Detection of hidden ports

[Nidhi Soni]

Hi all,

I have wazuh manager version: 4.3.7 installed on ubuntu

I have wazuh agent 4.3.7 installed on ubuntu

How can I get alerts for hidden ports using rootcheck

[Ifeanyi Onyia Odike]

Hi Nidhi,

Thank you for using Wazuh!

To answer your query. You will like to detect open ports on monitored agents using Wazuh.

You can integrate NMAP with Wazuh to scan network subnets for open ports and services, as explained and exemplified in the following repository: Github Wazuh-Nmap
NMAP must be installed on the agents and the NMAP output converted to JSON and added to the active responses file of each agent.

Below is a blog post that also details how this can be achieved. Socfortress - Using Wazuh stack to run network scans

Let me know if your objectives were achieved with the information provided.

BR,

[Nidhi Soni]

Hi,

I want to detect hidden ports using rootcheck as mentioned in the documentation:
https://documentation.wazuh.com/current/user-manual/capabilities/anomalies-detection/how-it-works.html

What steps should I follow to get alert for the hidden ports using rootcheck?

[Ifeanyi Onyia Odike]

Hi Nidhi,

Please note that Wazuh mentions this as a functionality of the Rootcheck feature. 
To configure, please see the example provided in the guide: Anomaly and malware detection - Basic example

I hope this helps.

BR,

[Nidhi Soni]

Hi,

I have installed reptile rootkit and did the required configurations as given in wazuh blog:

https://wazuh.com/blog/using-wazuh-rootcheck-to-detect-reptile-rootkit

I used this command to hide : /reptile/reptile_cmd conn <ip> <port> hide

After that when I use : netstat -tun | grep <port> the network connection does not show up.

But I did not get alerts in alerts.json, also I didn't get logs in archives.json for hidden ports.

[Ifeanyi Onyia Odike]

Hi Nidhi,

Did you get the other alerts as stated in the blog post?

[Nidhi Soni]

Hi,

Yes I got the other alerts for:
Hide a process
Hide files and folders

Enable promiscuous mode on a network interface

[Ifeanyi Onyia Odike]

Hi Nidhi,

I will attempt to replicate this lab and revert with my findings.

I will respond to this as soon as I have the answer.

BR,