Advanced settings

How it works

The who-data monitoring functionality uses the Linux Audit subsystem to get information about who makes the changes in a monitored directory. These changes produce audit events. The FIM module processes the audit events and reports them to the ThreatLockDown server. This functionality expands on the realtime attribute replacing it. This means that whodata is real-time monitoring with the who-data information added.

Configuration

You need to install the audit daemon if you don’t have it already installed on your endpoint.

# yum install audit

# yum install audispd-plugins
# systemctl restart auditd

# apt-get install auditd

# apt-get install audispd-plugins
# systemctl restart auditd

# apk add audit=3.1.1-r0
# rc-update add auditd default
# cp /usr/sbin/audisp-af_unix /sbin/audisp-af_unix
# rc-service auditd restart

Perform the following steps to enable who-data monitoring. In this example, you configure who-data monitoring for /etc directory.

1. Edit the ThreatLockDown agent /var/ossec/etc/ossec.conf configuration file and add the configuration below:

   <syscheck>
      <directories check_all="yes" whodata="yes">/etc</directories>
   </syscheck>
   

2. Once you add this configuration, restart the ThreatLockDown agent to apply the changes. This will add an audit rule for the monitored directory:

   # systemctl restart wazuh-agent
   

3. Execute the following command to check if the audit rule for monitoring the selected directory is applied:

   # auditctl -l | grep wazuh_fim
   

   From the output, you can see the rule was added:

   auditctl -w /etc -p wa -k wazuh_fim
   

   Note

   When the ThreatLockDown agent service stops, it removes the rule. You can use the same command to check that it removed the rule successfully.

Alert fields

The following table establishes a correspondence between audit fields and their equivalent fields in an alert when who-data is enabled.

Audit field	Alert field	Fields description
User	audit.user.id audit.user.name	Contain information about who started the process that modified the monitored file.
Login user	audit.login_user.id audit.login_user.name	Contain information about the user who started the session. They correspond respectively to the login UID and login name. Upon login, this ID is assigned to a user and is inherited by every process, even when the user's identity changes.
Effective user	audit.effective_user.id audit.effective_user.name	Contain the effective ID and name of the user who started the process that modified the monitored file. When a user executes a command using sudo, the effective user ID changes to 0 and the effective user name becomes root.
Group	audit.group.id audit.group.name	Contain the group ID and group name of the user who started the process that modified the monitored file.
Process ID	audit.process.id	Contains the ID of the process used to modify the monitored file.
Process name	audit.process.name	Contains the name of the process used to modify the monitored file.
Process ppid	audit.process.ppid	Contains the parent process ID of the process used to modify the monitored file.

Test the configuration

1. Create the user smith on a Linux endpoint:

   # useradd smith
   

2. Log out of the Linux endpoint and log in as smith.

3. Add a new IP address, such as 192.168.32.5 in /etc/hosts.allow file on the Linux endpoint.

   # nano /etc/hosts.allow
   

Visualize the alert

Navigate to File Integrity Monitoring on the ThreatLockDown dashboard to view the alert generated when the FIM module detects changes in the monitored file.

Expand the alert to view more information. In the alert fields below, you can see the user smith added a new IP address to the /etc/hosts.allow file using the nano text editor with root privileges.

Alert in JSON:

{
  "syscheck": {
    "size_before": "411",
    "uname_after": "root",
    "mtime_after": "2023-02-06T18:21:50",
    "size_after": "423",
    "gid_after": "0",
    "md5_before": "d0cfb796d371b0182cd39d589b1c1ce3",
    "diff": "10c10\n< \n---\n> 192.168.32.5\n",
    "sha256_before": "9eadbcd7ec16f4e5961ad2035c0228de7c22b2ba0f6761df63b1b3d9bad9d0a7",
    "mtime_before": "2023-02-06T18:21:33",
    "mode": "whodata",
    "path": "/etc/hosts.allow",
    "sha1_after": "a488ebb6fb615aa58c3cbf2363fd50e6f12b1990",
    "changed_attributes": [
      "size",
      "mtime",
      "md5",
      "sha1",
      "sha256"
    ],
    "gname_after": "root",
    "audit": {
      "process": {
        "parent_name": "/usr/bin/bash",
        "cwd": "/home/smith",
        "parent_cwd": "/home/smith",
        "name": "/usr/bin/nano",
        "id": "18451",
        "ppid": "13824"
      },
      "login_user": {
        "name": "smith",
        "id": "1001"
      },
      "effective_user": {
        "name": "root",
        "id": "0"
      },
      "user": {
        "name": "root",
        "id": "0"
      },
      "group": {
        "name": "root",
        "id": "0"
      }
    },
    "uid_after": "0",
    "perm_after": "rw-r--r--",
    "event": "modified",
    "md5_after": "56bf94e8c0b0ff9c5efb258d85d68bba",
    "sha1_before": "2964c8d9f69c7261de20877392bc7393d471f4ed",
    "sha256_after": "be0f64dc44ddc87f6ba4922e124078071cd65d27d9e25f988d5c9b4c8fa60ca0",
    "inode_after": 263955
  },
  "agent": {
    "ip": "192.168.33.157",
    "name": "Ubuntu20.04",
    "id": "014"
  },
  "manager": {
    "name": "wazuh"
  },
  "rule": {
    "mail": false,
    "level": 7,
    "description": "Integrity checksum changed.",
    "groups": [
      "ossec",
      "syscheck",
      "syscheck_entry_modified",
      "syscheck_file"
    ],
    "nist_800_53": [
      "SI.7"
    ],
    "gdpr": [
      "II_5.1.f"
    ],
    "firedtimes": 171,
    "mitre": {
      "technique": [
        "Stored Data Manipulation"
      ],
      "id": [
        "T1565.001"
      ],
      "tactic": [
        "Impact"
      ]
    },
    "id": "550",
    "gpg13": [
      "4.11"
    ]
  },
  "decoder": {
    "name": "syscheck_integrity_changed"
  },
  "full_log": "File '/etc/hosts.allow' modified\nMode: whodata\nChanged attributes: size,mtime,md5,sha1,sha256\nSize changed from '411' to '423'\nOld modification time was: '1675696893', now it is '1675696910'\nOld md5sum was: 'd0cfb796d371b0182cd39d589b1c1ce3'\nNew md5sum is : '56bf94e8c0b0ff9c5efb258d85d68bba'\nOld sha1sum was: '2964c8d9f69c7261de20877392bc7393d471f4ed'\nNew sha1sum is : 'a488ebb6fb615aa58c3cbf2363fd50e6f12b1990'\nOld sha256sum was: '9eadbcd7ec16f4e5961ad2035c0228de7c22b2ba0f6761df63b1b3d9bad9d0a7'\nNew sha256sum is : 'be0f64dc44ddc87f6ba4922e124078071cd65d27d9e25f988d5c9b4c8fa60ca0'\n",
}

