Blocking Attacks with Active Response in Wazuh#

1
flowchart TB
2
    subgraph "Threat Detection"
3
        T1[Security Event]
4
        T2[Log Analysis]
5
        T3[Rule Match]
6
    end
7

8
    subgraph "Wazuh Manager"
9
        D1[Decoder Processing]
10
        R1[Rule Engine]
11
        AR1[Active Response Trigger]
12
        C1[Command Selection]
13
    end
14

15
    subgraph "Active Response"
16
        E1[Execute Local]
17
        E2[Execute on Agent]
18
        E3[Execute on Server]
19
        E4[Execute Everywhere]
20
    end
21

22
    subgraph "Response Actions"
23
        A1[Block IP]
24
        A2[Kill Process]
25
        A3[Delete File]
26
        A4[Custom Script]
27
    end
28

29
    subgraph "Management"
30
        M1[Timeout Control]
31
        M2[Whitelist Check]
32
        M3[Response Logging]
33
    end
34

35
    T1 --> T2
36
    T2 --> T3
37
    T3 --> D1
38
    D1 --> R1
39
    R1 --> AR1
40
    AR1 --> C1
41

42
    C1 --> E1
43
    C1 --> E2
44
    C1 --> E3
45
    C1 --> E4
46

47
    E1 --> A1
48
    E2 --> A2
49
    E3 --> A3
50
    E4 --> A4
51

52
    AR1 --> M1
53
    AR1 --> M2
54
    A1 --> M3
55

56
    style T1 fill:#ff6b6b
57
    style AR1 fill:#4dabf7
58
    style A1 fill:#51cf66

1
** Alert 1461258591.68247: mail - syslog,sshd,authentication_failures,pci_dss_11.4,pci_dss_10.2.4,pci_dss_10.2.5,
2
2016 Apr 21 17:09:51 (LinAgent) 10.0.0.5->/var/log/auth.log
3
Rule: 5712 (level 10) -> 'SSHD brute force trying to get access to the system.'
4
Src IP: 10.0.0.6
5
Apr 21 17:09:49 LinAgent sshd[1336]: Invalid user ec2-user from 10.0.0.6
6
Apr 21 17:09:46 LinAgent sshd[1334]: Invalid user ec2-user from 10.0.0.6
7
...

1
<ossec_config>
2
  <!-- Block and notify -->
3
  <active-response>
4
    <command>firewall-drop</command>
5
    <location>local</location>
6
    <rules_id>5712</rules_id>
7
    <timeout>3600</timeout>
8
  </active-response>
9

10
  <active-response>
11
    <command>mail-notify</command>
12
    <location>server</location>
13
    <rules_id>5712</rules_id>
14
  </active-response>
15

16
  <!-- Kill malicious processes -->
17
  <active-response>
18
    <command>kill-process</command>
19
    <location>local</location>
20
    <rules_id>100200</rules_id>
21
  </active-response>
22
</ossec_config>

1
<ossec_config>
2
  <active-response>
3
    <command>firewall-drop</command>
4
    <location>local</location>
5
    <rules_id>5712</rules_id>
6
    <timeout>1800</timeout>
7
    <repeated_offenders>3600,7200,86400</repeated_offenders>
8
  </active-response>
9
</ossec_config>

1
#!/bin/bash
2
# test-active-response.sh - Test active response configuration
3

4
# Test command execution
5
/var/ossec/bin/agent_control -b 192.168.1.100 -f firewall-drop -r 5712
6

7
# Check if IP was blocked
8
iptables -L INPUT -n | grep 192.168.1.100
9

10
# Test timeout
11
sleep 1805  # Wait for timeout + 5 seconds
12

13
# Verify IP was unblocked
14
iptables -L INPUT -n | grep 192.168.1.100

1
Implementation Phases:
2
  Phase 1 - Monitoring:
3
    - Deploy active response in alert-only mode
4
    - Log actions without executing
5
    - Analyze potential impact
6

