Request for Guidance on Wazuh Attack Detection and Alerting
Narasimha Naidu B
Hi Team,
We are evaluating Wazuh for monitoring laptops and network endpoints. Our main requirement is to receive alerts whenever suspicious or potentially malicious activity is detected.
Could you please advise us on the recommended Wazuh configuration and rules for detecting and alerting on the following activities?
| Attack / Activity | Detection Requirement |
|---|---|
| SSH brute-force attack | Detect multiple failed SSH login attempts and generate an alert |
| RDP brute-force attack | Detect repeated failed RDP authentication attempts |
| Windows failed logins | Monitor Windows Security Event logs and alert on suspicious authentication failures |
| Multiple failed login attempts | Correlate repeated authentication failures from the same source |
| Privilege escalation | Detect suspicious privilege escalation activities |
| Malware | Detect malware or other malicious activity on endpoints |
| Suspicious PowerShell | Detect potentially malicious or abnormal PowerShell execution |
| Port scanning | Detect port scans or reconnaissance activity against endpoints |
| Web attacks | Detect suspicious activity from web server logs |
| File modification | Detect unauthorized or suspicious changes using File Integrity Monitoring |
| Suspicious processes | Detect abnormal or potentially malicious processes using endpoint telemetry/Sysmon |
| Vulnerable software | Detect vulnerable applications/software installed on endpoints |
| Malicious IPs/domains | Detect communication with known malicious IP addresses or domains |
Our main questions
Which built-in Wazuh rules and rule IDs should we use for each of these attack scenarios?
Which events/log sources should be enabled on Windows,MAC and Linux endpoints to achieve good detection coverage?
Can Wazuh correlate multiple failed authentication attempts and generate a higher-severity alert when they appear to be a brute-force attack?
Can Wazuh detect network reconnaissance activities such as port scanning, or should we integrate Wazuh with Suricata or another network IDS?
What is the recommended approach for sending alerts to our SOC/email/Teams/Slack when these events are detected?
Can Active Response automatically block the source IP for attacks such as SSH/RDP brute force or port scanning?
What is the recommended architecture for combining Wazuh Agent + Wazuh Manager + Sysmon + Suricata + Active Response?
Are there any additional Wazuh rules, integrations, or configurations you recommend for improving endpoint attack detection?
Our goal is to have a centralized monitoring solution where Wazuh detects suspicious activity, generates an appropriate alert with details such as source IP, destination endpoint, username, event type, rule ID, severity, and MITRE ATT&CK technique, and optionally performs an automated response.
Could you please provide your recommended configuration and best practices for implementing this?
LEGAL DISCLAIMER: By including any personal data in your response to this email, you are freely consenting to this being used and stored by us for the purpose of service delivery. Any email and files/attachments transmitted with it may be confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose the information it contains. Please notify us immediately and delete the message from your system. 42Gears is committed to your privacy. To understand more about how we collect, store, and process your personal information, please take a look at our Privacy Notice.
Bony V John
Bony V John
Hi,
Yes, most of these scenarios can be covered with Wazuh, but I would not recommend trying to handle everything using only the default Wazuh rules. You can also create custom rules for additional use cases or fine-tune the alerts based on your requirements.
Answered based on each of your questions:
1. Which built-in Wazuh rules and rule IDs should we use for each of these attack scenarios?
- SSH brute-force attack - Use rule IDs 5712 and 5763, which cover brute-force attack alerts.
- RDP brute-force attack - Use 6024 for multiple Windows login failures.
- Windows failed logins - 60122 for Windows login failures.
- Multiple failed login attempts - 5720 for multiple login failures.
- Privilege escalation - 5402, 5404, 80721, 60203, etc. can be used for privilege escalation detection. There are also different supporting rules available, and you can create custom rules based on your requirements.
- Malware - 99901, 87105, 62113, and 52502 can be used as the main rules for malware detection. There are also other supporting rules available.
- Suspicious PowerShell - 91809, 91810, 91803, 91823, and 91822.
- Port scanning - 4151, 20151, 86601, and 20161.
- Web attacks - 31103, 31104, 31105, and 31106.
- File modification - 550.
- Suspicious processes - 92016 - 92019, 92024, 92026, 184666, and 184696.
- Vulnerable software - 23504, 23505, and 23506.
- Malicious IPs/domains - 99903, 99904, 99915 - 99920.
These are the default rules based on the use cases that you have shared. There are also supporting child rules available. You can go through the Wazuh Rules page on the Wazuh Dashboard to check the available rules based on your use cases.
