\":\"node01\",\"module\":\"wazuh-execd\"},\"command\":\"add\",\"parameters\":{\"extra_args\":[],\"alert\":{\"timestamp\":\"2022-09-13T18:04:40.424+0000\",\"rule\":{\"level\":5,\"description\":\"Logon failure - Unknown user or bad password.\",\"id\":\"60122\",\"mitre\":{\"id\":[\"T1078\",\"T1531\"],\"tactic\":[\"Defense Evasion\",\"Persistence\",\"Privilege Escalation\",\"Initial Access\",\"Impact\"],\"technique\":[\"Valid Accounts\",\"Account Access Removal\"]},\"firedtimes\":2,\"mail\":false,\"groups\":[\"windows\",\"windows_security\",\"authentication_failed\"],\"gdpr\":[\"IV_32.2\",\"IV_35.7.d\"],\"gpg13\":[\"7.1\"],\"hipaa\":[\"164.312.b\"],\"nist_800_53\":[\"AC.7\",\"AU.14\"],\"pci_dss\":[\"10.2.4\",\"10.2.5\"],\"tsc\":[\"CC6.1\",\"CC6.8\",\"CC7.2\",\"CC7.3\"]},\"agent\":{\"id\":\"004\",\"name\":\"EC2AMAZ-N9OLJ1L\",\"ip\":\"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA\"},\"manager\":{\"name\":\"ip-172-31-0-15\"},\"id\":\"1663092280.7664545\",\"decoder\":{\"name\":\"windows_eventchannel\"},\"data\":{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4625\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8010000000000000\",\"systemTime\":\"2022-09-13T18:04:39.6723561Z\",\"eventRecordID\":\"61864\",\"processID\":\"712\",\"threadID\":\"764\",\"channel\":\"Security\",\"computer\":\"EC2AMAZ-N9OLJ1L\",\"severityValue\":\"AUDIT_FAILURE\",\"message\":\"\\\"An account failed to log on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Type:\\t\\t\\t3\\r\\n\\r\\nAccount For Which Logon Failed:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\tqa\\r\\n\\tAccount Domain:\\t\\t\\r\\n\\r\\nFailure Information:\\r\\n\\tFailure Reason:\\t\\tUnknown user name or bad password.\\r\\n\\tStatus:\\t\\t\\t0xC000006D\\r\\n\\tSub Status:\\t\\t0xC000006A\\r\\n\\r\\nProcess Information:\\r\\n\\tCaller Process ID:\\t0x0\\r\\n\\tCaller Process Name:\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tip-172-31-1-106\\r\\n\\tSource Network Address:\\t172.31.1.106\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tNtLmSsp \\r\\n\\tAuthentication Package:\\tNTLM\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\\r\\n\\r\\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe Process Information fields indicate which account and process on the system requested the logon.\\r\\n\\r\\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-0-0\",\"targetUserName\":\"qa\",\"status\":\"0xc000006d\",\"failureReason\":\"%%2313\",\"subStatus\":\"0xc000006a\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"ip-172-31-1-106\",\"keyLength\":\"0\",\"processId\":\"0x0\",\"ipAddress\":\"172.31.1.106\",\"ipPort\":\"0\"}}},\"location\":\"EventChannel\"},\"program\":\"active-response/bin/netsh.exe\"}}","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"data":{"srcip":"172.31.1.106","version":"1","origin":{"name":"node01","module":"wazuh-execd"},"command":"add","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:04:40.424+0000","rule":{"level":"5","description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":"2","mail":"false","groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092280.7664545","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:04:39.6723561Z","eventRecordID":"61864","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}},"location":"active-response\\active-responses.log"} {"timestamp":"2022-09-13T18:04:41.187+0000","agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092281.7670973","full_log":"2022/09/13 18:04:40 active-response/bin/netsh.exe: {\"version\":1,\"origin\":{\"name\":\"netsh.exe\",\"module\":\"active-response\"},\"command\":\"check_keys\",\"parameters\":{\"keys\":[\"172.31.1.106\"]}}","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"data":{"version":"1","origin":{"name":"netsh.exe","module":"active-response"},"command":"check_keys","parameters":{"keys":["172.31.1.106"]}},"location":"active-response\\active-responses.log"} {"timestamp":"2022-09-13T18:04:41.194+0000","agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092281.7670973","full_log":"2022/09/13 18:04:40 active-response/bin/netsh.exe: {\"version\":1,\"origin\":{\"name\":\"node01\",\"module\":\"wazuh-execd\"},\"command\":\"continue\",\"parameters\":{\"extra_args\":[],\"alert\":{\"timestamp\":\"2022-09-13T18:04:40.424+0000\",\"rule\":{\"level\":5,\"description\":\"Logon failure - Unknown user or bad password.