7
  Phase 2 - Limited Deployment:
8
    - Enable on non-critical systems
9
    - Short timeout periods (300-600 seconds)
10
    - Monitor false positives
11

12
  Phase 3 - Production:
13
    - Enable on all systems
14
    - Appropriate timeout periods
15
    - Implement repeated offenders
16

17
  Phase 4 - Advanced:
18
    - Custom response scripts
19
    - Integration with other tools
20
    - Automated remediation

1
#!/usr/bin/env python3
2
# manage-whitelist.py - Manage active response whitelist
3

4
import ipaddress
5
import yaml
6
import subprocess
7

8
class WhitelistManager:
9
    def __init__(self, config_file='/etc/ossec-whitelist.yaml'):
10
        self.config_file = config_file
11
        self.load_whitelist()
12

13
    def load_whitelist(self):
14
        """Load whitelist from YAML file"""
15
        with open(self.config_file, 'r') as f:
16
            self.whitelist = yaml.safe_load(f)
17

18
    def add_ip(self, ip, reason, expires=None):
19
        """Add IP to whitelist"""
20
        entry = {
21
            'ip': ip,
22
            'reason': reason,
23
            'added': datetime.now().isoformat(),
24
            'expires': expires
25
        }
26

27
        self.whitelist['ips'].append(entry)
28
        self.save_whitelist()
29
        self.update_ossec_config()
30

31
    def remove_expired(self):
32
        """Remove expired whitelist entries"""
33
        current_time = datetime.now()
34

35
        self.whitelist['ips'] = [
36
            entry for entry in self.whitelist['ips']
37
            if not entry.get('expires') or
38
               datetime.fromisoformat(entry['expires']) > current_time
39
        ]
40

41
        self.save_whitelist()
42
        self.update_ossec_config()
43

44
    def update_ossec_config(self):
45
        """Update OSSEC configuration with whitelist"""
46

47
        # Generate whitelist XML
48
        whitelist_xml = ""
49
        for entry in self.whitelist['ips']:
50
            whitelist_xml += f"    <white_list>{entry['ip']}</white_list>\n"
51

52
        # Update ossec.conf
53
        # (Implementation depends on your config management approach)
54

55
        # Restart OSSEC
56
        subprocess.run(['systemctl', 'restart', 'wazuh-manager'])
57

58
# Example whitelist YAML format:
59
"""
60
ips:
61
  - ip: 10.0.0.10
62
    reason: Management server
63
    added: 2023-01-01T00:00:00
64

65
  - ip: 192.168.1.0/24
66
    reason: Internal network
67
    added: 2023-01-01T00:00:00
68

69
  - ip: 203.0.113.50
70
    reason: Temporary vendor access
71
    added: 2023-06-01T00:00:00
72
    expires: 2023-06-30T00:00:00
73
"""

1
<!-- Detect and respond to ransomware -->
2
<rule id="100400" level="15">
3
  <if_group>syscheck</if_group>
4
  <match>\.encrypted|\.locked|\.crypto</match>
5
  <description>Possible ransomware activity detected</description>
6
</rule>
7

8
<command>
9
  <name>ransomware-response</name>
10
  <executable>ransomware-response.sh</executable>
11
  <timeout_allowed>no</timeout_allowed>
12
</command>
13

14
<active-response>
15
  <command>ransomware-response</command>
16
  <location>local</location>
17
  <rules_id>100400</rules_id>
18
</active-response>

1
#!/bin/bash
2
# ransomware-response.sh - Emergency ransomware response
3

4
ACTION=$1
5
USER=$2
6
IP=$3
7
ALERTID=$4
8
RULEID=$5
9

10
if [ "$ACTION" = "add" ]; then
11
    # Isolate system
12
    iptables -I INPUT -j DROP
13
    iptables -I OUTPUT -j DROP
14

15
    # Allow only management access
16
    iptables -I INPUT -s 10.0.1.0/24 -j ACCEPT
17

18
    # Kill suspicious processes
19
    pkill -f ".encrypted|.locked|.crypto"
20

21
    # Disable scheduled tasks
22
    systemctl stop crond
23

24
    # Alert administrators
25
    echo "RANSOMWARE DETECTED on $(hostname)" | \
26
        mail -s "CRITICAL: Ransomware Alert" security@company.com
27

28
    # Initiate backup
29
    /usr/local/bin/emergency-backup.sh &
30
fi

1
<!-- Block web application attacks -->
2
<rule id="100410" level="10" frequency="5" timeframe="60">
3
  <if_group>web|attack</if_group>
4
  <same_source_ip />
5
  <description>Multiple web application attacks from same IP</description>
6
</rule>
7

8
<command>
9
  <name>nginx-ban</name>
10
  <executable>nginx-ban.py</executable>
11
  <timeout_allowed>yes</timeout_allowed>
12
</command>
13

14
<active-response>
15
  <command>nginx-ban</command>
16
  <location>local</location>
17
  <rules_id>100410</rules_id>
18
  <timeout>3600</timeout>
19
</active-response>

1
#!/usr/bin/env python3
2
# nginx-ban.py - Ban IPs in Nginx
3

4
import sys
5
import os
6
import subprocess
7

8
NGINX_BLOCKED_CONF = "/etc/nginx/blocked_ips.conf"
9
NGINX_RELOAD_CMD = ["nginx", "-s", "reload"]
10

11
def add_block(ip):
12
    """Add IP to Nginx blocked list"""
13

14
    # Add deny rule
15
    with open(NGINX_BLOCKED_CONF, 'a') as f:
16
        f.write(f"deny {ip};\n")
17

18
    # Reload Nginx
19
    subprocess.run(NGINX_RELOAD_CMD)
20

21
def remove_block(ip):
22
    """Remove IP from Nginx blocked list"""
23

24
    # Read current blocks
25
    with open(NGINX_BLOCKED_CONF, 'r') as f:
26
        lines = f.readlines()
27

28
    # Remove the IP
29
    with open(NGINX_BLOCKED_CONF, 'w') as f:
30
        for line in lines:
31
            if f"deny {ip};" not in line:
32
                f.write(line)
33

34
    # Reload Nginx
35
    subprocess.run(NGINX_RELOAD_CMD)
36

37
if __name__ == "__main__":
38
    action = sys.argv[1]
39
    ip = sys.argv[3]
40

41
    if action == "add":
42
        add_block(ip)
43
    elif action == "delete":
44
        remove_block(ip)

1
#!/usr/bin/env python3
2
# vulnerability-patch.py - Automated patching response
3

4
import sys
5
import subprocess
6
import logging
7
import json
8

9
class VulnerabilityPatcher:
10
    def __init__(self):
11
        self.patches = {
12
            '100500': self.patch_shellshock,
13
            '100501': self.patch_heartbleed,
14
            '100502': self.patch_log4j
15
        }
16

17
    def patch_shellshock(self):
18
        """Patch Shellshock vulnerability"""
19
        commands = [
20
            ["yum", "update", "-y", "bash"],
21
            ["apt-get", "update"],
22
            ["apt-get", "install", "-y", "bash"]
23
        ]
24

25
        for cmd in commands:
26
            try:
27
                subprocess.run(cmd, check=True)
28
                return True
29
            except:
30
                continue
31

32
        return False
33

34
    def patch_log4j(self):
35
        """Mitigate Log4j vulnerability"""
36

37
        # Set system property
38
        with open('/etc/environment', 'a') as f:
39
            f.write('\nLOG4J_FORMAT_MSG_NO_LOOKUPS=true\n')
40

41
        # Find and update log4j configurations
42
        result = subprocess.run(
43
            ["find", "/", "-name", "log4j*.properties"],
44
            capture_output=True,
45
            text=True
46
        )
47

48
        for config_file in result.stdout.strip().split('\n'):
49
            if config_file:
50
                # Add mitigation to config
51
                with open(config_file, 'a') as f:
52
                    f.write('\nlog4j2.formatMsgNoLookups=true\n')
53

