SOC Automation Project (Home Lab) | Part 4 transcript

welcome to part four of five on the series of the sock automation project if you haven't seen the previous Parts where we go over how to build out a diagram for this lab install what is required and configure the components I highly encourage you go and watch that first to get up to speed today's objective is to generate Telemetry from our Windows 10 machine and making sure it is being ingested into Wasa by the end of the video you would have properly conf figured and sent Telemetry containing mimik cats and trigger a custom alert that you created let's get started starting with our Windows 10 machine when we install Wasa the configuration for it will be under programs file x86 so let's go ahead and open that up program files x86 and it will be under the file ek- agent the file that we are most interested in is called osc.com so right here osc.com we can rightclick this and open with notepad now we'll likely need to have administrative privileges but let's just try opening this up in notepad I guess not so this is all good this configuration will contain everything related to Wasa if we scroll down just a bit we will see what is called log analysis and under the security location you notice how there are some event IDs that are being excluded by the exclamation mark equal sign for those that don't know this means does not equal to if I wanted to monitor for po shell for example we can follow the same syntax as the local file for example this one right here so I can copy this and then paste it right underneath and then type in Powershell but because I'm not interested in Powell and instead I want to look for processes that will contain mimic cats and in order to to do that we either should have cismon installed or enable Windows security event ID 4688 we will utilize the cismon method since we installed cismon in part two of this series let's configure our os. configuration file to ask it to ingest our sysmon logs but before we make any configurations I'm going to close this one out and don't save I'm going to copy out the osc.com file and then just make a backup of it just in case we mess something up so I'll rename this file as o-b backup because again if we make a mistake we can just revert it back now let's go ahead and doubleclick the configuration file and then scroll down to log analysis so this one right here I'll go ahead and start copying one of the local file tags and right underneath application I'll just paste it in currently for the location name it is set to applic a and because I want to ingest cismon logs let's change this to Symon's channel name now how do we get that channel name well we can get that through opening up Windows Event Viewer so we type in Event Viewer we will expand applications and services expand Microsoft Windows scroll down until you see cismon right here I'll expand cismon and right click operation select properties and from here we can see the full name this is going to be the name that we will be using so I'll go ahead and copy that and head back over to our configuration file and I'll paste it into this application location just like that now if I wanted to again ingest Powershell instead of sysmon scroll up until I find power shell and then I'll right click operational and then hit properties this is the name that I'll copy and paste into the location tag for the sake of ingestion I'm going to remove the local file application I'm also going to remove the security and system and then I'll just leave the active response here now in other words this means that application security and system will no longer forward events to our Wasa manager if you wanted to forward those logs you can keep it as is but for me again just for an ingestion sake I only care about cismon so we will go ahead and save this file out then I'll replace it here it says you do not have permissions to open this file okay so we do need administrative permissions that's what I thought so we'll type in notepad and then I'll rightclick it and run as administrator I'll hit yes now from here I'm just going to copy out the cismon location tag don't save and then I'll click on file open let's open up the OAC configuration file this one right here again I'm going to remove application security and system then I'll paste in my cismon and now we will go ahead and save this file the next step is to open up our services and restart our Wasa Service as a side note anytime you change your configurations you must restart the service head over to our Wasa dashboard and under events and making sure that we're in the alerts index we can start searching for cismon events so I'll type in sysmon and it might take some time until you can actually search for some cismon events so if you do not see it at first that is okay the next thing we want to do is download mimik cats onto our machine we want to make sure that we disable Windows Defender or at least exclude our downloads folder because it will detect it for sure for those that don't know what mimic cats is or does it is an application that attackers and red teamers use to extract credentials from your machine before I download mimik cats I will go and exclude the downloads path so I will type in security and select Windows security I'll dismiss the virus and threat protection and under manage settings for virus and threat protection settings you want to scroll down and click on add or remove exclusions I'll add an exclusion I'll add it as a folder and then I'll select my downloads folder to exclude select yes now our downloads folder is excluded I'll go ahead and download mimic cats and save it in my downloads folder if you are downloading mimicat your web browser might block that now if you're using Google Chrome like I am go into your Google Chrome settings and under privacy and security you want to select security and then scroll down and select no protection turn that off and now you can try and download mimik cats again once mimik cats is downloaded I'll right click it and select extract all and now I have mimicat here so what I'll do is open up a administrative Powershell session and then change my directory into mimic cats now I will run mimic cat.exe and now we'll head back over to wasa's dashboard and check if you can see any events related to mimik cat so I'll type in mimic cats and hit enter now you might not see any events relating to cismon or