Wazuhを使ったアプリケーションの脅威検知とインシデントの管理

<!-- File integrity monitoring -->
<syscheck>
 
  [...]
 
  <!-- Frequency that syscheck is executed default every 12 hours -->
  <frequency>43200</frequency>
 
  [...]
 
  <!-- Directories to check  (perform all possible verifications) -->
  <directories>/etc,/usr/bin,/usr/sbin</directories>
  <directories>/bin,/sbin,/boot</directories>
 
  <!-- 監視したいアプリケーションのディレクトリ -->
  <directories realtime="yes">/var/www/html</directories>
 
  <!-- Files/directories to ignore -->
  <ignore>/etc/mtab</ignore>
  <ignore>/etc/hosts.deny</ignore>
  <ignore>/etc/mail/statistics</ignore>
  <ignore>/etc/random-seed</ignore>
  <ignore>/etc/random.seed</ignore>
  <ignore>/etc/adjtime</ignore>
  <ignore>/etc/httpd/logs</ignore>
  <ignore>/etc/utmpx</ignore>
  <ignore>/etc/wtmpx</ignore>
  <ignore>/etc/cups/certs</ignore>
  <ignore>/etc/dumpdates</ignore>
  <ignore>/etc/svc/volatile</ignore>
 
  <!-- 監視から除外したいアプリケーションのディレクトリ -->
  <ignore>/var/www/html/var/cache</ignore>
  <ignore>/var/www/html/var/sessions</ignore>
 
  <!-- File types to ignore -->
  <ignore type="sregex">.log$|.swp$</ignore>
 
  [...]
 
</syscheck>

sudo mkdir -p /tmp/yara/rules
sudo curl 'https://valhalla.nextron-systems.com/api/v1/get' \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
-H 'Accept-Language: en-US,en;q=0.5' \
--compressed \
-H 'Referer: https://valhalla.nextron-systems.com/' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-H 'DNT: 1' -H 'Connection: keep-alive' -H 'Upgrade-Insecure-Requests: 1' \
--data 'demo=demo&apikey=1111111111111111111111111111111111111111111111111111111111111111&format=text' \
-o /tmp/yara/rules/yara_rules.yar

#!/bin/bash
 
read INPUT_JSON
 
# YARA実行ファイルのパス
YARA_PATH=$(echo $INPUT_JSON | jq -r .parameters.extra_args[1])
# YARAルールファイルのパス
YARA_RULES=$(echo $INPUT_JSON | jq -r .parameters.extra_args[3])
# セキュリティイベントのトリガーとなったファイル
FILENAME=$(echo $INPUT_JSON | jq -r .parameters.alert.syscheck.path)
# ファイルのmtime
MTIME=$(echo $INPUT_JSON | jq -r .parameters.alert.syscheck.mtime_after)
MTIME_EPOCH=$(date --date=${MTIME} +"%s")
 
LOG_FILE="logs/active-responses.log"
 
# ファイル書き込み中の場合は完了するまで待機
size=0
actual_size=$(stat -c %s ${FILENAME})
while [ ${size} -ne ${actual_size} ]; do
    sleep 1
    size=${actual_size}
    actual_size=$(stat -c %s ${FILENAME})
done
 
mkdir -p /tmp/lock
LOCK_FILE="/tmp/lock/$(sha256sum ${FILENAME} | awk '{ print $1 }').lock"
 
# ロックファイルを使用して重複起動を回避
if [[ -f $LOCK_FILE ]]; then
    OLD_MTIME_EPOCH=$(cat $LOCK_FILE)
    if [ $((MTIME_EPOCH - OLD_MTIME_EPOCH)) -gt 30 ]; then
        echo "$MTIME_EPOCH" > $LOCK_FILE
    else
        exit 1
    fi
else
    touch $LOCK_FILE
    echo "$MTIME_EPOCH" > $LOCK_FILE
fi
 
if [[ ! $YARA_PATH ]] || [[ ! $YARA_RULES ]]; then
    echo "wazuh-yara: ERROR - Yara active response error. Yara path and rules parameters are mandatory." >> ${LOG_FILE}
    exit 1
fi
 
# YARAスキャンを実行
yara_output="$("${YARA_PATH}"/yara -w -r "$YARA_RULES" "$FILENAME")"
 
if [[ $yara_output != "" ]]; then
    # マッチしたルールを一つずつログファイルに出力
    while read -r line; do
        echo "wazuh-yara: INFO - Scan result: $line" >> ${LOG_FILE}
    done <<< "$yara_output"
fi
 
exit 0

<group name="syscheck,">
  <rule id="100200" level="7">
    <if_sid>550</if_sid>
    <field name="file">/var/www/html/</field>
    <description>File modified in the app directory.</description>
  </rule>
  <rule id="100201" level="7">
    <if_sid>554</if_sid>
    <field name="file">/var/www/html/</field>
    <description>File added to the app directory.</description>
  </rule>
</group>

<ossec_config>
 
  [...]
 
