Hello again.
In this demo, we'll look at a custom rule I created on the OSSEC server that
detects new scheduled tasks on modern Windows systems.
Then,
since scheduled tasks login is not enabled by default on Windows workstations,
I'll show you the highlights of how to enable login
using the local group policy editor.
Once these two tasks are complete,
I will create a scheduled task and observe the artifacts sent
to the OSSEC alert log. Let's get started.
I am remotely connected to the command line interface of the OSSEC server.
Our custom rule is located under /var/ossec/rules/ in the local_rules.xml file.
Let's take a look at the contents and ensure it's active and reflects the
details we need. Here we are. Remember, disabled rules have their level set
to 0, or the rule is completely commented out.
This rule looks good, so now we can close this file and switch to the
Windows workstation and make some configuration changes. The event ID
4698 is not always logged by default when a scheduled task is created
on Windows workstations. There is a two‑step process for rectifying
this problem.
The first step is to tell Windows to enforce subcategory audit
settings. In an Active Directory environment, you would do
this using group policy. However,
I'll be using the local group policy editor, but the configuration
settings are the same when creating a GPO. The second step is to
enable auditing of other object access events.
Okay,
now I'll switch to a terminal with an admin PowerShell session and put
on an adversary hat. On the screen, we have the syntax for creating a
scheduled task from the command line.
This scheduled task will download and execute a malicious
PowerShell payload at every logon as the system account. If
you ever see this in your environment, it might not be a good day.
If I press Enter, voila, a good day for the attacker so far.
Now, let's jump back over to the OSSEC server and check the alert logs.
Here we are.
Now we can use the tail command to view the latest alert logs,
which should contain the scheduled task created.
Beautiful.
We can see the name of the scheduled task,
the workstation name, and which OSSEC agent captured the event.
Unfortunately, OSSEC does not come with a web user interface for
monitoring alerts, and OSSEC recommends shipping the logs to a sim
with a graphical component if you want that functionality. That's it
for this clip, thanks for watching.