Let's go into the Wazuh Kibana UI.
You could find the Wazuh URL in notes number 7.
If you see an invalid certificate warning,
that is expected, as this is a local environment.
Okay, we see there was a admin UI here.
Let's go ahead and put in the username and password of admin and admin.
Of course,
you wouldn't be leveraging these default credentials in a non‑local environment.
Oh, wow, nice.
So we see one connected agent.
That must be the victim's machine.
Let's go ahead and click on Total agents.
Okay,
here we see the victim's agent. We see a little bit more of a granular view.
Let's go ahead and drill into the victim a little bit more.
Okay, so here we see some pretty graphs.
Let's go ahead and click on Security events.
Further, we need to click on the Events tab. As we scroll down
here, we see this interesting alert, Listened ports status
(netstat) changed (new port opened or closed).
Hmmm.
I wonder what that is.
Let's go ahead and click on the triangle here and drill down a little
bit more. Further, we'll go ahead and click on View single document so
we can see this a little bit more close up.
Note the previous_log and the full_log.
It's evident that the listening port of the Merlin agent tripped
this alert. For stealth, you should change the binary's name to be
something that wouldn't be so suspicious.
An example could be update checker.
Let's mount some more attacks by Merlin and see how
Wazuh and Suricata both respond.