introduction to whids an
play

Introduction to WHIDS, an Open Source Endpoint Detection System for - PowerPoint PPT Presentation

Dec 08, 2023 •374 likes •607 views

Introduction to WHIDS, an Open Source Endpoint Detection System for Windows Github / Twitter: 0xrawsec Project: https://github.com/0xrawsec/whids Outline 1. Introduction to WHIDS 2. Writing rules: Gene Hands On 3. WHIDS Possible Deployments

  1. Introduction to WHIDS, an Open Source Endpoint Detection System for Windows Github / Twitter: 0xrawsec Project: https://github.com/0xrawsec/whids

  2. Outline 1. Introduction to WHIDS 2. Writing rules: Gene Hands On 3. WHIDS Possible Deployments 4. Installation and feature exploration 5. Case Study: choose a case study and write your own detection rule(s) 24 October 2019 Hack.lu Workshop 2019 2

  3. Introduction 24 October 2019 Hack.lu Workshop 2019 3

  4. ?I ma ohw Freelance Security Consultant working in Luxembourg, running for my own company › Originally doing Incident Response, digital forensics, malware oriented digital forensics … › I start to accumulate a lot of knowledge (relatively to what is available online) about Sysmon › Also Open-Source developer (in my free time) mainly Go, C, Python. At the origin of several projects: - Golang-evtx - Golang-misp - Gene - WHIDS Doing other stuffs as well: software RE, bug hunting ... 24 October 2019 Hack.lu Workshop 2019 4

  5. What ? Stands for: Windows Host IDS (even though it is more than just an IDS) To be more accurate, it combines IDS features with detection based Incident Response Capabilities. WHIDS strongly relies on the existence of Microsoft Sysmon since most of its nice features are built on to of Sysmon events Features: › Correlate Windows Event on host › Detect in real time suspicious events (raw/correlated) based on user defined rules › React to the detection: - Dump files - Dump process - Dump registry › Can send all the information collected to a central point (a.k.a manager ) 24 October 2019 Hack.lu Workshop 2019 5

  6. Why ? I want people who cannot afford expansive solutions (EDR, SIEM …) to have something: › They can craft detection rules specific to their environment Spoiler Alert: vendors often sell generic products, in the end not customizable as you would like it to be. May be it can be customized … but you will have to pay ☺ › That scales › Which can also be plugged in with the other open source tools they are using I also want to save time to analysts and allow them to have the data collected in real time 24 October 2019 Hack.lu Workshop 2019 6

  7. How WHIDS Engine Works Hook: a function that takes a Windows Event as input and process it either to enrich it or to take information from it to enrich future events NB : you can listen on absolutely any Windows Event Log channel you want and create detection rules for those 24 October 2019 Hack.lu Workshop 2019 7

  8. Few Words about Gene Gene is the detection engine of WHIDS so I need to explain you what it is. Gene is at the origin of everything… › What : an engine and a rule format designed to detect patterns in Windows Event Logs. It was developed prior to WHIDS for Incident Response purposes. › Why : any Windows Event can be considered as an IOC so it make sense to have a tool / rule format, to catch them You can see it as a Yara engine but to match against Windows Event Logs https://github.com/0xrawsec/gene 24 October 2019 Hack.lu Workshop 2019 8

  9. Writing Rules: Gene Hands On Exercises 1.X 24 October 2019 Hack.lu Workshop 2019 9

  10. Methodology 1. Identify a possible entry point event to look at • A process created 2. Follow the track of events from the entry point and look for suspicious (requires Sysmon and a bit of OS knowledge) i. At this point it might happen you did not find anything of interest ii. Dig a bit around the time of the entry point event - Look at process created, files created … iii. Go back to step 1 taking the new event(s) you found as entry point(s) 3. Create rule(s) for the suspicious event(s) you have found 4. Verify your rules against a bunch of known good events (a reference WHIDS trace recorded from a clean system) 5. If previous steps reported some events, it means you have to refine your rule in order to avoid false positives 24 October 2019 Hack.lu Workshop 2019 10

  11. The toolset Sorry for you guys, I am not using any GUI for that • Use sysmon-search.py to filter in/out some events. You can find it in the exercises folder • Use jq for visualization and advanced filtering • A text editor (this one may have a GUI actually) to write the rules • Gene executable to verify the rules 24 October 2019 Hack.lu Workshop 2019 11

  12. WHIDS Possible Deployments 24 October 2019 Hack.lu Workshop 2019 12

  13. Standalone Deployment • Installation of WHIDS on each endpoint • Log collection done directly on the endpoint Pro: • Solution for a single machine Cons: • Difficult to manage several machines • Don’t benefit of manager centralization 24 October 2019 Hack.lu Workshop 2019 13

  14. Centralized Management • WHIDS is installed on every endpoint • All entities are managed centrally Pros: • Single point to update rules / containers • Single point to collect logs from • Maximizes amount of logs which can be analyzed Cons: • Rules / containers are pushed on endpoints 24 October 2019 Hack.lu Workshop 2019 14