\",\"id\":\"60122\",\"mitre\":{\"id\":[\"T1078\",\"T1531\"],\"tactic\":[\"Defense Evasion\",\"Persistence\",\"Privilege Escalation\",\"Initial Access\",\"Impact\"],\"technique\":[\"Valid Accounts\",\"Account Access Removal\"]},\"firedtimes\":2,\"mail\":false,\"groups\":[\"windows\",\"windows_security\",\"authentication_failed\"],\"gdpr\":[\"IV_32.2\",\"IV_35.7.d\"],\"gpg13\":[\"7.1\"],\"hipaa\":[\"164.312.b\"],\"nist_800_53\":[\"AC.7\",\"AU.14\"],\"pci_dss\":[\"10.2.4\",\"10.2.5\"],\"tsc\":[\"CC6.1\",\"CC6.8\",\"CC7.2\",\"CC7.3\"]},\"agent\":{\"id\":\"004\",\"name\":\"EC2AMAZ-N9OLJ1L\",\"ip\":\"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA\"},\"manager\":{\"name\":\"ip-172-31-0-15\"},\"id\":\"1663092280.7664545\",\"decoder\":{\"name\":\"windows_eventchannel\"},\"data\":{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4625\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8010000000000000\",\"systemTime\":\"2022-09-13T18:04:39.6723561Z\",\"eventRecordID\":\"61864\",\"processID\":\"712\",\"threadID\":\"764\",\"channel\":\"Security\",\"computer\":\"EC2AMAZ-N9OLJ1L\",\"severityValue\":\"AUDIT_FAILURE\",\"message\":\"\\\"An account failed to log on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Type:\\t\\t\\t3\\r\\n\\r\\nAccount For Which Logon Failed:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\tqa\\r\\n\\tAccount Domain:\\t\\t\\r\\n\\r\\nFailure Information:\\r\\n\\tFailure Reason:\\t\\tUnknown user name or bad password.\\r\\n\\tStatus:\\t\\t\\t0xC000006D\\r\\n\\tSub Status:\\t\\t0xC000006A\\r\\n\\r\\nProcess Information:\\r\\n\\tCaller Process ID:\\t0x0\\r\\n\\tCaller Process Name:\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tip-172-31-1-106\\r\\n\\tSource Network Address:\\t172.31.1.106\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tNtLmSsp \\r\\n\\tAuthentication Package:\\tNTLM\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\\r\\n\\r\\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe Process Information fields indicate which account and process on the system requested the logon.\\r\\n\\r\\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-0-0\",\"targetUserName\":\"qa\",\"status\":\"0xc000006d\",\"failureReason\":\"%%2313\",\"subStatus\":\"0xc000006a\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"ip-172-31-1-106\",\"keyLength\":\"0\",\"processId\":\"0x0\",\"ipAddress\":\"172.31.1.106\",\"ipPort\":\"0\"}}},\"location\":\"EventChannel\"},\"program\":\"active-response/bin/netsh.exe\"}}","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"data":{"srcip":"172.31.1.106","version":"1","origin":{"name":"node01","module":"wazuh-execd"},"command":"continue","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:04:40.424+0000","rule":{"level":"5","description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":"2","mail":"false","groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092280.7664545","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:04:39.6723561Z","eventRecordID":"61864","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}},"location":"active-response\\active-responses.log"} {"timestamp":"2022-09-13T18:04:41.210+0000","agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092281.7670973","full_log":"2022/09/13 18:04:40 active-response/bin/netsh.exe: Ended","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"location":"active-response\\active-responses.log"} {"timestamp":"2022-09-13T18:04:45.192+0000","agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092285.7670973","full_log":"2022/09/13 18:04:41 active-response/bin/netsh.exe: Starting","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"location":"active-response\\active-responses.log"} {"timestamp":"2022-09-13T18:04:45.192+0000","rule":{"level":3,"description":"Active response: active-response/bin/netsh.exe - delete","id":"657","firedtimes":4,"mail":false,"groups":["ossec","active_response"],"pci_dss":["11.4"],"gdpr":["IV_35.7.d"],"nist_800_53":["SI.4"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3","CC7.4"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092285.7680119","full_log":"2022/09/13 18:04:41 active-response/bin/netsh.exe: {\"version\":1,\"origin\":{\"name\":\"node01\",\"module\":\"wazuh-execd\"},\"command\":\"delete\",\"parameters\":{\"extra_args\":[],\"alert\":{\"timestamp\":\"2022-09-13T18:04:40.424+0000\",\"rule\":{\"level\":5,\"description\":\"Logon failure - Unknown user or bad password.