even mimic cats and that could be because due to the fact that your cismon events did not trigger any alerts or rules from Wasa because Wasa by default does not log everything and only logs things when a rule or alert was triggered of course we can change this Behavior by going into the Wasa manager and configuring the osc.com file to make it so it logs everything or we can create a rule that looks at specific events that way when a particular event does exist it will trigger an alert in Wasa and then we can search for it so why don't we go and do that let's go and modify the osac configuration to log everything I am in my Wasa manager CLI the first thing we want to do is make sure to create a backup of the osc.com file and that is located in VA r oacc o.com and then I'll just place it in my home directory called OAC dasb backup.com because again mistakes do happen and if we accidentally overwrite something we can always revert it back using our backup file now let's go ahead and edit that file so I'll open up the osc.com file and hit enter now if you look at the bottom right under alerts unor log you see a log all section and a log allore Json section currently they are both set to no so I'll change this to yes now essentially this means what format do you want the logs to be displayed in you can select either or or in my case selecting both I'll save this and hit yes now let's restart the Wasa manager by typing in system CTL restart was- manager and then you can hit tab for auto completion now what this does is force Wasa to begin archiving all the logs and put them into a file called Archives this file will be located in VAR OAC logs archive and I'll show you so if we go over to VAR OAC logs archives so if we just do an LS these are the files that will be created and the logs will be placed in here in order for was to start ingesting these logs we need to change our configuration in file beat to do that we type in Nano SLC filebeat filebeat doyo and if we were to scroll down we will eventually see a setting called archives enabled false so let's go and change this to true and then we will save that out just like anything if you update a configuration you must restart its service so I'll restart filebeat service now that we've updated filebeat as well as the osac configuration let's head back over to our Wasa dashboard and create a new index on our dashboard click the top left corner so this hamburger icon and then you want to scroll down to select stack management click on index pattern and you notice how we have three indexes so far we have alerts monitoring and statistics we want to create an index for our c IES that way we can search all the logs regardless if was all triggered an alert to do that we can click on create index at the top right corner the big blue button and we can name our index here so I'll type in Wasa Das archives dash asri for everything I'll click on next and for the time field I will select the timestamp at the bottom and then select create index pattern now let's head back over to discover we can head over there by clicking on the top left the hamburger icon and just click on Discover select the indexes from the drop down arrow and then we want to select our archives now it might take a while until events start to flow in but it will come in eventually I promise one thing you can do to troubleshoot is cat out the archive file and grab for mimik cats if you see it in archives it will be ingested in the dashboard it just takes some time and I can demonstrate this for you in a sec now wiah is a bit Special by default not all logs will show in the manager in fact only those that trigger a rule will show up that is why we had to configure the logs to log everything making it so regardless of a rule being triggered or not we want the manager to Archive it and allow us to search for them now don't get me wrong although what they are doing by default is great but if we are testing testing it hinders our test do keep this in mind if you do play around with Wasa so in our Wasa manager CLI under the following directory path so VAR OAC logs archive if we were to type in LS we can see archives.

Json and archives. log we definitely see that there are events in those files let me clear out the screen here I mentioned to troubleshoot you can cat out the archive file so I will cat out archive Json and then I'll pipe it into a grap dasi for ignore case sensitivity and then I'll search for mimik cats now if I don't see anything in my archives then a mimic cats event did not generate so this means that no matter what I'm not going to see mimik cats in my Wasa dashboard if I don't see any mimic cats events the next thing that we can do is let's try and regenerate it let's type in mimik cats again and then hit enter open up our Event Viewer just to make sure that cismon is capturing mimic cats the event ID that I'm most interested in is event id1 because these are process creations and here I can see that there is in fact mimic cats so cismon is generating on my Windows machine and we did configure our oset configuration to push cismon data over to Wasa the next thing we can do is check our Wasa manager again and GP for for mimic cats we actually see some data regarding mimic cats in our archive file so that's great this means that if we search for mimik cats in our Wasa dashboard and we do not see any events yet we just need to be a little patient and eventually it will get in there let's head over to our dashboard and take a look I am under the archives index because that is what we want and then I will type in mimic cats and hit enter and great we have two events that that's perfect now remember we are interested in event ID 1 because this will show us process Creations if you don't see mimik cats in Wasa but you see it in your archive log file you can try and force the ingestion by restarting your Wasa manager service of course this do you don't want to do that in production but because it's demo it's all good now if I were to expand the event id1 and scroll down a bit we can take a look at the fields I noticed that there is a field called Original file name we will use this field to craft our alert because if we were to use a field such as image this one right here an attacker could simply rename mimik cats to mimik cow and the alert would have been bypassed however with the original file name regardless of the name change to mimik cow