  15. WEC Deployment • Endpoints use Windows protocol to send logs to WEC(s) • WHIDS is installed on WEC(s) • If only one WEC can run without manager Pros: • Rules / containers not on endpoints • Non invasive deployment Cons: • Cannot benefit from the same correlations as it is on endpoint • Cannot benefit from artifact collection features (I have an idea for a workaround though ☺ ) 24 October 2019 Hack.lu Workshop 2019 15

  16. Installation and Feature Exploration 24 October 2019 Hack.lu Workshop 2019 16

  17. Manager Installation We are going to cheat, instead of installing the manager on a remote machine, we will install it on the local machine but under WSL (Windows Subsystem for Linux) so simulate a Linux server. Manager Installation: • Generate TLS certificate and key for server • Modify the configuration file to make it listen on 127.0.0.1 • Add rules / containers you’d like to be pushed on the endpoint • Start the manager and let it run NB: the manager needs to be rebooted in case of rule / container updates 24 October 2019 Hack.lu Workshop 2019 17

  18. WHIDS Installation We are going to install it with a central manager (no WEC). Endpoint installation steps: 1. Install Sysmon 2. Install WHIDS with the help of manage.bat - Do not import rules shipped with project (we are going to pull them from the manager) - Do not start the services, we are going to configure stuff first 3. Edit configuration file to configure connection to the manager we have just set up - Do not forget to set unsafe to true under manager-client config (we have auto generated a TLS cert) - Do not forget to set local to false under forwarder config 4. Start the services and check if you see connections in your manager’s logs 24 October 2019 Hack.lu Workshop 2019 18

  19. Feature Exploration • Explore dumping capabilities • File dumping • Process memory dumping • Registry dumping • Alert forwarding capabilities: alerts are regularly forwarded to the manager • On host log correlation • MITRE ATT&CK integration • Offline mode: even though configured with a manager the logs and dumps are never lost in case connection is lost. • MISP IOC checks (left as homework) 24 October 2019 Hack.lu Workshop 2019 19

  20. Case Study Exercise 2.X or whatever technique / malware you want to assess the tool with 24 October 2019 Hack.lu Workshop 2019 20

  21. Thank you 24 October 2019 Hack.lu Workshop 2019 21

Recommend

INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION

INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION

TRAINING COURSE ON SOCIAL PROTECTION & FORMALIZATION TRINIDAD AND TOBAGO MARCH 15, 2017 INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION Design of the NIS Assistance from the

547 views • 23 slides
INTRODUCTION Introduction 2/42 INTRODUCTION Alternations I am giving bread to the

INTRODUCTION Introduction 2/42 INTRODUCTION Alternations I am giving bread to the

Patterns of variation in the expression of case and agreement Andrs Brny Leiden University Centre for Linguistics 9 November 2019, BaSIS Workshop a.barany@hum.leidenuniv.nl INTRODUCTION Introduction 2/42 INTRODUCTION

1.37k views • 42 slides
Introduction Introduction Introduction Introduction Outline Motivation Failures

Introduction Introduction Introduction Introduction Outline Motivation Failures

Introduction Introduction Introduction Introduction Outline Motivation Failures Definition and concepts Process and product properties Principles SE Approaches Motivation Software and the economy The economies of

1.03k views • 49 slides
Introduction Introduction Introduction Nationwide Cause for Concern 1

Introduction Introduction Introduction Nationwide Cause for Concern 1

Introduction Introduction Introduction Nationwide Cause for Concern 1 https://www.cdc.gov/std/stats17/infographic.htm Introduction Epidemiology in Western Colorado CPHE Surveillance Data Report, May 2018 Chlamydia Epidemiology in Western

977 views • 39 slides
DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every

DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every

DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every meeting (2) Some ideas of diagrams for section 7.1 (Introduction) of TP. Giles Barr 25 Jan 2018, Pembroke College On DUNE, the reality is there is a

474 views • 10 slides
INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT

INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT

ADVANCED COMPUTER SECURITY INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT IS SECURITY? A systems security policies describe What the system is supposed to do Store and provide access

479 views • 16 slides
Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL

Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL

Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL Writing a SMIL file Adding Media Objects Martin Halvey Clipping media files January 2008 Timing and Synchronising Layout World Wide

387 views • 14 slides
14 Introduction Introduction Bad guys can put malware into Example: hosts

14 Introduction Introduction Bad guys can put malware into Example: hosts

Introduction Introduction source Encapsulation ISO/OSI reference model message M application segment H t H t M transport network datagram H n H n H t M presentation: allow applications to frame link H l H n H t M interpret

583 views • 4 slides
Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL

Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL

Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL Writing a SMIL file Adding Media Objects Martin Halvey Clipping media files January 2008 Timing and Synchronising Layout

322 views • 8 slides
Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL

Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL

Introduction Zynq Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL Processing System Processor Peripherals Data Buses AXI Bus Conclusion BTE5380 - Embedded Systems Octobre 2014 Andreas Habegger