\",\"id\":\"60122\",\"mitre\":{\"id\":[\"T1078\",\"T1531\"],\"tactic\":[\"Defense Evasion\",\"Persistence\",\"Privilege Escalation\",\"Initial Access\",\"Impact\"],\"technique\":[\"Valid Accounts\",\"Account Access Removal\"]},\"firedtimes\":2,\"mail\":false,\"groups\":[\"windows\",\"windows_security\",\"authentication_failed\"],\"gdpr\":[\"IV_32.2\",\"IV_35.7.d\"],\"gpg13\":[\"7.1\"],\"hipaa\":[\"164.312.b\"],\"nist_800_53\":[\"AC.7\",\"AU.14\"],\"pci_dss\":[\"10.2.4\",\"10.2.5\"],\"tsc\":[\"CC6.1\",\"CC6.8\",\"CC7.2\",\"CC7.3\"]},\"agent\":{\"id\":\"004\",\"name\":\"EC2AMAZ-N9OLJ1L\",\"ip\":\"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA\"},\"manager\":{\"name\":\"ip-172-31-0-15\"},\"id\":\"1663092280.7664545\",\"decoder\":{\"name\":\"windows_eventchannel\"},\"data\":{\"win\":{\"system\":{\"providerName\":\"Microsoft-Windows-Security-Auditing\",\"providerGuid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"eventID\":\"4625\",\"version\":\"0\",\"level\":\"0\",\"task\":\"12544\",\"opcode\":\"0\",\"keywords\":\"0x8010000000000000\",\"systemTime\":\"2022-09-13T18:04:39.6723561Z\",\"eventRecordID\":\"61864\",\"processID\":\"712\",\"threadID\":\"764\",\"channel\":\"Security\",\"computer\":\"EC2AMAZ-N9OLJ1L\",\"severityValue\":\"AUDIT_FAILURE\",\"message\":\"\\\"An account failed to log on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Type:\\t\\t\\t3\\r\\n\\r\\nAccount For Which Logon Failed:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\tqa\\r\\n\\tAccount Domain:\\t\\t\\r\\n\\r\\nFailure Information:\\r\\n\\tFailure Reason:\\t\\tUnknown user name or bad password.\\r\\n\\tStatus:\\t\\t\\t0xC000006D\\r\\n\\tSub Status:\\t\\t0xC000006A\\r\\n\\r\\nProcess Information:\\r\\n\\tCaller Process ID:\\t0x0\\r\\n\\tCaller Process Name:\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\tip-172-31-1-106\\r\\n\\tSource Network Address:\\t172.31.1.106\\r\\n\\tSource Port:\\t\\t0\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tNtLmSsp \\r\\n\\tAuthentication Package:\\tNTLM\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\\r\\n\\r\\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe Process Information fields indicate which account and process on the system requested the logon.\\r\\n\\r\\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\\\"\"},\"eventdata\":{\"subjectUserSid\":\"S-1-0-0\",\"subjectLogonId\":\"0x0\",\"targetUserSid\":\"S-1-0-0\",\"targetUserName\":\"qa\",\"status\":\"0xc000006d\",\"failureReason\":\"%%2313\",\"subStatus\":\"0xc000006a\",\"logonType\":\"3\",\"logonProcessName\":\"NtLmSsp\",\"authenticationPackageName\":\"NTLM\",\"workstationName\":\"ip-172-31-1-106\",\"keyLength\":\"0\",\"processId\":\"0x0\",\"ipAddress\":\"172.31.1.106\",\"ipPort\":\"0\"}}},\"location\":\"EventChannel\"},\"program\":\"active-response/bin/netsh.exe\"}}","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"data":{"srcip":"172.31.1.106","version":"1","origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:04:40.424+0000","rule":{"level":"5","description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":"2","mail":"false","groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092280.7664545","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:04:39.6723561Z","eventRecordID":"61864","processID":"712","threadID":"764","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}},"location":"active-response\\active-responses.log"} {"timestamp":"2022-09-13T18:04:45.206+0000","agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092285.7680119","full_log":"2022/09/13 18:04:41 active-response/bin/netsh.exe: Ended","decoder":{"parent":"ar_log_json","name":"ar_log_json"},"location":"active-response\\active-responses.log"} ```

