Welcome to OS Analysis with OSSEC. My name is Michael Edie, and in
this course, we'll look at how we can monitor OS activity using OSSEC.
This is not an introductory course, so I won't cover things like
installation or basic configuration.
However, I will talk about and demonstrate how we can leverage OSSEC to help
detect malicious activity on various endpoint systems.
When an adversary gains access to a system,
they will typically try to ensure that they can keep their
access until they have achieved their objective.
One of the ways they maintain access is by creating
accounts on systems they've compromised.
The hope is that in large environments, accounts are created and expire
frequently enough that they can fly under the radar undetected.
If we look at the MITRE ATT&CK framework, under the persistence
tactic, we have the Create Account technique. We will be looking at
how OSSEC can help us detect the sub technique,
Create Local Account. The discussion and follow‑up demo will involve a
Microsoft Windows system and a Linux workstation.
Another great reference is MITRE SHIELD, which is a knowledge base of
proactive defense tactics and techniques defenders can use to help
harden their networks and reduce adversary dwell time. When it comes to
the Create Local Account technique, having a good grasp of your
organization's change control process can pay dividends. For example,
think about your environment.
If a user account is created, do you get an alert?
Well, depending on the size of your organization, alerting
on every account created is untenable.
So then how do you know if an account is created legitimately or maliciously?
Do you have the proper checks and balances that can be verified at speed?
Well,
MITRE SHIELD suggests that you develop a process for user account
creation that allows your security team to rapidly detect accounts
created outside of that organizational process.
Next,
we will look at how OSSEC can detect user account creation on a
Microsoft Windows system. On the screen is a snippet from one of the
many OSSEC alert rules that come bundled by default.
This is the specific rule that is designed to alert when
the user account is created or updated.
It works by looking for one of four event IDs. The first two provide
coverage of Windows Server 2003 and older systems,
while the latter half belongs to modern day versions of Windows.
Hopefully you don't have a business need for the legacy systems,
but the rule will trigger for those systems as well.