인프런 커뮤니티 질문&답변

안녕하세요 이번 실습부터 갑자기 wazuh 서버로 이벤트 로그를 잘 보내던 Windows 클라이언트로부터 더 이상 이벤트를 받지 못하고 있습니다. 도와주셨으면 합니다.

둘이 서로 네트워크 연결 문제 및 설정이 제대로 되어있는지 확인 및 에이전트 / 서비스 재시작을 다수 해봤으며, 에러로그는 아래와 virus total codec 문제인것을 볼 수 있었습니다.

지금 alerts.log는 virustotal 다른 사람들의 결과물에 비해 좀 부실하게 작성되어서 나와있길레 가져왔습니다. (해당 로그에서 시스템 무결성 체크나 netstat 명령을 가져오는건 잘 보입니다.)

또한, 강좌에서 나온것 처럼 sysmon 이벤트로그에서 calc, vss 관련로그도 정상적으로 등장하는것을 확인했습니다.

-wazuh server-

/var/ossec/logs/ossec.log
2024/01/25 03:07:15 wazuh-integratord: ERROR: Unable to run integration for virustotal -> integrations

2024/01/25 03:07:15 wazuh-integratord: ERROR: While running virustotal -> integrations. Output: UnicodeDecodeError: 'utf-8' codec can't decode byte 0xbb in position 1481: invalid start byte

var/ossec/logs/alerts/alerts.log

** Alert 1706119676.269841153: - virustotal,

2024 Jan 25 03:07:56 (DESKTOP-8KIVUDS) 윈도우IP->virustotal

Rule: 87103 (level 3) -> 'VirusTotal: Alert - No records in VirusTotal database'

{"virustotal": {"found": 0, "malicious": 0, "source": {"alert_id": "1706119670.269839011", "file": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-21-2409306197-2214590480-1851912469-1000", "md5": "a1d87ba945282fbbd3276dc1b9918a23", "sha1": "4b6965b3c854f07763683c778774221fecf263b4"}}, "integration": "virustotal"}

virustotal.found: 0

virustotal.malicious: 0

virustotal.source.alert_id: 1706119670.269839011

virustotal.source.file: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2409306197-2214590480-1851912469-1000

virustotal.source.md5: a1d87ba945282fbbd3276dc1b9918a23

virustotal.source.sha1: 4b6965b3c854f07763683c778774221fecf263b4

integration: virustotal

local_rules.xml 파일 설정 내용은 아래와 같습니다.

<!-- Sysmon Wazuh Rules version 1.0-->

<group name="local,syscheck,">

<!-- Rule for ZEROMINI_RANSOM_NOTE.txt -->

<rule id="100001" level="10">

<decoded_as>json</decoded_as>

<field name="syscheck.path">C:\\Users\\User\\Desktop\\ransom_test\\ZEROMINI_RANSOM_NOTE.txt</field>

<description>ZEROMINI_RANSOM_NOTE.txt file detected.</description>

</rule>

<!-- Rule for .koyange extension -->

<rule id="100002" level="10">

<decoded_as>json</decoded_as>

<field name="syscheck.path">\.koyange$</field>

<description>File with .koyange extension detected.</description>

</rule>

</group>

<group name="sysmon,sysmon_process-anomalies,">

<rule id="300001" level="13">

<if_group>sysmon_event1</if_group>

<field name="win.eventdata.Image">calc.exe</field>

<description>Calc process started (possible ransomware simulation)</description>

</rule>

<rule id="300002" level="13">

<if_group>sysmon_event1</if_group>

<field name="win.eventdata.CommandLine">vssadmin delete shadows</field>

<description>Shadow copy deletion command detected (possible ransomware simulation)</description>

</rule>

<rule id="300003" level="13">

<if_group>sysmon_event1</if_group>

<field name="win.eventdata.TargetFilename">ZEROMINI_RANSOM_NOTE.txt</field>

<description>Ransom note detected (possible ransomware activity)</description>

</rule>

<rule id="300004" level="13">

<if_group>sysmon_event1</if_group>

<field name="win.eventdata.parentImage">python.exe</field>

<description>File with python extension detected (possible ransomware activity)</description>

</rule>

<rule id="300005" level="13">

<if_group>sysmon_event1</if_group>

<field name="win.eventdata.CommandLine">ping 8.8.8.8</field>

<description>Ping to 8.8.8.8 detected (possible network test or exfiltration attempt)</description>

</rule>

</group>