  <command>
    <name>yara_linux</name>
    <executable>yara.sh</executable>
    <extra_args>-yara_path /usr/local/bin -yara_rules /tmp/yara/rules/yara_rules.yar</extra_args>
    <timeout_allowed>no</timeout_allowed>
  </command>
 
  <active-response>
    <disabled>no</disabled>
    <!-- 実行するコマンド名 -->
    <command>yara_linux</command>
    <!-- コマンドを実行する場所（localはセキュリティイベントが発生したサーバーを表す） -->
    <location>local</location>
    <!-- 指定したルールIDに関わるセキュリティイベントの場合のみコマンドを実行する -->
    <rules_id>100200,100201</rules_id>
  </active-response>
 
  [...]
 
</ossec_config>

<ossec_config>
 
  [...]
 
  <!-- 下記ファイルをログ収集対象に追加 -->
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>
 
  [...]
 
</ossec_config>

<decoder name="yara_decoder">
  <prematch>wazuh-yara:</prematch>
</decoder>
 
<decoder name="yara_decoder1">
  <parent>yara_decoder</parent>
  <regex>wazuh-yara: (\S+) - Scan result: (\S+) (\S+)</regex>
  <!-- 上の正規表現のキャプチャグループと対になるラベル -->
  <order>log_type, yara_rule, yara_scanned_file</order>
</decoder>

<group name="yara,">
  <rule id="108000" level="0">
    <decoded_as>yara_decoder</decoded_as>
    <description>Yara grouping rule</description>
  </rule>
  <rule id="108001" level="12">
    <if_sid>108000</if_sid>
    <match>wazuh-yara: INFO - Scan result: </match>
    <description>File "$(yara_scanned_file)" is a positive match. Yara rule: $(yara_rule)</description>
    <group>malware,incident,</group>
  </rule>
</group>

curl https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai --output /var/www/html/html/upload/mirai

cd /tmp/ && curl -LO https://rules.emergingthreats.net/open/suricata-6.0.8/emerging.rules.tar.gz
sudo tar -xvzf emerging.rules.tar.gz && sudo mkdir /etc/suricata/rules && sudo mv rules/*.rules /etc/suricata/rules/
sudo chmod 640 /etc/suricata/rules/*.rules

vars:
  address-groups:
    HOME_NET: "＜エンドポイントのIPアドレス＞"
 
af-packet:
  - interface: "＜監視したいネットワークインターフェース（例：eth0）＞"
 
rule-files:
  - "*.rules"

<ossec_config>
 
  [...]
 
  <localfile>
    <log_format>json</log_format>
    <location>/var/log/suricata/eve.json</location>
  </localfile>
 
  [...]
 
</ossec_config>

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Possible Malicious Outbound Activity"; flow:to_server; flags: S,12; threshold: type both, track by_src, count 30, seconds 60; classtype:misc-activity; sid:1000001; rev:1; metadata: severity high;)

<group name="ids,suricata,">
  <rule id="86611" level="9">
    <if_sid>86601</if_sid>
    <field name="alert.metadata.severity" type="pcre2">\["high"\]</field>
    <description>Suricata: Alert - $(alert.signature)</description>
    <group>alert,</group>
  </rule>
</group>

eccube.log.formatter.line:
  class: Monolog\Formatter\LineFormatter
  arguments:
      - "%%datetime%% ECCUBE: %%channel%%.%%level_name%% [%%extra.ip%%] [%%extra.session_id%%] [%%extra.uid%%] [%%extra.user_id%%] [%%extra.class%%:%%extra.function%%:%%extra.line%%] - %%message%% [%%extra.http_method%%, %%extra.url%%, %%extra.referrer%%, %%extra.user_agent%%]\n"

2024-09-01T00:00:00.000000+09:00 ECCUBE: security.INFO [192.168.1.1] [d0254ab9] [5345b59] [N/A] [Symfony\Component\Security\Http\Authentication\AuthenticatorManager:handleAuthenticationFailure:251] - Authenticator failed.  [POST, /mypage/login, http://example.com/mypage/login, Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36]

<ossec_config>
 
  [...]
 
