Create custom decoder from ADFS auditing log

[riiky devils]

Hello,

I'm currently faced the issue about create custom decoder from ADFS auditing log
I'm cannot create exactly prematch decoder from archives.log

This is example log from archives.log

2021 Aug 16 08:39:13 (live-365-adfs) any->EventChannel {"win":{"system":{"providerName":"AD FS Auditing","eventID":"1202","level":"0","task":"3","keywords":"0x80a0000000000000","systemTime":"2021-08-16T01:39:12.364350400Z","eventRecordID":"1727886","channel":"Security","computer":"xxxxx.xxxx.com,"severityValue":"AUDIT_SUCCESS","message":"\"The Federation Service validated a new credential. See XML for details. \r\n\r\nActivity ID: xxxxxxxxxxxxxxx \r\n\r\nAdditional Data \r\nXML: <?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\r\n  <AuditType>FreshCredentials</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>xxxxx-xxxx-xxxx</RelyingParty>\r\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\r\n      <UserId>XXXXX</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>https://axfs.xxxxxxxx</Server>\r\n      <AuthProtocol>OAuth</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.10.xx.xx</IpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36</UserAgentString>\r\n      <Endpoint>/adfs/oauth2/authorize/</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>\""},"eventdata":{"data":"xxxxx-xxxxx-xxxx, &lt;?xml version=\\\"1.0\\\" encoding=\\\"utf-16\\\"?&gt;  &lt;AuditBase xmlns:xsd=\\\"http://www.w3.org/2001/XMLSchema\\\" xmlns:xsi=\\\"http://www.w3.org/2001/XMLSchema-instance\\\" xsi:type=\\\"FreshCredentialAudit\\\"&gt;    &lt;AuditType&gt;FreshCredentials&lt;/AuditType&gt;    &lt;AuditResult&gt;Success&lt;/AuditResult&gt;    &lt;FailureType&gt;None&lt;/FailureType&gt;    &lt;ErrorCode&gt;N/A&lt;/ErrorCode&gt;    &lt;ContextComponents&gt;      &lt;Component xsi:type=\\\"ResourceAuditComponent\\\"&gt;        &lt;RelyingParty&gt;xxx-xxxx-xxxxlt;/RelyingParty&gt;        &lt;ClaimsProvider&gt;AD AUTHORITY&lt;/ClaimsProvider&gt;        &lt;UserId&gt;xxxx-xxxx&lt;/UserId&gt;      &lt;/Component&gt;      &lt;Component xsi:type=\\\"AuthNAuditComponent\\\"&gt;        &lt;PrimaryAuth&gt;N/A&lt;/PrimaryAuth&gt;        &lt;DeviceAuth&gt;false&lt;/DeviceAuth&gt;        &lt;DeviceId&gt;N/A&lt;/DeviceId&gt;        &lt;MfaPerformed&gt;false&lt;/MfaPerformed&gt;        &lt;MfaMethod&gt;N/A&lt;/MfaMethod&gt;        &lt;TokenBindingProvidedId&gt;false&lt;/TokenBindingProvidedId&gt;        &lt;TokenBindingReferredId&gt;false&lt;/TokenBindingReferredId&gt;        &lt;SsoBindingValidationLevel&gt;NotSet&lt;/SsoBindingValidationLevel&gt;      &lt;/Component&gt;      &lt;Component xsi:type=\\\"ProtocolAuditComponent\\\"&gt;        &lt;OAuthClientId&gt;N/A&lt;/OAuthClientId&gt;        &lt;OAuthGrant&gt;N/A&lt;/OAuthGrant&gt;      &lt;/Component&gt;      &lt;Component xsi:type=\\\"RequestAuditComponent\\\"&gt;        &lt;Server&gt;https://xxxxx.xxxx.com&lt;/Server&gt;        &lt;AuthProtocol&gt;OAuth&lt;/AuthProtocol&gt;        &lt;NetworkLocation&gt;Intranet&lt;/NetworkLocation&gt;        &lt;IpAddress&gt;10.10.xxx.xxx&lt;/IpAddress&gt;        &lt;ProxyServer&gt;N/A&lt;/ProxyServer&gt;        &lt;UserAgentString&gt;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36&lt;/UserAgentString&gt;        &lt;Endpoint&gt;/adfs/oauth2/authorize/&lt;/Endpoint&gt;      &lt;/Component&gt;    &lt;/ContextComponents&gt;  &lt;/AuditBase&gt;"}}}