How it works

The who-data monitoring functionality uses the Microsoft Windows auditing subsystem. It gets the related information about who makes modifications in a monitored directory. These changes produce audit events. The FIM module processes these events and reports them to the ThreatLockDown server. This feature is only compatible with Windows operating systems later than Windows Vista.

Configuration

To enable the who-data feature, you must declare the tag whodata="yes" within the directories block in the C:\Program Files (x86)\ossec-agent\ossec.conf configuration file. You need to properly configure the Local Audit Policies and the System Access Control List (SACLs) of each monitored directory. ThreatLockDown automatically performs these configurations for the directory to monitor.

...
<syscheck>
  ...
  <directories check_all="yes" whodata="yes">C:\test</directories>
  ...
</syscheck>
...

The FIM module configures the required Local Audit Policies and SACLs when launched. However, other services might change this configuration which would prevent who-data from receiving the monitored events. To overcome this, FIM detects this configuration change and switches all the directories monitoring with who-data to real-time mode. The two available mechanisms to detect these configuration changes are:

1. ThreatLockDown monitors specific events (ID 4719) that Windows generates when one of the Audit Policies is modified (Success removed).

2. Periodically, ThreatLockDown checks that the Audit Policies and the SACLs are configured as expected. You can modify the frequency of this verification with windows_audit_interval.

If your Windows OS version is later than Windows Vista but the system didn’t automatically configure the audit policies, see the Manual configuration of the Windows Audit Policies guide.

The following table establishes a correspondence between audit fields and their equivalent fields in an alert when who-data is enabled:

Audit field	Alert field	Fields description
User	audit.user.id audit.user.name	Contain the ID and name of the user who started the process that modified the monitored file.
Process id	audit.process.id	Contain the ID of the process used to modify the monitored file.
Process name	audit.process.name	Contain the name of the process used to modify the monitored file.

Test the configuration

1. Create a text file audit_docu.txt in the Documents folder using Notepad.

2. Add the text “Hello” and save the changes.

Visualize the alert

Navigate to File Integrity Monitoring on the ThreatLockDown dashboard and find the alert generated when the FIM module detects changes in the monitored directory.

Expand the alert with rule.id:550 to view all the information. In the alert fields below, you can see the user wazuh added the word “Hello” to the audit_docu.txt file using the Notepad text editor.

Alert in JSON:

{
  "_index": "wazuh-alerts-4.x-2023.04.18",
  "_id": "ZcS6lIcB57JzuUZxyH13",
  "_version": 1,
  "_score": null,
  "_source": {
    "syscheck": {
      "size_before": "0",
      "uname_after": "wazuh",
      "mtime_after": "2023-04-18T17:17:58",
      "size_after": "5",
      "md5_before": "d41d8cd98f00b204e9800998ecf8427e",
      "diff": "---\n> Hello\n",
      "win_perm_after": [
        {
          "allowed": [
            "DELETE",
            "READ_CONTROL",
            "WRITE_DAC",
            "WRITE_OWNER",
            "SYNCHRONIZE",
            "READ_DATA",
            "WRITE_DATA",
            "APPEND_DATA",
            "READ_EA",
            "WRITE_EA",
            "EXECUTE",
            "READ_ATTRIBUTES",
            "WRITE_ATTRIBUTES"
          ],
          "name": "SYSTEM"
        },
        {
          "allowed": [
            "DELETE",
            "READ_CONTROL",
            "WRITE_DAC",
            "WRITE_OWNER",
            "SYNCHRONIZE",
            "READ_DATA",
            "WRITE_DATA",
            "APPEND_DATA",
            "READ_EA",
            "WRITE_EA",
            "EXECUTE",
            "READ_ATTRIBUTES",
            "WRITE_ATTRIBUTES"
          ],
          "name": "Administrators"
        },
        {
          "allowed": [
            "DELETE",
            "READ_CONTROL",
            "WRITE_DAC",
            "WRITE_OWNER",
            "SYNCHRONIZE",
            "READ_DATA",
            "WRITE_DATA",
            "APPEND_DATA",
            "READ_EA",
            "WRITE_EA",
            "EXECUTE",
            "READ_ATTRIBUTES",
            "WRITE_ATTRIBUTES"
          ],
          "name": "wazuh"
        }
      ],
      "sha256_before": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "mtime_before": "2023-04-18T17:17:54",
      "mode": "whodata",
      "path": "c:\\users\\wazuh\\documents\\audit_docu.txt",
      "sha1_after": "f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0",
      "changed_attributes": [
        "size",
        "mtime",
        "md5",
        "sha1",
        "sha256"
      ],
      "audit": {
        "process": {
          "name": "C:\\Windows\\System32\\notepad.exe",
          "id": "5672"
        },
        "user": {
          "name": "wazuh",
          "id": "S-1-5-21-1189703717-396825564-3703043190-1000"
        }
      },
      "attrs_after": [
        "ARCHIVE"
      ],
      "uid_after": "S-1-5-21-1189703717-396825564-3703043190-1000",
      "event": "modified",
      "md5_after": "8b1a9953c4611296a827abf8c47804d7",
      "sha1_before": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
      "sha256_after": "185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969"
    },
    "input": {
      "type": "log"
    },
    "agent": {
      "ip": "192.168.33.132",
      "name": "Windows10",
      "id": "021"
    },
    "manager": {
      "name": "wazuh"
    },
    "rule": {
      "mail": false,
      "level": 7,
      "pci_dss": [
        "11.5"
      ],
      "hipaa": [
        "164.312.c.1",
        "164.312.c.2"
      ],
      "tsc": [
        "PI1.4",
        "PI1.5",
        "CC6.1",
        "CC6.8",
        "CC7.2",
        "CC7.3"
      ],
      "description": "Integrity checksum changed.",
      "groups": [
        "ossec",
        "syscheck",
        "syscheck_entry_modified",
        "syscheck_file"
      ],
      "nist_800_53": [
        "SI.7"
      ],
      "gdpr": [
        "II_5.1.f"
      ],
      "firedtimes": 2,
      "mitre": {
        "technique": [
          "Stored Data Manipulation"
        ],
        "id": [
          "T1565.001"
        ],
        "tactic": [
          "Impact"
        ]
      },
      "id": "550",
      "gpg13": [
        "4.11"
      ]
    },
    "location": "syscheck",
    "decoder": {
      "name": "syscheck_integrity_changed"
    },
    "id": "1681827479.1689265",
    "full_log": "File 'c:\\users\\wazuh\\documents\\audit_docu.txt' modified\nMode: whodata\nChanged attributes: size,mtime,md5,sha1,sha256\nSize changed from '0' to '5'\nOld modification time was: '1681827474', now it is '1681827478'\nOld md5sum was: 'd41d8cd98f00b204e9800998ecf8427e'\nNew md5sum is : '8b1a9953c4611296a827abf8c47804d7'\nOld sha1sum was: 'da39a3ee5e6b4b0d3255bfef95601890afd80709'\nNew sha1sum is : 'f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0'\nOld sha256sum was: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'\nNew sha256sum is : '185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969'\n",
    "timestamp": "2023-04-18T17:17:59.498+0300"
  },
  "fields": {
    "syscheck.mtime_after": [
      "2023-04-18T17:17:58.000Z"
    ],
    "syscheck.mtime_before": [
      "2023-04-18T17:17:54.000Z"
    ],
    "timestamp": [
      "2023-04-18T14:17:59.498Z"
    ]
  },
}

Local Audit Policies in Windows

To manually configure the audit policies needed to run FIM in who-data mode, you need to activate the logging of successful events.

On the Run dialog box (win + R), open the Local Group Policy Editor using the following command:

gpedit.msc

Configure the Audit Events field to Success for the following policies:

• Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access > Audit File System

• Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access > Audit Handle Manipulation

If your system doesn't allow configuring subcategories through Advanced Audit Policy Configuration, configure the Security Setting field to Success for the following policy:

• Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy > Audit object access

System Access Control List (SACL) in Windows

A system access control list (SACL) enables administrators to log attempts to access a secured object. You can check and modify SACLs of each monitored directory through Properties, selecting the Security tab, and clicking on Advanced:

It's necessary to have a Success entry in the Auditing tab:

If there is no Success entry, click on Add, to create it with these advanced permissions: