Custom active response scripts

Method 1: Convert the Python script to an executable application

1. Open an administrator PowerShell terminal and use pip to install pyinstaller:

   > pip install pyinstaller
   > pyinstaller --version
   

2. Run the following command using PowerShell with administrator privileges to create the executable file:

   > pyinstaller -F <PATH_TO_CUSTOM-AR.PY>
   

   You can find the created custom-ar.exe executable in the C:\Users\<USER>\dist\ directory.

3. Copy the custom-ar.exe executable file to C:\Program Files (x86)\ossec-agent\active-response\bin\ directory on the monitored endpoint.

4. Restart the ThreatLockDown agent using PowerShell with administrator privileges to apply the changes:

   > Restart-Service -Name wazuh
   

5. On the ThreatLockDown server, add the <command> and <active-response> blocks below to the /var/ossec/etc/ossec.conf configuration file. This uses the custom-ar.exe executable for Windows endpoints.

   <ossec_config>
     <command>
       <name>windows-custom-ar</name>
       <executable>custom-ar.exe</executable>
       <timeout_allowed>yes</timeout_allowed>
     </command>
   
     <active-response>
       <disabled>no</disabled>
       <command>windows-custom-ar</command>
       <location>local</location>
       <rules_id>503</rules_id>
       <timeout>60</timeout>
     </active-response>
   </ossec_config>
   

6. Restart the ThreatLockDown manager to apply the changes:

   # systemctl restart wazuh-manager
   

With this configuration, ThreatLockDown runs an executable instead of a Python script when triggering an active response on a Windows endpoint.

Method 2: Run a Python script through a Batch launcher

In this method, the ThreatLockDown active response module executes the launcher.cmd script which subsequently executes the custom-ar.py script.

1. Create a launcher.cmd file in C:\Program Files (x86)\ossec-agent\active-response\bin\ with the following content. This allows you to run any Windows script through the launcher.cmd script when triggering an active response.

   @echo off
   
   setlocal enableDelayedExpansion
   
   set ARPATH="%programfiles(x86)%\ossec-agent\active-response\bin\\"
   
   if "%~1" equ "" (
       call :read
   
       set aux=!input:*"extra_args":[=!
       for /f "tokens=1 delims=]" %%a in ("!aux!") do (
           set aux=%%a
       )
       set script=!aux:~1,-1!
   
       if exist "!ARPATH!!script!" (
           set aux=!input:*"command":=!
           for /f "tokens=1 delims=," %%a in ("!aux!") do (
               set aux=%%a
           )
           set command=!aux:~1,-1!
   
           echo !input! >alert.txt
   
           start /b cmd /c "%~f0" child !script! !command!
   
           if "!command!" equ "add" (
               call :wait keys.txt
               echo(!output!
               del keys.txt
   
               call :read
               echo !input! >result.txt
           )
       )
       exit /b
   )
   
   set "name=%~1"
   goto !name!
   
   
   :child
   copy nul pipe1.txt >nul
   copy nul pipe2.txt >nul
   
   "%~f0" launcher %~3 <pipe1.txt >pipe2.txt | <PYTHON_ABSOLUTE_PATH> !ARPATH!%~2 <pipe2.txt >pipe1.txt
   
   del pipe1.txt pipe2.txt
   exit /b
   
   
   :launcher
   call :wait alert.txt
   echo(!output!
   del alert.txt
   
   if "%~2" equ "add" (
       call :read
       echo !input! >keys.txt
   
       call :wait result.txt
       echo(!output!
       del result.txt
   )
   exit /b
   
   
   :read
   set input=
   for /f "delims=" %%a in ('<PYTHON_ABSOLUTE_PATH> -c "import sys; print(sys.stdin.readline())"') do (
       set input=%%a
   )
   exit /b
   
   
   :wait
   if exist "%*" (
       for /f "delims=" %%a in (%*) do (
           set output=%%a
       )
   ) else (
       goto :wait
   )
   exit /b
   

   Where <PYTHON_ABSOLUTE_PATH> is the absolute path of the Python.exe executable.

2. Move the custom-ar.py script to C:\Program Files (x86)\ossec-agent\active-response\bin\ directory.

3. Restart the ThreatLockDown agent using PowerShell with administrator privileges to apply the changes:

   > Restart-Service -Name wazuh
   

4. On the ThreatLockDown server, add the <command> and <active-response> blocks below to the ThreatLockDown configuration /var/ossec/etc/ossec.conf file. The active response module runs the launcher.cmd script which runs the Python script in its <extra_args> option. This action executes for 60 seconds when rule ID 503 is triggered.

   <ossec_config>
     <command>
       <name>custom-ar</name>
       <executable>launcher.cmd</executable>
       <extra_args>custom-ar.py</extra_args>
       <timeout_allowed>yes</timeout_allowed>
     </command>
   
     <active-response>
       <disabled>no</disabled>
       <command>custom-ar</command>
       <location>local</location>
       <rules_id>503</rules_id>
       <timeout>60</timeout>
     </active-response>
   </ossec_config>
   

5. Restart the ThreatLockDown manager to apply the changes:

   # systemctl restart wazuh-manager