actually i want to extract failure and success event from AD FS classic security log which the decoder does not provide by default for the eventchannel log

Anyone can help me?

Thanks

[Fabricio Brunetti]

Hi Riiky,

From which Wazuh version were these logs collected?, there is something weird with json and xml format mixed in a single log.
Have you tried adding the  "AD FS/Auditing" provider using this guide https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/how-to-collect-wlogs.html?

Regards,

Fabricio Brunetti

[riiky devils]

Hi Fabricio,

The wazuh version on server logs collected is 4.1.4.  I'm already add localfile from security eventchannel log in ossec.conf
 

When i'm try to parse previous log from archives.log to logtest this is the result no decoder matched

This is the real log from eventviewer on server

So, any workaround to create decoder from adfs auditing log?

Thank You,

[Fabricio Brunetti]

Riiky,

Instead of looking for the event log in archives.log, could you search for it in archives.json? It should be in the same folder and will provide cleaner logs (hopefully without \n and &lt characters ) for Windows Event Channel.
In newer versions of Wazuh, like the one you are using, Windows Event channel events do not need a decoder, they are automatically decoded in a json-like format. Ideally you would write a simple base rule that would act as a "decoder" and then extend with specific rules.

Testing windows event log rules using wazuh-logtest is a bit tricky, as you will need to make a temporary change to rule  60000 in /var/ossec/ruleset/rules/0575-win-base_rules.xml:

  <rule id="60000" level="0">

  <!--category>ossec</category-->

  <!--decoded_as>windows_eventchannel</decoded_as-->

   <decoded_as>json</decoded_as>

    <field name="win.system.providerName">\.+</field>

    <options>no_full_log</options>

    <description>Group of windows rules</description>

  </rule>

You child rule would be something like

AD FS Auditing

  <rule id="100001" level="0">

   <if_sid>60000</if_sid>

    <field name="win.system.providerName">AD FS Auditing</field>

    <options>no_full_log</options>

    <description>Group of AD FS classic security log rules</description>

  </rule>

If you can get the log in json format I can provide better guidance on this.

Regards,

Fabricio

[riiky devils]