2. Which events/log sources should be enabled on Windows, MAC, and Linux endpoints to achieve good detection coverage?
For Windows I would collect at least:
- Windows Security
- Windows System
- Windows Application
- Microsoft-Windows-Sysmon/Operational
- Microsoft-Windows-PowerShell/Operational
- Microsoft-Windows-Windows Defender/Operational
- RDP/Terminal Services event channels where required
- Windows Firewall logs where network visibility is needed
For Linux I would enable/collect:
- /var/log/auth.log or /var/log/secure
- SSHD
- sudo/PAM authentication
- Auditd
- journald/systemd
- kernel events
- UFW/firewalld/iptables logs where applicable
- application/web server logs
- FIM
- Syscollector
For macOS I would use:
- macOS Unified Logging System
- authentication/security-related unified logs
- FIM for sensitive files and directories
- Syscollector
- application/security-tool logs
- additional audit telemetry where required
Also, you can configure the Wazuh agent to monitor other modules on the endpoint based on your requirements and use cases. For this, you can refer to the Wazuh documentation for configuring the Wazuh agent.
3. Can Wazuh correlate multiple failed authentication attempts and generate a higher-severity alert when they appear to be a brute-force attack?
Yes, you can create custom rules to trigger higher-severity alerts when multiple brute-force attacks are detected.
For example, a brute-force attack alert is triggered with rule ID 5712. You can create a custom rule to check if multiple brute-force attack alerts are triggered from the same source IP.
In that case, your custom rule syntax should look like below:
<if_matched_sid>5712</if_matched_sid>
<same_source_ip />
<description>sshd: Multiple brute force attack alert triggered from a single source IP.</description>
</rule>
4. Can Wazuh detect network reconnaissance activities such as port scanning, or should we integrate Wazuh with Suricata or another network IDS?
Yes, for port scan detection, you can configure Suricata in your environment to monitor port scanning activities on your network. Suricata will generate the events, and Wazuh can collect and analyze those logs to trigger alerts.
There is official documentation available for the configuration guidance. You can refer to this Wazuh documentation for further details:
https://wazuh.com/blog/responding-to-network-attacks-with-suricata-and-wazuh-xdr/
5. What is the recommended approach for sending alerts to our SOC/email/Teams/Slack when these events are detected?
You can configure the integration module for sending email or Slack alerts from Wazuh. For Teams, you need to create a custom script to send Wazuh alerts to Teams based on your requirements.
You can refer to this Wazuh documentation for configuration guidance on email alerts and configuring alerts based on your requirements:
https://documentation.wazuh.com/current/user-manual/manager/alert-management.html#configuring-email-alerts
For Slack alerts and Teams alerts, you can refer to the Wazuh integration documentation for guidance on sending alerts to Slack. Note that for Teams, you need to create a custom script to send the alerts:
https://documentation.wazuh.com/current/user-manual/manager/integration-with-external-apis.html#slack
6. Can Active Response automatically block the source IP for attacks such as SSH/RDP brute force or port scanning?
Yes, you can configure Active Response to block the malicious source IP on the endpoint for SSH/RDP brute-force attacks or port scanning.
You can refer to this Wazuh blog, which shows how to configure Wazuh Active Response to block an IP performing a port scan:
https://wazuh.com/blog/responding-to-network-attacks-with-suricata-and-wazuh-xdr/
Also, you can refer to the Wazuh Active Response documentation for configuring Active Response for additional use cases.
https://documentation.wazuh.com/current/user-manual/capabilities/active-response/index.html
7. What is the recommended architecture for combining Wazuh Agent + Wazuh Manager + Sysmon + Suricata + Active Response?
Suricata and Sysmon are log sources that generate events based on activities occurring on the endpoint or network. We can consider them as telemetry/log sources that generate the logs -> Wazuh Agent will be configured to monitor those log sources and send the events to the Wazuh Manager for analysis -> Wazuh Manager will decode the events and analyze them using the available Wazuh rules, then trigger alerts based on the event severity and rule conditions configured on the Wazuh Manager -> Wazuh Manager can trigger Active Response if it is configured to take an action such as blocking an IP -> the Wazuh Agent will execute the action on the endpoint and send the corresponding logs back to the Wazuh Manager, confirming that the action was executed.
8. Are there any additional Wazuh rules, integrations, or configurations you recommend for improving endpoint attack detection?
Yes, you can create custom rules and add custom integrations to enhance the security monitoring of your environment. You can also create and fine-tune custom rules to improve detection accuracy and avoid flooding the environment with noisy alerts.
You can refer to Wazuh blogs and documentation for additional security integrations that can be added to your environment based on your security monitoring requirements.
Narasimha Naidu B
 | |
| B Narasimha Naidu | |
| Senior System Engineer L2 | |
| Bangalore, India | |
| M: +91 9686634776 | |
 | |
--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/f9b1144d-4208-466a-9623-a90962089bc8n%40googlegroups.com.