What Cant Go Wrong?

#tutorial #cybersecurity #beginners #networkmonitoring

Entering the Cybersecurity World

Honestly, as a cybersecurity analyst to be, I got to say there really is a lot to worry about in the grand scheme of things. I'm not letting my anxiety take over or anything, but there seems to be a lot of holes to cover, and when it comes to network vulnerabilities, you can't cover all of them. Learning new and more ways to protect a network just means there are more ways to break in. Great for me that I'm highly competitive and don't like to get beat at my own game. I'll admit I'm still new to this game, but I'll catch up quick enough. Learning to deploy a SIEM has been a skill of relief and has me ready to learn more and test my skills; making this post to share the experience and mistakes i learned throughout this project.

The last few months I've been working on understanding data and security in a way that would roll off the tongue when asked about. A decent amount of projects have been completed, but I honestly think this one can show the growth I developed over the last 6 months. The exploration in this project is great for the overall growth of an analyst's mind. You're able to push your boundaries and questions in a safe environment to make mistakes, and with mistakes comes understanding. The Wazuh SIEM itself is like a new app on your phone your ready to tinker with. Poking around seeing what's already there just to get familiar with the lay of the land

Running Amuck In the Land

To start out with my Wazuh environment, I first added more endpoints to the SIEM. I chose the play-server because it was the endpoint with the fewest mods to it. hoping i can leave an imprint on Wazuh i ran atomics or attempted to run on all endpoints on the system. running different TTPs i found interesting from the ART atomic station via hosting from which ever endpoint I choose. Set up player server to forward logs to the Wazuh SIEM. Installed sysmon on device to send queries to the Wazuh SIEM to monitor web security. This modification will forward logs from the play server to the blue team station where the SIEM is. Allowing for alerts to come through. After installing Sysmon on the play server, we are able to see the core behaviors of alerts from malicious content. After setting up the baseline for the environment, I was then ready to start with the experimentation.

Reconstructing the Landscape

Out of all the test i ran Access Token Manipulation(ATM) was probably the most successful. Tested ART atomic TTP for access token manipulation on Windows AD01. ATM is when an attacker gains access to someone token and impersonates as them to escalate privilege and bypass control. In order to execute this test first I started in the Art station told the station where to find the invoke commands and ran the hosting service. Since I want to complete this on the Ad01 endpoint i used the ip address and connected. checked for prerequisites for ATM, git hub shows you all the ways to execute this from say a home desktop but in the ART station everything's already installed. Ran the test, popped the shell and ran the cleanup command after. Now the real test, to see if Wazuh picked it up and it did. Event ID 10 and 13 show up in the Wazuh SIEM. Also if we go to the Ad01 station and pull up event folder sysmon events show up there as well.

Tested ART atomic TTP data destruction on the Linux system play-server. Data destruction was a TTP that stood out to me in earlier sprints, and I immediately thought about spy movies where you have to wipe the computer clean to make sure information doesn't leak. Though exciting, to think about this experiment was not a success. I couldn't get ART to host the play server even with the instructor's help; it wouldn't allow me to run atomic on the remote server. I tried manually, and it still didn't work. I ran an auditing tool (Lynis) on the Linux play server for security posture improvement. Because I couldn't run any atomics on the play server, I decided to still buff up the endpoint by installing an audit tool to backcheck everything. When I felt that wasn't enough, I added a basic firewall in the mix.

Ad01 experiment

failed atomic attempt on play-server
Out of the 3 experiments I ran, 2 were fully successful, and I believe I learned more from the one that failed than the 2 that were complete. I didn't notice the growth I developed behind the computer. It was fun to actually figure out what the solution to a problem is. trying to create files that don't need to be there or searching and creating commands to try and insert your solution. The experiments that were successful taught about consistency. The more I'm in the CLI, the better I am at navigating. The more tricks I learn, the better I get at speaking the language. Take your time; sometimes I can get real anxious and just want to be done, not saying it's not fun or I'm dreading it; it's just been some years since I accomplished anything, and patience is a virtue. I also feel like I waited too long to ask for help. I feel like we're supposed to just enumerate any problem we have. But if you do get stuck on the road, it's ok to ask for help. in this type of field when configuring or coding 1 little mess-up, a misspelled word, or a finger slip can affect a lot. Cross every T and dot every I. Take your time, and you'll be fine.