1.81k views • 30 slides
2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04

2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04

2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04 Project References S E 5 PART.1 SMILE5 Introduction M I L Introduction STORION-SMILE5 Residential Energy Storage System Inverter 5kW Output Input

1.06k views • 25 slides
Introduction to CICS Course introduction Course introduction What is CICS? What is an

Introduction to CICS Course introduction Course introduction What is CICS? What is an

Introduction to CICS Course introduction Course introduction What is CICS? What is an application server? Why use an application server? Course introduction Services provided by CICS How CICS applications are defined Scaling CICS to meet

1.84k views • 146 slides
Network Visualization Introduction Presented by Shahed Introduction Introduction Basic

Network Visualization Introduction Presented by Shahed Introduction Introduction Basic

Network Visualization Introduction Presented by Shahed Introduction Introduction Basic building blocks Node Links (relationship between nodes) Spatial information Network data

584 views • 9 slides
Introduction Introduction (1) Main argument of the paper: universities are not only

Introduction Introduction (1) Main argument of the paper: universities are not only

Le jugement des pairs comme outil de management des universits Peer-review as a management tool Christine Musselin (CSO, Sciences Po et CNRS) Avril 2013, Lirrsistible ascension du capitalisme acadmique Introduction Introduction (1)

590 views • 28 slides
Introduction Introduction to storage and to storage and filesystems filesystems Introduction

Introduction Introduction to storage and to storage and filesystems filesystems Introduction

Moreno Baricevic Gilberto Daz Axel Kohlmeyer Stefano Cozzini ULA ICTP CNR-IOM DEMOCRITOS Merida, VENEZUELA Trieste, ITALY Trieste, ITALY Introduction Introduction to storage and to storage and filesystems filesystems Introduction

1.19k views • 51 slides
JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of

JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of

JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of the brand new JA-100 alarm system Visions Basic architecture System components Setting Help us with final validations You are the FIRST ones

1.69k views • 111 slides
1 Introduction Introduction Communication System Baseband an adjective that describes

1 Introduction Introduction Communication System Baseband an adjective that describes

Introduction Introduction Physical Layer Mobile network Global ISP Provides the means to transmit bits Basic Concepts of from sender to receiver, Data Transmission Defines the mechanical, electrical, and Home network timing

463 views • 7 slides
Welcome! Todays Agenda: Topic Introduction Course Introduction Team Practical

Welcome! Todays Agenda: Topic Introduction Course Introduction Team Practical

INFOGR Computer Graphics Jacco Bikker - April-July 2015 - Lecture 1: Introduction Welcome! Todays Agenda: Topic Introduction Course Introduction Team Practical Details Assignments Field Study State of

869 views • 62 slides
Introduction (00) RNDr. Martin Madaras, PhD. madaras@skeletex.xyz Introduction Introduction

Introduction (00) RNDr. Martin Madaras, PhD. madaras@skeletex.xyz Introduction Introduction

Virtual and Augmented Reality Introduction (00) RNDr. Martin Madaras, PhD. madaras@skeletex.xyz Introduction Introduction Who am I? What do I do here? 2 About me Short research bio: - 2014 - finished PhD at FMFI UK - 2014 2016 -

1.3k views • 39 slides
PRESENTATION The Introduction What is the Introduction ? The introduction prepares the audience

PRESENTATION The Introduction What is the Introduction ? The introduction prepares the audience

PRESENTATION The Introduction What is the Introduction ? The introduction prepares the audience for your presentation. It tells them what your presentation is about, why it is important, and finally, what to listen for in your speech. Get the

505 views • 3 slides
How to make a presentation with L A T EX? Introduction to L A T EX Introduction to Beamer

How to make a presentation with L A T EX? Introduction to L A T EX Introduction to Beamer

Introduction to Beamer Hafida Benhidour How to make a presentation with L A T EX? Introduction to L A T EX Introduction to Beamer Introduction to Beamer Hafida Benhidour Department of computer science King Saud University November

732 views • 49 slides
Shenzhen Cuilu jewelry Co., Ltd was founded in 1996 and its a large private enterprise

Shenzhen Cuilu jewelry Co., Ltd was founded in 1996 and its a large private enterprise

Introduction Introduction - - Brief Brief Introduction Introduction of of Cuilu Cuilu Group Group Introduction Introduction - - Brief Brief Introduction Introduction of of Cuilu Cuilu Group Group Shenzhen Cuilu jewelry Co., Ltd

147 views • 14 slides
Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org

Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org

V olunteer C ommunications N etwork (V-C-N.org) Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org Academy Course - 2012-02.24-2208 262: Introduction to ICS-214 : V-C-N.org : Slide: 1 V olunteer C

735 views • 34 slides
Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org

Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org

V olunteer C ommunications N etwork (V-C-N.org) Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org Academy Course - 2012-02.24-2208 262: Introduction to ICS-214 : V-C-N.org : Slide: 1 V olunteer C

558 views • 18 slides

More recommend