Threat hunting with Wazuh and Yara

Threat hunting with Wazuh and Yara for endpoints is an effective approach to proactively identify and mitigate potential security threats on your network. Wazuh is an open-source security monitoring platform that can be used to collect, analyze, and correlate security events across your endpoints, while Yara is a powerful pattern matching tool for identifying specific patterns or indicators of compromise (IOCs) within files or processes.

Here's a step-by-step guide on how you can leverage Wazuh and Yara for threat hunting on your endpoints:

1. Set up Wazuh: Install and configure the Wazuh server on a centralized system or virtual machine within your network. Deploy Wazuh agents on your endpoints to collect and send security logs to the Wazuh server. Ensure the agents are properly configured to forward all relevant endpoint events.

To configure Wazuh on Linux, you typically need to follow these steps:

• Prerequisites: Ensure that you have a Linux distribution installed and updated on your system. Wazuh supports various distributions, including Ubuntu, CentOS, Debian, and Red Hat.
• Installation: Install the Wazuh server component on the machine that will function as the central manager. The Wazuh server collects and analyzes logs from multiple sources, manages agents, and performs various security-related tasks. You can find the installation instructions specific to your Linux distribution in the Wazuh documentation.

Install the Wazuh repository:

? ?Import the GPG key:

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo apt-key add –        

Add the Wazuh repository to your system:

For Ubuntu/Debian:

echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list        

For CentOS/Red Hat:

echo -e "[wazuh_repo]\nname=Wazuh repository\nbaseurl=https://packages.wazuh.com/4.x/yum/\ngpgcheck=1\nenabled=1" | sudo tee /etc/yum.repos.d/wazuh.repo        

Install Wazuh server and Elastic Stack:

Update the package cache:

For Ubuntu/Debian:

sudo apt update        

For CentOS/Red Hat:

sudo yum makecache        

Install the Wazuh server and the Elastic Stack (including Elasticsearch, Logstash, and Kibana):

For Ubuntu/Debian:

sudo apt install wazuh-manager        

For CentOS/Red Hat:

sudo yum install wazuh-manager        

Configure Wazuh:

Wazuh server configuration: Edit the Wazuh server configuration file (/var/ossec/etc/ossec.conf) and modify the necessary settings, such as email notifications, log analysis rules, and network configuration.

Wazuh agent configuration: Edit the agent configuration file (/var/ossec/etc/ossec.conf) on each monitored machine. Specify the Wazuh server IP address, authentication key, and any additional configuration options as needed.

Start Wazuh services:

For Ubuntu/Debian:

sudo systemctl enable wazuh-manage

sudo systemctl start wazuh-managerr        

For CentOS/Red Hat:

sudo systemctl enable wazuh-manage

sudo systemctl start wazuh-managerr        

Access Kibana:

Open a web browser and access the Kibana interface by navigating to https://<wazuh-server-IP>:5601.

Follow the on-screen prompts to set up Kibana and create an administrator account. Once logged in, you can explore the Wazuh dashboards and configure additional features as needed.

Agent installation: Install the Wazuh agent on the machines you want to monitor. Agents are responsible for collecting logs and sending them to the Wazuh server for analysis. Again, the installation process may vary depending on your Linux distribution, so consult the Wazuh documentation for detailed instructions.

To install and configure the Wazuh agent on a Linux machine, follow these steps:

Install the Wazuh agent:

Transfer the Wazuh agent package to the target Linux machine.

Install the agent package:

For Ubuntu/Debian:

sudo dpkg -i wazuh-agent.deb        

For CentOS/Red Hat:

sudo rpm -ivh wazuh-agent.rpm        

Configure the Wazuh agent:

Open the agent configuration file for editing (/var/ossec/etc/ossec.conf)

Set the following parameters in the configuration file:

<client>: Specify a unique ID for the agent (e.g., an integer or a descriptive name).

<server-ip>: Set this to the IP address of the Wazuh server.

<agent-name>: Assign a name to the agent.

<alerts-log>: Define the path to the agent's alerts log file (e.g., /var/ossec/logs/alerts/alerts.log).

<log-file>: Specify the log files you want the agent to monitor, using <log_format> and <location> tags. You can include multiple log files.

<rootcheck>: Enable or disable the rootkit detection module (set <disabled> to 'no' or 'yes').

Save and close the configuration file..        

Register the agent with the Wazuh server:

Run the following command to register the agent:

/var/ossec/bin/agent-auth -m <server-ip> -A <agent-key>        

Replace <server-ip> with the IP address of the Wazuh server and <agent-key> with the registration key generated on the server.

Start the Wazuh agent and service:

For Ubuntu/Debian:

sudo systemctl enable wazuh-agen

sudo systemctl start wazuh-agentt        

For CentOS/Red Hat:

sudo systemctl enable wazuh-agen

sudo systemctl start wazuh-agentt        

Verify agent connectivity:

Check the agent status on the Wazuh server using the Wazuh API or the Wazuh app interface. Ensure that the agent appears as active and connected.

That's it! The Wazuh agent is now installed and configured on the Linux machine, ready to send logs to the Wazuh server for analysis.

Configuration: Once the Wazuh server and agents are installed, you need to configure them to establish communication and define monitoring rules. Here are the key configuration steps:

Wazuh server configuration: Edit the Wazuh server configuration file (/var/ossec/etc/ossec.conf) to specify settings such as network configuration, email notifications, log analysis rules, and integration with other security tools. Review the configuration file carefully and adjust it according to your needs.

Agent configuration: On each machine with a Wazuh agent, edit the agent configuration file (/var/ossec/etc/ossec.conf) to set parameters such as the server IP address, authentication key, and monitored log files. Customize the configuration based on the specific requirements of each agent.

Restart services: After making configuration changes, restart the Wazuh server and agent services to apply the new settings. Use the appropriate commands for your Linux distribution, such as systemctl restart wazuh or service wazuh restart.

Testing: Verify that the Wazuh server and agents are properly communicating. Check the Wazuh server logs (/var/ossec/logs/alerts/alerts.log) for any errors or issues. You can also trigger test events on the agent machines to ensure that logs are being collected and analyzed correctly.

Additional configuration: Wazuh provides numerous advanced configuration options, including file integrity monitoring, rootkit detection, and active response capabilities. Explore the Wazuh documentation to learn about these features and customize your setup further as needed.

2. Define Yara rules: Create Yara rules that specify the patterns or IOCs you want to detect. Yara rules can target specific file types, process names, strings, or behavior associated with known threats or suspicious activities. You can write your own Yara rules or leverage existing ones from trusted sources such as the Yara rules repository (https://github.com/Yara-Rules/rules).

3. Integrate Yara with Wazuh: Configure Wazuh to utilize Yara for threat detection. Wazuh has built-in support for Yara rules, allowing you to leverage the power of Yara within the Wazuh environment. Configure the Wazuh server to include Yara rules in its detection engine.

4. Deploy Yara rules to endpoints: Distribute the Yara rules to all Wazuh agents on the endpoints. This can be done through Wazuh's centralized management or by pushing the rules directly to the agents using a configuration management tool.

5. Monitor and analyze alerts: As Wazuh agents collect endpoint security events, the Wazuh server will analyze the events against the Yara rules. When a match is found, an alert is generated. Regularly monitor the alerts to identify potential threats or suspicious activities on your endpoints.

6. Investigate and respond: When an alert is triggered, investigate the corresponding endpoint to determine the nature and severity of the threat. Use the information provided by Wazuh, including the alert details and associated event logs, to analyze the potential impact and take appropriate action. This may involve isolating the affected system, collecting forensic evidence, or performing remediation steps.

7. Fine-tune rules: Periodically review and refine your Yara rules based on the feedback and results from the threat hunting process. Adjust the rules to reduce false positives or enhance detection capabilities as you gain more insights into the threats targeting your endpoints.

By combining Wazuh's monitoring capabilities with Yara's powerful rule matching, you can enhance your organization's ability to detect and respond to potential security threats on your endpoints. Regularly updating your Yara rules and staying up-to-date with the latest threat intelligence will help you stay ahead of emerging threats.