Testing Windows Defender and Wazuh with Atomic Red Team
Posted on September, 28 by Zehra Begum
Introduction
Building my first SIEM deployment hands-on cybersecurity journey with log aggregation, network visibility, and threat detection. I cover how I stood up and modified a baseline SIEM environment, and ran attack commands using Atomic Red Team (ART) to see how those activities surfaced in our logs.
Whoami
My name is a Zehra Begum, and i am field to specialize in network security and threat detection. This post represents my very first contribution to the cybersecurity community. I hope sharing my process, mistakes, and findings helps other aspiring analysts on a similar path.
Setup
I opened to establish the ‘observer’ Apache logs as a new log source in the SIEM.
To do so, I added the following to (/var/ossec/etc/ossec.conf) the ossec.conf file:
After updating the configuration file, i restarted the Wazuh to apply the changes and logs collection.
sudo systemctl restart wazuh-agent
Experiment time
Experiment #1 T1053.005:Scheduled Task
In the first experiment i tested the MITRE ATT&CK technique T1053.005 - Scheduled Task Running command Atomic tests on Ad01 verifies events trigger alert rules in Wazuh.
After running the command i checked wazuh's discover dashboard with the filter agent.name ad01 and see the modification was detected.
Experiment #2 T1027: Obfuscated Files or Information
Second experiment i opened up powerShell and ran Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force then i disabled Windows Defender so the test could run smoothly then i connected to computer name ad01 my work station using password i installed everything needed to run the test on that remote computer.
I ran the atomic test using Invoke-AtomicTest T1027 -Session $sess and waited for the tests to complete. when the test were completed then i ran Invoke-AtomicTest T1027 -cleanup -Session $sess to clean up and then i checked the Wazuh security logs to make sure every thing was recorded.
Conclusion
Running these experiments i confirmed that my SIEM deployment is successfully capturing and correlating important security events, highlighted the direct connection between endpoint configuration and SIEM visibility with proper log, critical attack vectors remain invisible.
Final thoughts
Coolest Thing Learned:
Seeing raw adversary actions executed via Atomic Red Team instantly transform into structured alerts and structured log fields inside the SIEM dashboard.
Don't panic when logs don't show up immediately. Systematically isolate the path from event creation.
Refrences
Wazuh Documentation
Atomic RED Team Work Station
MITRE ATT&CK Technique Reference
Top comments (0)