Failed attempt to perform a privileged operation from one of the agents.

[S K]

Hi!  On the wazuh server, I receive many messages like Failed attempt to perform a privileged operation from one of the agents. What can you do about this?

data.win.eventdata.objectServer

Security

data.win.eventdata.privilegeList

SeProfileSingleProcessPrivilege

data.win.eventdata.processId

0xe98

data.win.eventdata.processName

C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe

data.win.eventdata.subjectDomainName

MYDOMAIN

data.win.eventdata.subjectLogonId

0x6ecb2c8e

data.win.eventdata.subjectUserName

user

data.win.eventdata.subjectUserSid

S-1-5-21-2407885080-1312752117-203232576-11325

data.win.system.channel

Security

data.win.system.computer

host.mydomain.local

data.win.system.eventID

4673

data.win.system.eventRecordID

413213634

data.win.system.keywords

0x8010000000000000

data.win.system.level

0

data.win.system.message

data.win.system.opcode

0

data.win.system.processID

4

data.win.system.providerGuid

{54849625-5478-4994-a5ba-3e3b0328c30d}

data.win.system.providerName

Microsoft-Windows-Security-Auditing

data.win.system.severityValue

AUDIT_FAILURE

data.win.system.systemTime

2023-11-01T11:12:59.4842559Z

data.win.system.task

13056

data.win.system.threadID

22944

data.win.system.version

0

decoder.name

windows_eventchannel

id

1698837272.2171363486

input.type

log

location

EventChannel

manager.name

wazuh-server-01

rule.description

Failed attempt to perform a privileged operation.

rule.firedtimes

63,042

rule.gdpr

IV_32.2

rule.groups

windows, windows_security

rule.hipaa

164.312.b

rule.id

60107

rule.level

4

rule.mail

false

rule.mitre.id

T1078

rule.mitre.tactic

Defense Evasion, Persistence, Privilege Escalation, Initial Access

rule.mitre.technique

Valid Accounts

rule.nist_800_53

AC.6, AU.14

rule.pci_dss

10.2.2

rule.tsc

CC6.8, CC7.2, CC7.3

timestamp

Nov 1, 2023 @ 14:14:32.578

[Md. Nazmur Sakib]

Hi S K,

Hope you are doing well. Thank you for using Wazuh.

This is a known issue for Google Chrome. It appears that these alerts are likely false positives originating from Chrome.

Check this document:

https://support.google.com/chrome/a/thread/15440066/excessive-windows-10-audit-failures-from-chrome-exe?hl=en

As a response, we have two available options: either filter these alerts or choose to ignore them.

Follow one of these in order to troubleshoot this issue:

Filter that case using an eventchannel query.

If you're receiving a large volume of alerts, which could strain your system resources, it might be best to filter these alerts using a query in your Windows agent configuration. You can make this adjustment in the Windows agent ossec.conf file (or use Centralized configuration if you want to apply this change in all your Windows endpoints). Here's an example of what the query might look like:

<localfile>

  <location>Security</location>

  <log_format>eventchannel</log_format>

   <query>

<localfile>

   <location>Security</location>

   <log_format>eventchannel</log_format>

   <query>

    \<QueryList\>

     \<Query Id="0" Path="Security"\>

     \<Select Path="Security"\>*\</Select\>

     \<Suppress Path="Security"\>*[System[(EventID=4673)]] 

    *[EventData[Data[@Name='PrivilegeList'] and (Data='SeProfileSingleProcessPrivilege')]]

and *[EventData[Data[@Name='ProcessName

'] and (Data ='C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe')]]\

</Suppress\>

     \</Query\>

    \</QueryList\>

   </query>

</localfile>

Please use this query cautiously, as it has not been thoroughly tested in a live environment.

More information about eventchannel queries can be found in Monitoring specific events from Windows event channel documentation.

Ignore the rule for that case:

Create a custom rule to ignore this case. Something like the following should do the job:

  <rule id="100005" level="0">

    <if_sid>60107</if_sid> <!-- The name of the parent rule -->

    <field name="win.eventdata.processName">C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe</field>

    <description>Custom rule used with Chrome.</description>

  </rule>

Let me if this solves your issue or if you need any further help.

Regards

Md. Nazmur Sakib

[S K]

Thank you! Is there an error in the agent configuration filter? I think I'm missing one parameter </query>

среда, 1 ноября 2023 г. в 15:03:56 UTC+3, Md. Nazmur Sakib:

[Md. Nazmur Sakib]

Hi S K,

Hope you are doing well. Sorry for the late response.

This is just a template to give you the idea. Configure it based on your need.

Check the document for reference:

https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/localfile.html

Regards

Md. Nazmur Sakib

[S K]

Hello! Thanks! 

I added the rule as you wrote, but when I restart wazuh-manager I get an error

wazuh-srv:~# systemctl restart wazuh-manager.service
Job for wazuh-manager.service failed because the control process exited with error code.
See "systemctl status wazuh-manager.service" and "journalctl -xeu wazuh-manager.service" for details.
wazuh-srv:~# journalctl --unit wazuh-manager --follow
Dec 21 15:20:16 dc-wazuh-01 systemd[1]: Failed to start Wazuh manager.
Dec 21 15:20:16 wazuh-srv systemd[1]: wazuh-manager.service: Consumed 2.484s CPU time.
Dec 21 15:22:04 wazuh-srv systemd[1]: Starting Wazuh manager...
Dec 21 15:22:07 wazuh-srv env[3756516]: 2023/12/21 15:22:07 wazuh-analysisd: ERROR: rules_op: Invalid root element "rule".Only "group" is allowed
Dec 21 15:22:07 wazuh-srv env[3756516]: 2023/12/21 15:22:07 wazuh-analysisd: CRITICAL: (1220): Error loading the rules: 'etc/rules/local_rules.xml '.
Dec 21 15:22:07 wazuh-srv env[3756491]: wazuh-analysisd: Configuration error. Exiting
Dec 21 15:22:07 wazuh-srv systemd[1]: wazuh-manager.service: Control process exited, code=exited, status=1/FAILURE
Dec 21 15:22:07 wazuh-srv systemd[1]: wazuh-manager.service: Failed with result 'exit-code'.
Dec 21 15:22:07 wazuh-srv systemd[1]: Failed to start Wazuh manager.
Dec 21 15:22:07 wazuh-srv systemd[1]: wazuh-manager.service: Consumed 2.285s CPU time.

вторник, 7 ноября 2023 г. в 07:37:08 UTC+3, Md. Nazmur Sakib: