How to monitorize program execution on Windows using Wazuh and sysmon.
Tags: security, windows, wazuh, opensource
Published: 2020-09-25 14:54:18

A few months ago I wrote a post in the Wazuh blog describing [how to monitoring root actions on Linux systems using auditd and Wazuh](https://wazuh.com/blog/monitoring-root-actions-on-linux-using-auditd-and-wazuh/) which had been useful for a lot of users. Nevertheless, I've been asked by a slack community user how to do something similar on Windows and I've found the solution may be a little bit tricky.

I'm writing this post sharing with you the solution I've proposed to this user in order to leave it in writing and have it at hand if someone needs it in the future.

# Sysmon

My proposal was simple: use Sysmon, a (and I'm quoting Microsoft documentation) Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log which It provides detailed information about process creations among other things.

But, how does Sysmon integrates with [Wazuh?](https://documentation.wazuh.com/3.13/getting-started/)

Okay, there is [an interesting post](https://wazuh.com/blog/how-to-collect-windows-events-with-wazuh/) in Wazuh blog talking about Sysmon and how to install and integrate it with Wazuh, but it described a particular case where the execution of a concrete program is realized.

As we want to track every program execution in the system (As a starting point, of course, we could filter the data in one way or another and we won't generate alerts for every single program execution!), we need a different Sysmon config.

So what do we do?

Install Sysmon as described in [Microsoft documentation](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon) and configure it according to our needs. I recommend using it as a base [this Sysmon configuration](https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml) which is well documented and available at GitHub. It has some exceptions for the Sysmon event with ID 1 (process creation) which is the one we want to track.

After enabling Sysmon on our system, we will start receiving events on the event viewer for program executions (on the Sysmon folder, like it is shown in the image)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/dlz60eni132lksc1ewm3.png)

Now, we will need to include this to our Wazuh Windows Agent configuration (`ossec.conf`) to make it analyze those Sysmon logs:

```xml
Microsoft-Windows-Sysmon/Operational eventchannel
```

And, in order to generate alerts, add to our manager custom rules (`/var/ossec/etc/local_rules.xml`):

```xml
sysmon_event1 Process creation detected: $(win.eventdata.description) by $(win.eventdata.user)
```

Naturally, this will generate alerts for every single process created on the system (with the exception of those that we filter in the Sysmon configuration). My advice over here would be to receive an alert of level 3 for all command execution (maybe filtering with Sysmon that program that doesn't matter to us) and child alerts with a severer level for more unusual programs.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/za7y9jvav38qhpxh987p.png)

For example:


```xml
sysmon_event1 mimikatz.exe Malicious program process creation detected: $(win.eventdata.description) by $(win.eventdata.user)
```

Here, an example of a complete alert generated by Wazuh using Sysmon:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/hgrj248nzuwc7x4bivr8.png)

And that's all.

## Extra: Legacy systems.

What if my system is old and doesn't support sysmon? Another way could be to enable a security system policy to track program execution:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/cna55r2m5qqwss7wbep1.png)
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/z4zfb81bm1l1xn3rp99s.png)

And enable eventlog data collection on Wazuh Windows Agent configuration:

```xml
Security eventlog
```

And a custom rule on your manager:

```
18104 Process started on windows server 4688
```

With these steps you could generate another simpler but awesome alert like this one:

```
** Alert 1601034144.2471775: - local,syslog,sshd,
2020 Sep 25 11:42:24 (windows) any->WinEvtLog
Rule: 100009 (level 5) -> 'Process started on windows server'
User: (no user)
2020 Sep 25 11:42:21 WinEvtLog: registry: AUDIT_SUCCESS(4688): Microsoft-Windows-Security-Auditing: (no user): no domain: windows: S-1-5-21-3469229866-3176928381-1688825521-1000 vagrant WINDOWS 0x3fce6 0x1240 C:\Program Files (x86)\Internet Explorer\iexplore.exe %%1936 0xd9c ? S-1-0-0 - - 0x0 C:\Program Files\internet explorer\iexplore.exe S-1-16-12288
type: registry
```

It would be easy as well to create child rules for more concrete security events.

And that is all! I hope you've found this post useful. If you need help with something don't doubt to ask here or open a thread in Wazuh slack channel, someone would be glad to help you!