we should still be able to see it and the alert should trigger now let's start creating our alert Wasa has some built-in rules that we can use as a reference stored in the location VAR OAC rule set rules I know it's a bit of a mouthful but their rules are there and it's located in Wasa manager CLI however the good news is that we can actually access this on the dashboard itself so if you don't like playing around with CLI this is great news for you to access the rules you want to click on the home button and then there will be a drop down next to it just go ahead and click on that and then Select Management you'll see rules over here click on rules and now you want to click on manage rule files at the top right and because we are interested specifically in the event ID one for cismon let's try and find that by typing in sysmon and hit enter now immediately I can see there is a 0 800- cyson _ 1 we can take a look at it by clicking on this I icon these are sysmon rules that are built into Wasa specifically targeting event id1 I'll copy one of these for reference and build it out as a custom rule to detect mimic cats so let's just select the first one here I'll select the rule ID all the way to the rule and then copy that out once we copy that head back and click on custom rules I'm going to minimize the browser because you cannot see it but there's a custom rules button here I'll go ahead and click on that and immediately we see one local rule file and we can edit that by clicking on the pencil icon we want to paste in the rule that we copied into the local rule that already exists but you want to do that below the rule just like that so one thing to keep in mind is the indentation I would recommend you follow the same as the rule above and they do use spaces now to begin customizing this rule we'll start with the ID field custom rules should always start from 100,000 if you look above the rule ID is 100,000 And1 so I cannot use that instead I'm going to put this as 100,2 the level is the severity so the higher the level the higher the importance is and the highest level you can add is up to 15 so for fun let's just put it as 15 I'll change 4 to 15 for the field name we know that we want original file name So currently it is looking at parent image I'll remove this and type in original file name one thing to keep in mind is case sensitivity you want to make sure it matches exactly the field name so for example I have a capital F and N if I did not capitalize the F and then just put it as lowercase file name this alert will never trigger because there's no field name with that the field name that exists has a capital f for file so do keep that in mind when you're creating an alert case sensitivity matters as for the type the PC2 we'll leave it as is it is essentially Rex the bracket question mark I is set to ignore case sensitivity for the value not the field name but the field value so right now it is looking for C or W script .exe I'm just going to remove that and then type in mimicat that way it's searching specifically for mimic cats in the original file name right underneath it options no full log I am going to remove this because I want all the logs for the description it's right now it is scripting interpreter spawn I am going to change this to let's say mimik cats use message detected and for the miter ID I'm going to remove this and type in 03 because that is credential dumping which is what mimik cats is known to do and again just make sure the indentation is the same as the one above and it does use spaces so let's go ahead and save this out and then we can restart the manager once you save it it would automatically tell you to restart and there's a button for for you to do that so I will click on confirm that the manager will be restarted before we run mimik cats just to prove this point I'm going to change its file name and maybe name it as you are awesome exe or actually I'll remove the exe because that is already implied there and then I'll just name it as you are awesome now I'll open up my Powershell exit out mimik cats and actually before I even do all that let's just head over to Security events and double check just to make sure that there's no alert for mimik cats currently there's none so that's perfect so let's head over to our Powershell and now we will type in you are awesome. exe and then I'll hit enter back onto our was dashboard let's go and refresh this scroll all the way down and there you go perfect perfect we even used our renamed mimic cats and the alert still triggered because we are looking at the original file name instead if we were looking at the image the mimik cats executable have been renamed to you are awesome. exe so we were monitoring for an alert specifically for mimik cats as an image field value then our alert would not trigger that is why we should look at the original file name and right here it says Mim cats we did a lot in this video I showed you how to create an alert and how we can customize our Wasa configuration to ingest certain logs in this example we configured cismon to be ingested into Wasa if you are a student or a professional that wants to transition into cyber security I want you to know that I offer free mentorship on my site with no strings attached on there you will also see products that I've personally created in which you can download to help guide you along this journey these products include resume and cover letter templates bookmarks a one-year road map on how to get started in cyber security and a list of interview questions to help you in your next interview also as a sneak peek I am in the process of creating a sock course where there will be over 20 Hands-On labs and multiple projects that you can put onto your resume you can join the wait list if if you choose to do so my mission here is to help you get to where you want to be if you ever have a question about a certain field or what a certain function does I do encourage you to stop and research what that is and learn more about it now in the final episode we will begin performing some automation using Shuffle and the hive and that is it for the video and I hope you found it informative if you do happen to have any questions remember try and research it to find the answer if you can't find the answer leave it in the comment section down below I'll try my best to help you out remember to stay curious and do things differently