54
        return True
55

56
    def execute_patch(self, rule_id):
57
        """Execute patch based on rule ID"""
58

59
        if rule_id in self.patches:
60
            logging.info(f"Executing patch for rule {rule_id}")
61

62
            success = self.patches[rule_id]()
63

64
            if success:
65
                logging.info(f"Successfully patched vulnerability {rule_id}")
66
                self.notify_success(rule_id)
67
            else:
68
                logging.error(f"Failed to patch vulnerability {rule_id}")
69
                self.notify_failure(rule_id)
70
        else:
71
            logging.warning(f"No patch available for rule {rule_id}")
72

73
    def notify_success(self, rule_id):
74
        """Notify successful patching"""
75
        message = f"Vulnerability {rule_id} successfully patched on {subprocess.run(['hostname'], capture_output=True, text=True).stdout.strip()}"
76
        subprocess.run(["mail", "-s", "Patch Success", "security@company.com"], input=message.encode())
77

78
    def notify_failure(self, rule_id):
79
        """Notify patching failure"""
80
        message = f"Failed to patch vulnerability {rule_id} on {subprocess.run(['hostname'], capture_output=True, text=True).stdout.strip()}"
81
        subprocess.run(["mail", "-s", "Patch Failure - Manual Intervention Required", "security@company.com"], input=message.encode())
82

83
if __name__ == "__main__":
84
    action = sys.argv[1]
85
    rule_id = sys.argv[5]
86

87
    if action == "add":
88
        patcher = VulnerabilityPatcher()
89
        patcher.execute_patch(rule_id)

1
#!/usr/bin/env python3
2
# ar-metrics.py - Collect active response metrics
3

4
import json
5
import sqlite3
6
from datetime import datetime, timedelta
7
from collections import defaultdict
8

9
class ActiveResponseMetrics:
10
    def __init__(self, db_path='/var/ossec/stats/ar_metrics.db'):
11
        self.conn = sqlite3.connect(db_path)
12
        self.create_tables()
13

14
    def create_tables(self):
15
        """Create metrics tables"""
16

17
        self.conn.execute('''
18
            CREATE TABLE IF NOT EXISTS ar_executions (
19
                id INTEGER PRIMARY KEY,
20
                timestamp DATETIME,
21
                rule_id INTEGER,
22
                command TEXT,
23
                source_ip TEXT,
24
                action TEXT,
25
                status TEXT,
26
                error TEXT
27
            )
28
        ''')
29

30
        self.conn.execute('''
31
            CREATE TABLE IF NOT EXISTS ar_effectiveness (
32
                date DATE PRIMARY KEY,
33
                total_blocks INTEGER,
34
                repeat_offenders INTEGER,
35
                false_positives INTEGER,
36
                avg_block_duration REAL
37
            )
38
        ''')
39

40
    def log_execution(self, alert_data):
41
        """Log active response execution"""
42

43
        self.conn.execute('''
44
            INSERT INTO ar_executions
45
            (timestamp, rule_id, command, source_ip, action, status)
46
            VALUES (?, ?, ?, ?, ?, ?)
47
        ''', (
48
            datetime.now(),
49
            alert_data['rule_id'],
50
            alert_data['command'],
51
            alert_data['source_ip'],
52
            alert_data['action'],
53
            'success'
54
        ))
55
        self.conn.commit()
56

57
    def calculate_effectiveness(self):
58
        """Calculate active response effectiveness metrics"""
59

60
        # Get data for last 24 hours
61
        yesterday = datetime.now() - timedelta(days=1)
62

63
        cursor = self.conn.execute('''
64
            SELECT
65
                COUNT(*) as total,
66
                COUNT(DISTINCT source_ip) as unique_ips,
67
                AVG(CASE
68
                    WHEN action = 'delete' THEN
69
                        (julianday(timestamp) - julianday(
70
                            LAG(timestamp) OVER (PARTITION BY source_ip ORDER BY timestamp)
71
                        )) * 24 * 60
72
                    ELSE NULL
73
                END) as avg_block_minutes
74
            FROM ar_executions
75
            WHERE timestamp > ?
76
        ''', (yesterday,))
77

