Wazuh Sysmon Installation Detection

[Yogi Valentino]

I'm trying to Install app and make Wazuh detect what i did

This is the rules

 <rule id="101101" level="5">
           <if_sid>61603</if_sid>
           <field name="win.eventdata.RuleName"></field>
           <options>no_full_log</options>
           <description>Sysmon - Event 1: File Opened $(win.eventdata.description).</description>
  </rule>

<rule id="100502" level="5">
           <if_sid>101101</if_sid>
           <field name="win.eventdata.RuleName">^technique_id=T1204,technique_name=User Execution$</field>
           <field name="win.eventdata.image">(?i)\.exe$</field>
           <field name="win.eventdata.parentImage">(?i)\\explorer\.exe$</field>
           <options>no_full_log</options>
           <description>Application Installed $(win.eventdata.product) $(win.eventdata.fileVersion) by User.</description>
     </rule>

But it only keep generated the first rule. Any ideas?

Here i put the screenshoot and the full JSON about the log rule.

[hasitha.u...@wazuh.com]

Hi Yogi,

Please allow me some time; I’m currently looking into this and will get back to you with an update as soon as possible.  

[hasitha.u...@wazuh.com]

Hi Yogi,

I've tested this rule and identified the problem. The regex type isn't defined in the field tags section. You're using PCRE2 regex syntax, but you need to explicitly declare the regex type for it to work properly.  

•    <field name="win.eventdata.image">(?i)\.exe$</field>
•     <field name="win.eventdata.parentImage">(?i)\\explorer\.exe$</field>

You needto modify them like below.

•    <field name="win.eventdata.image" type="pcre2">(?i)\.exe$</field>
•     <field name="win.eventdata.parentImage" type="pcre2">(?i)\\explorer\.exe$</field>
  

For more details, you can refer to this guide.

Custom rule path: /var/ossec/etc/rules/

1. <group name="sysmon_custom">

1.  
2. <rule id="101101" level="5">
3.            <if_sid>61603</if_sid>
4.            <field name="win.eventdata.RuleName"></field>
5.            <options>no_full_log</options>
6.            <description>Sysmon - Event 1: File Opened $(win.eventdata.description).</description>
7.   </rule>
8.  
9. <rule id="100502" level="5">
10.            <if_sid>101101</if_sid>
11.            <field name="win.eventdata.RuleName">^technique_id=T1204,technique_name=User Execution$</field>

1.            <field name="win.eventdata.image" type="pcre2">(?i)\.exe$</field>
2.            <field name="win.eventdata.parentImage" type="pcre2">(?i)\\explorer\.exe$</field>

1.            <options>no_full_log</options>
2.            <description>Application Installed $(win.eventdata.product) $(win.eventdata.fileVersion) by User.</description>
3.      </rule>
4.  

1. </group>

After modifying the rule, make sure to restart the manager to apply the changes.
systemctl restart wazuh-manager



Further references:

• Rules
• Rules Syntax
• Regular Expression Syntax

Let me know if you need further assistance on this.