In the last clip, we looked at the OSSEC rules for user
account creation on a Windows workstation.
Now, we will turn to the rules for user account creation on a
Linux system. I want to remind you that these are default rules
and are not customized after installation.
So how does this rule work?
Well, to start, there are two rules listed on the screen.
They both leverage the OSSEC log analysis engine to
match user account creation artifacts.
The rule at the bottom triggers when a user account is added
to the system, and the rule at the top triggers when a group
account is added to the system.
In Linux, when you create a user account, the
corresponding group is automatically created.
It is also important to note that user groups can be created independently,
therefore, having the rule at the top complements the user
account creation rule at the bottom.
Okay,
so let's jump into a demo and see all of this in action. First, we
will check if the Linux account creation rule is active on the OSSEC
server and then switch over to a Linux workstation where we'll create
a user account and then we will move back to the OSSEC server and
observe the alert logs.
This is the command line interface of a remote SSH session on the OSSEC server.
I'm going to look at the syslog_rules.xml file, and check
if the account creation rule is enabled.
The XML comments make it easy to identify sections of the rule file, and
we can see pretty quickly that our rule is enabled.
Remember, a rule is disabled if it's either commented out or the level equals 0.
Now let's use the tail command once again to read from
the end of the OSSEC alert log file.
I'm going to switch my terminal tab and bring up the SSH shell
that's connected to the Linux workstation.
Okay, notice my command shell has changed.
I'm going to put on my cyber adversary hat and execute my backdoor shell
script that will create a user account on the system.
Okay,
now we can switch back to the previous terminal and
check for a corresponding alert.
Fantastic.
We have two new alerts.
The first is the new group added to the system and below
that there's the new user creation alert.
The alert provides us with the agent name,
the IP address of the system, and we get the username of the
account created and a few associated details.
This is much less verbose than the Windows alerts, but it still
provides the information we need for this task.
However,
I wish these alerts included the source account, but for now, you would have
to go to the host and investigate and find out that detail.