78
        metrics = cursor.fetchone()
79

80
        # Count repeat offenders
81
        cursor = self.conn.execute('''
82
            SELECT COUNT(*)
83
            FROM (
84
                SELECT source_ip, COUNT(*) as count
85
                FROM ar_executions
86
                WHERE timestamp > ? AND action = 'add'
87
                GROUP BY source_ip
88
                HAVING count > 1
89
            )
90
        ''', (yesterday,))
91

92
        repeat_offenders = cursor.fetchone()[0]
93

94
        return {
95
            'total_blocks': metrics[0],
96
            'unique_ips': metrics[1],
97
            'repeat_offenders': repeat_offenders,
98
            'avg_block_duration': metrics[2] or 0,
99
            'effectiveness_rate': (metrics[1] - repeat_offenders) / metrics[1] * 100 if metrics[1] > 0 else 0
100
        }
101

102
    def generate_report(self):
103
        """Generate active response report"""
104

105
        metrics = self.calculate_effectiveness()
106

107
        report = f"""
108
Active Response Daily Report
109
============================
110
Date: {datetime.now().strftime('%Y-%m-%d')}
111

112
Summary Statistics:
113
- Total Blocks: {metrics['total_blocks']}
114
- Unique IPs Blocked: {metrics['unique_ips']}
115
- Repeat Offenders: {metrics['repeat_offenders']}
116
- Average Block Duration: {metrics['avg_block_duration']:.2f} minutes
117
- Effectiveness Rate: {metrics['effectiveness_rate']:.2f}%
118

119
Top Triggered Rules:
120
"""
121

122
        # Get top rules
123
        cursor = self.conn.execute('''
124
            SELECT rule_id, COUNT(*) as count
125
            FROM ar_executions
126
            WHERE timestamp > ? AND action = 'add'
127
            GROUP BY rule_id
128
            ORDER BY count DESC
129
            LIMIT 10
130
        ''', (datetime.now() - timedelta(days=1),))
131

132
        for row in cursor:
133
            report += f"  - Rule {row[0]}: {row[1]} times\n"
134

135
        return report
136

137
# Generate daily report
138
if __name__ == "__main__":
139
    metrics = ActiveResponseMetrics()
140
    print(metrics.generate_report())

1
#!/usr/bin/env python3
2
# ar-rate-limit.py - Rate limit active response executions
3

4
import time
5
import json
6
from collections import defaultdict
7
from datetime import datetime, timedelta
8

9
class ActiveResponseRateLimit:
10
    def __init__(self, max_blocks_per_hour=100, max_per_ip=5):
11
        self.max_blocks_per_hour = max_blocks_per_hour
12
        self.max_per_ip = max_per_ip
13
        self.blocks = defaultdict(list)
14
        self.total_blocks = []
15

16
    def should_block(self, ip):
17
        """Check if IP should be blocked based on rate limits"""
18

19
        current_time = datetime.now()
20
        hour_ago = current_time - timedelta(hours=1)
21

22
        # Clean old entries
23
        self.total_blocks = [
24
            t for t in self.total_blocks if t > hour_ago
25
        ]
26
        self.blocks[ip] = [
27
            t for t in self.blocks[ip] if t > hour_ago
28
        ]
29

30
        # Check total rate limit
31
        if len(self.total_blocks) >= self.max_blocks_per_hour:
32
            return False, "Global rate limit exceeded"
33

34
        # Check per-IP rate limit
35
        if len(self.blocks[ip]) >= self.max_per_ip:
36
            return False, f"Per-IP rate limit exceeded for {ip}"
37

38
        # Allow block
39
        self.blocks[ip].append(current_time)
40
        self.total_blocks.append(current_time)
41

42
        return True, "OK"