Case 3: Timeout valid where a repeated_offenders negative value.

<active-response>
  <disabled>no</disabled>
  <repeated_offenders>-1,2,3</repeated_offenders>
</active-response>

The ossec.log in the agent side:

2022/09/13 18:10:36 wazuh-agent[4460] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: -1 (for #1)
2022/09/13 18:10:36 wazuh-agent[4460] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 2 (for #2)
2022/09/13 18:10:36 wazuh-agent[4460] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 3 (for #3)

Test

First attack works as expected
Second attack does not work
Third and the following attack works as expected

First rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 18:11:30 wazuh-agent[4460] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:11:30.284+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":1,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092690.7692752","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:11:29.5951960Z","eventRecordID":"61885","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '5s'. ``` #### End active-response ``` 2022/09/13 18:11:36 wazuh-agent[4460] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:11:30.284+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":1,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092690.7692752","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:11:29.5951960Z","eventRecordID":"61885","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '5s' ```

Second rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 18:11:54 wazuh-agent[4460] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '-60s' 2022/09/13 18:11:54 wazuh-agent[4460] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:11:53.770+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":2,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092713.7717146","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:11:53.1222326Z","eventRecordID":"61886","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '-60s'. ``` #### End active-response ``` 2022/09/13 18:11:55 wazuh-agent[4460] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:11:53.770+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":2,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092713.7717146","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:11:53.1222326Z","eventRecordID":"61886","processID":"712","threadID":"808","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '-60s' ```

Third rdp attack output log (agent side):

#### Start active-response ``` 2022/09/13 18:12:26 wazuh-agent[4460] execd.c:325 at ExecdRun(): DEBUG: Repeated offender. Setting timeout to '120s' 2022/09/13 18:12:26 wazuh-agent[4460] execd.c:375 at ExecdRun(): DEBUG: Adding command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:12:26.342+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":3,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092746.7732385","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:12:25.6867211Z","eventRecordID":"61887","processID":"712","threadID":"1400","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' to the timeout list, with a timeout of '120s'. ``` #### End active-response ``` 2022/09/13 18:14:27 wazuh-agent[4460] execd.c:143 at ExecdTimeoutRun(): DEBUG: Executing command 'active-response/bin/netsh.exe {"version":1,"origin":{"name":"node01","module":"wazuh-execd"},"command":"delete","parameters":{"extra_args":[],"alert":{"timestamp":"2022-09-13T18:12:26.342+0000","rule":{"level":5,"description":"Logon failure - Unknown user or bad password.","id":"60122","mitre":{"id":["T1078","T1531"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Impact"],"technique":["Valid Accounts","Account Access Removal"]},"firedtimes":3,"mail":false,"groups":["windows","windows_security","authentication_failed"],"gdpr":["IV_32.2","IV_35.7.d"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AC.7","AU.14"],"pci_dss":["10.2.4","10.2.5"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"004","name":"EC2AMAZ-N9OLJ1L","ip":"FE80:0000:0000:0000:3CE9:E64B:C186:0DFA"},"manager":{"name":"ip-172-31-0-15"},"id":"1663092746.7732385","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Security-Auditing","providerGuid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","eventID":"4625","version":"0","level":"0","task":"12544","opcode":"0","keywords":"0x8010000000000000","systemTime":"2022-09-13T18:12:25.6867211Z","eventRecordID":"61887","processID":"712","threadID":"1400","channel":"Security","computer":"EC2AMAZ-N9OLJ1L","severityValue":"AUDIT_FAILURE","message":"\"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tqa\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tip-172-31-1-106\r\n\tSource Network Address:\t172.31.1.106\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\""},"eventdata":{"subjectUserSid":"S-1-0-0","subjectLogonId":"0x0","targetUserSid":"S-1-0-0","targetUserName":"qa","status":"0xc000006d","failureReason":"%%2313","subStatus":"0xc000006a","logonType":"3","logonProcessName":"NtLmSsp","authenticationPackageName":"NTLM","workstationName":"ip-172-31-1-106","keyLength":"0","processId":"0x0","ipAddress":"172.31.1.106","ipPort":"0"}}},"location":"EventChannel"},"program":"active-response/bin/netsh.exe"}}' after a timeout of '120s' ```