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/www/html/var/log/prod/*.log</location>
  </localfile>
 
  [...]
 
</ossec_config>

<decoder name="eccube-security-info">
  <type>syslog</type>
  <program_name>ECCUBE</program_name>
  <prematch>security.INFO </prematch>
  <regex offset="after_prematch" type="pcre2">\[(\S*)\] \[(\S*)\] \[(\S*)\] \[(\S*)\] (.*)</regex>
  <order>srcip,session_id,uid,user_id,message</order>
</decoder>

<group name="syslog,eccube,">
  <rule id="100400" level="3">
    <decoded_as>eccube-security-info</decoded_as>
    <description>EC-CUBE security information.</description>
  </rule>
 
  <rule id="100401" level="5">
    <if_sid>100400</if_sid>
    <field name="message">Authenticator failed</field>
    <description>eccube: Authentication failed.</description>
    <group>authentication_failed,</group>
  </rule>
 
  <rule id="100402" level="3">
    <if_sid>100400</if_sid>
    <field name="message">Authenticator successful</field>
    <description>eccube: Authentication succeeded.</description>
    <group>authentication_success,</group>
  </rule>
</group>

<group name="syslog,eccube,">
 
  [...]
 
  <rule id="100401" level="5">
    [...]
    <options>no_log</options>
  </rule>
 
  <rule id="100402" level="3">
    [...]
    <options>no_log</options>
  </rule>
 
  <rule id="100403" level="7" frequency="10" timeframe="120">
    <if_matched_group>authentication_failed</if_matched_group>
    <same_srcip />
    <description>eccube: Too many login attempts from the same IP address</description>
    <group>authentication_failures,attack,alert,</group>
  </rule>
</group>

coraza_waf {
  load_owasp_crs
  directives `
  Include @coraza.conf-recommended
  Include @crs-setup.conf.example
  Include @owasp_crs/*.conf
  SecDefaultAction "phase:3,log,auditlog,pass"
  SecDefaultAction "phase:4,log,auditlog,pass"
  SecDefaultAction "phase:5,log,auditlog,pass"
  SecRuleEngine On
  SecDebugLog /dev/stdout
  SecDebugLogLevel 9
  SecRule REMOTE_ADDR "@ipMatchFromFile /caddy/banned_ips" "id:101,phase:1,t:lowercase,deny,status:403"
  SecRule REQUEST_URI "@streq /admin" "id:102,phase:1,t:lowercase,deny,status:403"
  SecRule REQUEST_BODY "@rx maliciouspayload" "id:103,phase:2,t:lowercase,deny,status:403"
  SecRule RESPONSE_STATUS "@rx 406" "id:104,phase:3,t:lowercase,deny,status:403"
  SecResponseBodyAccess On
  SecResponseBodyMimeType application/json
  SecRule RESPONSE_BODY "@contains responsebodycode" "id:105,phase:4,t:lowercase,deny,status:403"
  `
}

SecRule REMOTE_ADDR "@ipMatchFromFile /caddy/banned_ips" "id:101,phase:1,t:lowercase,deny,status:403"

#!/bin/bash
 
read INPUT_JSON
 
BANNED_IPS_FILE="/caddy/banned_ips"
 
ip_address=$(echo $INPUT_JSON | sed 's/\\/\\\\/g' | jq -r .parameters.alert.data.srcip)
 
echo "$ip_address" >> "$BANNED_IPS_FILE"
 
# ファイルの更新を反映させるためにWebサーバーの再起動
rc-service caddy restart
 
exit 0;

<ossec_config>
 
  [...]
 
  <command>
    <name>ip_block</name>
    <executable>ip-block.sh</executable>
    <extra_args></extra_args>
    <timeout_allowed>no</timeout_allowed>
  </command>
 
  <active-response>
    <disabled>no</disabled>
    <command>ip_block</command>
    <!-- コマンドを実行するエンドポイントを直接指定 -->
    <location>defined-agent</location>
    <agent_id>＜エンドポイント（Webサーバー）のエージェントID＞</agent_id>
    <!-- 最大試行回数超過のルールID -->
    <rules_id>100403</rules_id>
  </active-response>
 
  [...]
 