Hi Fabricio,

Here the log format from archives.json

{"timestamp":"2021-08-20T04:26:00.293+0700","agent":{"id":"002","name":"adfs-server","ip":"10.10.xx.xx"},"manager":{"name":"siem.domain.com"},"id":"1629408360.1384361533","full_log":"{\"win\":{\"system\":{\"providerName\":\"AD FS Auditing\",\"eventID\":\"1202\",\"level\":\"0\",\"task\":\"3\",\"keywords\":\"0x80a0000000000000\",\"systemTime\":\"2021-08-19T21:25:59.254335000Z\",\"eventRecordID\":\"1760607\",\"channel\":\"Security\",\"computer\":\"adadada.xxx.com\",\"severityValue\":\"AUDIT_SUCCESS\",\"message\":\"\\\"The Federation Service validated a new credential. See XML for details. \\r\\n\\r\\nActivity ID: xxx-xxxx-xxxxx-xxxxx \\r\\n\\r\\nAdditional Data \\r\\nXML: <?xml version=\\\"1.0\\\" encoding=\\\"utf-16\\\"?>\\r\\n<AuditBase xmlns:xsd=\\\"http://www.w3.org/2001/XMLSchema\\\" xmlns:xsi=\\\"http://www.w3.org/2001/XMLSchema-instance\\\" xsi:type=\\\"FreshCredentialAudit\\\">\\r\\n  <AuditType>FreshCredentials</AuditType>\\r\\n  <AuditResult>Success</AuditResult>\\r\\n  <FailureType>None</FailureType>\\r\\n  <ErrorCode>N/A</ErrorCode>\\r\\n  <ContextComponents>\\r\\n    <Component xsi:type=\\\"ResourceAuditComponent\\\">\\r\\n      <RelyingParty>yyyy-yyyyy-yyyy-yyyyy</RelyingParty>\\r\\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\\r\\n      <UserId>domain\\\\user</UserId>\\r\\n    </Component>\\r\\n    <Component xsi:type=\\\"AuthNAuditComponent\\\">\\r\\n      <PrimaryAuth>N/A</PrimaryAuth>\\r\\n      <DeviceAuth>false</DeviceAuth>\\r\\n      <DeviceId>N/A</DeviceId>\\r\\n      <MfaPerformed>false</MfaPerformed>\\r\\n      <MfaMethod>N/A</MfaMethod>\\r\\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\\r\\n      <TokenBindingReferredId>false</TokenBindingReferredId>\\r\\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\\r\\n    </Component>\\r\\n    <Component xsi:type=\\\"ProtocolAuditComponent\\\">\\r\\n      <OAuthClientId>N/A</OAuthClientId>\\r\\n      <OAuthGrant>N/A</OAuthGrant>\\r\\n    </Component>\\r\\n    <Component xsi:type=\\\"RequestAuditComponent\\\">\\r\\n      <Server>https://axfs.domain.com/adfs</Server>\\r\\n      <AuthProtocol>OAuth</AuthProtocol>\\r\\n      <NetworkLocation>Extranet</NetworkLocation>\\r\\n      <IpAddress>10.10.xx.xx</IpAddress>\\r\\n      <ProxyServer>10.10.xx.xx</ProxyServer>\\r\\n      <UserAgentString>Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36</UserAgentString>\\r\\n      <Endpoint>/adfs/oauth2/authorize/</Endpoint>\\r\\n    </Component>\\r\\n  </ContextComponents>\\r\\n</AuditBase>\\\"\"},\"eventdata\":{\"data\":\"xxx-xxxx-xxxxx-xxxxx, &lt;?xml version=\\\\\\\"1.0\\\\\\\" encoding=\\\\\\\"utf-16\\\\\\\"?&gt;  &lt;AuditBase xmlns:xsd=\\\\\\\"http://www.w3.org/2001/XMLSchema\\\\\\\" xmlns:xsi=\\\\\\\"http://www.w3.org/2001/XMLSchema-instance\\\\\\\" xsi:type=\\\\\\\"FreshCredentialAudit\\\\\\\"&gt;    &lt;AuditType&gt;FreshCredentials&lt;/AuditType&gt;    &lt;AuditResult&gt;Success&lt;/AuditResult&gt;    &lt;FailureType&gt;None&lt;/FailureType&gt;    &lt;ErrorCode&gt;N/A&lt;/ErrorCode&gt;    &lt;ContextComponents&gt;      &lt;Component xsi:type=\\\\\\\"ResourceAuditComponent\\\\\\\"&gt;        &lt;RelyingParty&gt;yyyy-yyyyy-yyyy-yyyyy&lt;/RelyingParty&gt;        &lt;ClaimsProvider&gt;AD AUTHORITY&lt;/ClaimsProvider&gt;        &lt;UserId&gt;domain\\\\\\\\user&lt;/UserId&gt;      &lt;/Component&gt;      &lt;Component xsi:type=\\\\\\\"AuthNAuditComponent\\\\\\\"&gt;        &lt;PrimaryAuth&gt;N/A&lt;/PrimaryAuth&gt;        &lt;DeviceAuth&gt;false&lt;/DeviceAuth&gt;        &lt;DeviceId&gt;N/A&lt;/DeviceId&gt;        &lt;MfaPerformed&gt;false&lt;/MfaPerformed&gt;        &lt;MfaMethod&gt;N/A&lt;/MfaMethod&gt;        &lt;TokenBindingProvidedId&gt;false&lt;/TokenBindingProvidedId&gt;        &lt;TokenBindingReferredId&gt;false&lt;/TokenBindingReferredId&gt;        &lt;SsoBindingValidationLevel&gt;NotSet&lt;/SsoBindingValidationLevel&gt;      &lt;/Component&gt;      &lt;Component xsi:type=\\\\\\\"ProtocolAuditComponent\\\\\\\"&gt;        &lt;OAuthClientId&gt;N/A&lt;/OAuthClientId&gt;        &lt;OAuthGrant&gt;N/A&lt;/OAuthGrant&gt;      &lt;/Component&gt;      &lt;Component xsi:type=\\\\\\\"RequestAuditComponent\\\\\\\"&gt;        &lt;Server&gt;https://axfs.domain.com/adfs&lt;/Server&gt;        &lt;AuthProtocol&gt;OAuth&lt;/AuthProtocol&gt;        &lt;NetworkLocation&gt;Extranet&lt;/NetworkLocation&gt;        &lt;IpAddress&gt;10.10.xx.xx&lt;/IpAddress&gt;        &lt;ProxyServer&gt;10.10.xx.xx&lt;/ProxyServer&gt;        &lt;UserAgentString&gt;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36&lt;/UserAgentString&gt;        &lt;Endpoint&gt;/adfs/oauth2/authorize/&lt;/Endpoint&gt;      &lt;/Component&gt;    &lt;/ContextComponents&gt;  &lt;/AuditBase&gt;\"}}}","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"AD FS Auditing","eventID":"1202","level":"0","task":"3","keywords":"0x80a0000000000000","systemTime":"2021-08-19T21:25:59.254335000Z","eventRecordID":"1760607","channel":"Security","computer":"adadada.xxx.com","severityValue":"AUDIT_SUCCESS","message":"\"The Federation Service validated a new credential. See XML for details. \r\n\r\nActivity ID: xxx-xxxx-xxxxx-xxxxx \r\n\r\nAdditional Data \r\nXML: <?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\r\n  <AuditType>FreshCredentials</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>yyyy-yyyyy-yyyy-yyyyy</RelyingParty>\r\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\r\n      <UserId>domain\\user</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>https://axfs.domain.com/adfs</Server>\r\n      <AuthProtocol>OAuth</AuthProtocol>\r\n      <NetworkLocation>Extranet</NetworkLocation>\r\n      <IpAddress>10.10.xx.xx</IpAddress>\r\n      <ProxyServer>10.10.xx.xx</ProxyServer>\r\n      <UserAgentString>Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36</UserAgentString>\r\n      <Endpoint>/adfs/oauth2/authorize/</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>\""},"eventdata":{"data":"xxx-xxxx-xxxxx-xxxxx, &lt;?xml version=\\\"1.0\\\" encoding=\\\"utf-16\\\"?&gt;  &lt;AuditBase xmlns:xsd=\\\"http://www.w3.org/2001/XMLSchema\\\" xmlns:xsi=\\\"http://www.w3.org/2001/XMLSchema-instance\\\" xsi:type=\\\"FreshCredentialAudit\\\"&gt;    &lt;AuditType&gt;FreshCredentials&lt;/AuditType&gt;    &lt;AuditResult&gt;Success&lt;/AuditResult&gt;    &lt;FailureType&gt;None&lt;/FailureType&gt;    &lt;ErrorCode&gt;N/A&lt;/ErrorCode&gt;    &lt;ContextComponents&gt;      &lt;Component xsi:type=\\\"ResourceAuditComponent\\\"&gt;        &lt;RelyingParty&gt;yyyy-yyyyy-yyyy-yyyyy&lt;/RelyingParty&gt;        &lt;ClaimsProvider&gt;AD AUTHORITY&lt;/ClaimsProvider&gt;        &lt;UserId&gt;domain\\\\user&lt;/UserId&gt;      &lt;/Component&gt;      &lt;Component xsi:type=\\\"AuthNAuditComponent\\\"&gt;        &lt;PrimaryAuth&gt;N/A&lt;/PrimaryAuth&gt;        &lt;DeviceAuth&gt;false&lt;/DeviceAuth&gt;        &lt;DeviceId&gt;N/A&lt;/DeviceId&gt;        &lt;MfaPerformed&gt;false&lt;/MfaPerformed&gt;        &lt;MfaMethod&gt;N/A&lt;/MfaMethod&gt;        &lt;TokenBindingProvidedId&gt;false&lt;/TokenBindingProvidedId&gt;        &lt;TokenBindingReferredId&gt;false&lt;/TokenBindingReferredId&gt;        &lt;SsoBindingValidationLevel&gt;NotSet&lt;/SsoBindingValidationLevel&gt;      &lt;/Component&gt;      &lt;Component xsi:type=\\\"ProtocolAuditComponent\\\"&gt;        &lt;OAuthClientId&gt;N/A&lt;/OAuthClientId&gt;        &lt;OAuthGrant&gt;N/A&lt;/OAuthGrant&gt;      &lt;/Component&gt;      &lt;Component xsi:type=\\\"RequestAuditComponent\\\"&gt;        &lt;Server&gt;https://axfs.domain.com/adfs&lt;/Server&gt;        &lt;AuthProtocol&gt;OAuth&lt;/AuthProtocol&gt;        &lt;NetworkLocation&gt;Extranet&lt;/NetworkLocation&gt;        &lt;IpAddress&gt;10.10.xx.xx&lt;/IpAddress&gt;        &lt;ProxyServer&gt;10.10.xx.xx&lt;/ProxyServer&gt;        &lt;UserAgentString&gt;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36&lt;/UserAgentString&gt;        &lt;Endpoint&gt;/adfs/oauth2/authorize/&lt;/Endpoint&gt;      &lt;/Component&gt;    &lt;/ContextComponents&gt;  &lt;/AuditBase&gt;"}}},"location":"EventChannel"}

I think is not much different from archives.log

So, i need to change directly to  /var/ossec/ruleset/rules/0575-win-base_rules.xml and add child rules based on your suggestion? and then make alert rule in  /var/ossec/etc/rules/local_rules.xml?

Thank You,

[riiky devils]

Hi Fabricio,

I'm sorry i'm forgot something, the main reason is i want to extract IP address, Proxy server, UserID, Network Location and Endpoint information from success and failure event at ADFS auditing log provided

Thank You,

[Fabricio Brunetti]

Hi Riiky,

The log you provided can be parsed. So it's good.
The changes on  /var/ossec/ruleset/rules/0575-win-base_rules.xml are just for testing with wazuh-logtest, once you want to set the rules to productive you need to set it back to it's default values.
Problem is that the windows_eventchannel decoder can't be extended so we can't parse win.eventdata.data to get IP address, Proxy, UserId, etc, (we are working to fix this). 

Most we can do for now is generate an alert when some specific value is present in the log, it's not good to make a general rule (for example we can generate an alert when certain Network Location is used but we can't display it's value on the description).

Let me know if I can help you writing alert rules.

Regards,

Fabricio

[Ausy R]

Hi Team,

"Problem is that the windows_eventchannel decoder can't be extended so we can't parse win.eventdata.data to get IP address, Proxy, UserId, etc, (we are working to fix this)." 

Has anything changed with the newer version of Wazuh? Is it possible to decode these fields, like brining in a new child decoder for the windows_eventchannel decoder? 

Thanks,

Ausy

[ChiewJH]

Hi All,

Im having a same issue which need to grab the following item in message as a metakey(value/field) from the ADFS audit log

-Activity ID
-RelyingParty
-UserId
-Server
-NetworkLocation
-IpAddress
-ForwardedIpAddress

Is there solution or any way I can modify or decode it?

Thank You