custom SCA for windows

[doc dodo]

Hello,

I try custom sca with check

checks:

  - id: 330510
    title: "Ensure windows wazuh-agent is installed."
    description: "wazuh-agent install checking."
    remediation: "Install wazuh-agent."
    condition: all
    rules:
      - "c:if (Get-Package -Name 'Wazuh Agent' -ErrorAction SilentlyContinue) { 'Exists' } else { 'NotExists' } -> r:Exists"

But result is not applicable. If I input command in Powershell I get the result "Exist".

What could be the problem?

[Matías Mercado]

Hello,

Get-Package depends on the available package providers (MSI, Programs, Chocolatey, etc.). Those providers are not always loaded when PowerShell is executed non-interactively by a service. As a result, Get-Package -Name 'Wazuh Agent' often returns nothing, even though the agent is installed.

Try this instead:

checks:
  - id: 330510
    title: "Ensure Windows Wazuh Agent is installed"
    description: "Checks if the Wazuh Agent is installed via registry."
    remediation: "Install the Wazuh Agent."
    condition: all
    rules:
      - "c:reg query \"HKLM\\SOFTWARE\\Wazuh\" -> r:Wazuh"

This is verifying the package searching on the registry and is not using PowerShell.

Regards,
Matías Mercado. 

[Jose Cintron]

Although this would work it is too easy to fake. All I have to do is create the right registry key and I faked my way into compliance... i have never used the windows wazuh agent, but i am going to assume that it creates a windows service when you install it. if this is the case, how about using ' get-service' to do the check?

something like (sust foobar with the actual service name)

   get-service -name "foobar"

should work you can also make sure that it is running (it is not enough to install it, it should also be running).

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/8681bc39-6ac7-43e4-8732-1c902567b0b2n%40googlegroups.com.

--

+==========================================
| Jose J. Cintron - <prb...@gmail.com>

| https://sites.google.com/site/joseconsciousness
|
| "The key to joy is disobedience."
|    Aleister Crowley
+==========================================

[Jack Martin]

I do to implement the Cleartext Credential Exposure use case using Wazuh:

Detect passwords stored in scripts, configuration files, or log files

Value: Prevents credential leakage and credential reuse attacks

Response: Generate alerts and recommend credential rotation

Reference:

https://documentation.wazuh.com/current/user-manual/capabilities/sec-config-assessment/use-cases.html#use-cases

My questions are:

If the environment has more than 50 agents across different operating systems, how can this be implemented efficiently without manually configuring each agent?

How can we create and manage custom security policies centrally on the Ubuntu-based Wazuh manager and apply them to Windows 10 Pro agents?

The Wazuh manager is running on Ubuntu, and the agents are Windows 10 Pro.

Please let me know if this approach is correct and if there are additional best practices or recommendations I should consider.

To view this discussion visit https://groups.google.com/d/msgid/wazuh/CAKQkZEnXcHomyqxsmD0AviiEnBtJK77ytK34jK1wqK9YPsyuRw%40mail.gmail.com.