</ossec_config>

#!/usr/bin/python3
 
import json
import logging
import sys
import os
 
try:
    import requests
except ModuleNotFoundError:
    print("No module 'requests' found. Install: pip install requests")
    sys.exit(1)
 
LOG_FILE = '/var/ossec/logs/integrations.log'
 
def main(args):
    alert_file_location = args[1]
    with open(alert_file_location) as alert_file:
        json_alert = json.load(alert_file)
 
    try:
        agent_id = json_alert['agent']['id']
        alert_level = json_alert['rule']['level']
        description = json_alert['rule']['description']
 
        api_key = args[2]
        hook_url = args[3]
 
        message: str = generate_message(json_alert)
 
        if not message:
            return
 
        send_message(message, api_key, hook_url)
    except json.JSONDecodeError as json_error:
        logging.error(f"Error decoding JSON: {str(json_error)}")
    except KeyError as key_error:
        logging.error(f"Key not found in JSON: {str(key_error)}")
    except FileNotFoundError:
        logging.error("Alerts file not found")
    except Exception as e:
        logging.error(f"Error processing alerts: {str(e)}")
 
 
def generate_message(alert: any) -> str:
    level = alert['rule']['level']
 
    if level <= 7:
        severity = 1
    elif level >= 8 and level <= 12:
        severity = 2
    else:
        severity = 3
 
    message = {
        'severity': severity,
        'title': alert['rule']['description'] if 'description' in alert['rule'] else 'N/A',
        'text': alert.get('full_log'),
        'rule_id': alert['rule']['id'],
        'timestamp': alert['timestamp'],
        'id': alert['id'],
        'all_fields': alert,
    }
 
    return json.dumps(message)
 
 
def send_message(message: str, api_key: str, hook_url: str) -> None:
    headers = {'Content-Type': 'application/json', 'Accept': 'application/json', 'X-ApiKey': api_key}
    res = requests.post(hook_url, data=message, headers=headers, timeout=10)
 
 
if __name__ == "__main__":
    try:
        logging.basicConfig(filename=LOG_FILE, level=logging.INFO, format='%(asctime)s - %(levelname)s: %(message)s', datefmt='%Y-%m-%d %H:%M:%S')
        main(sys.argv)
    except Exception as e:
        logging.error(str(e))
        raise

<ossec_config>
 
  [...]
 
  <integration>
    <name>custom-n8n</name>
    <hook_url>＜n8nのWebフックURL＞</hook_url>
    <!-- ルールレベルが7以上のイベントのみ送信 -->
    <level>7</level>
    <alert_format>json</alert_format>
    <api_key>＜n8nで設定したAPIキー＞</api_key>
    <!-- 下記グループのイベントのみ送信 -->
    <group>malware,ids,attack,attacks,</group>
  </integration> 
 
  [...]
 
</ossec_config>

import sys
import json
import os
 
from pocketbase import PocketBase
 
event = json.loads(sys.argv[1])
body = json.loads(event["body"])
 
client = PocketBase('http://0.0.0.0:8090')
client.auth_store.save(token=os.environ["CATALYST_TOKEN"])
 
severity = "Medium" if body["severity"] == 1 else "High"
groups = body["groups"].split(",")
type = "incident" if "incident" in groups else "alert"
 
if type:
  client.collection("tickets").create({
    "name": body["name"],
    "description": body["description"],
    "state": { "severity": severity }, 
    "type": type,
    "open": True,
  })

const notification = {}
const severity = ['Medium', 'High', 'Critical']
 
for (const item of $('Recieve security event from Wazuh').all()) {
  notification.severity = severity[parseInt(item.json.body.severity) - 1]
  notification.title = item.json.body.title
  // ログのデコーダーがjsonの場合はJSON形式のログにインデントを付けて見やすいように整形
  notification.log = item.json.body.all_fields.decoder.name === 'json' ? JSON.stringify(JSON.parse(item.json.body.text), null, 2) : item.json.body.text
  notification.isIncident = item.json.body.all_fields.rule.groups.some(g => g === 'incident')
}
 
return [notification]

** {{ $json.isIncident ? ':fire: ' : ':rotating_light:' }}[{{ $json.severity }}]{{ $json.title }} **

> {{ $json.log }}