Case 4: Repeat_offenders exceeds the established recurrence limit.

Agent configuration

<active-response>
  <disabled>no</disabled>
  <repeated_offenders>1,2,3,4,5,6,7</repeated_offenders>
</active-response>

Test

The ossec.log in the agent side:

2022/09/14 12:43:25 wazuh-agent[6000] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 1 (for #1)
2022/09/14 12:43:25 wazuh-agent[6000] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 2 (for #2)
2022/09/14 12:43:25 wazuh-agent[6000] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 3 (for #3)
2022/09/14 12:43:25 wazuh-agent[6000] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 4 (for #4)
2022/09/14 12:43:25 wazuh-agent[6000] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 5 (for #5)

First attack, IP blocked for 5 seconds (manager timeout).
Second attack, IP blocked for 1 min.
Third attack, IP blocked for 2 min.
Fourth attack, IP blocked for 3 min.
Fiveth attack, IP blocked for 4 min.
Sixth attack, IP blocked for 5 min.
Seventh attack, IP blocked for 5 min (before 5 min).
Eighth attack, IP blocked for 5 min (after 5 min).

Case 5: Repeat_offenders values are set more than once.

Agent configuration

<active-response>
  <disabled>no</disabled>
  <repeated_offenders>1,2,3</repeated_offenders>
  <repeated_offenders>4,5</repeated_offenders>
</active-response>

Test

The ossec.log in the agent side:

2022/09/14 13:44:52 wazuh-agent[4512] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 1 (for #1)
2022/09/14 13:44:52 wazuh-agent[4512] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 2 (for #2)
2022/09/14 13:44:52 wazuh-agent[4512] config.c:139 at ExecdConfig(): INFO: Adding offenders timeout: 3 (for #3)

Take the first repeated_offenders tag. This behavior is not expected because it is supposed to take the second repeated_offenders to overwrite the first appearance.

wazuh / wazuh-qa

System tests: Repeated offenders not working/implemented in windows #2946

Description

Usefull Documentation:

Use cases

Development stage

Update 2022/09/02

manager-side configuration test

Linux agent-side configuration test

local_internal_option configuration

Logs expected on the agent side (ossec.log)

Case 1: If there is a recurrence before the timeout expires

Test

Case 2: Timeout negative value.

manager-side configuration test

Test

First ssh attack output log (agent side):

Case 3: Timeout valid where a repeated_offenders negative value.

Test

First ssh attack output log (agent side):

Manager alerts.json file

Case 4: Repeat_offenders exceeds the established recurrence limit.

Case 5: Repeat_offenders values are set more than once.

Update 2022/09/13

manager-side configuration test

Windows agent-side configuration test

local_internal_option configuration

Logs expected on the agent side (ossec.log)

Case 1: If there is a recurrence before the timeout expires

Test

Case 2: Timeout negative value.

manager-side configuration test

Test

Case 3: Timeout valid where a repeated_offenders negative value.

Test

Case 4: Repeat_offenders exceeds the established recurrence limit.

Agent configuration

Test

Case 5: Repeat_offenders values are set more than once.

Agent configuration

Test

Logs expected on the agent side (`ossec.log`)

Manager `alerts.json` file

Logs expected on the agent side (`ossec.log`)