Enhancing Data Security with the Wazuh Open Source FIM#

1
flowchart TB
2
    subgraph "File System Events"
3
        F1[File Created]
4
        F2[File Modified]
5
        F3[File Deleted]
6
        F4[Permission Changed]
7
        F5[Registry Modified]
8
    end
9

10
    subgraph "Wazuh FIM Module"
11
        S1[Real-time Monitor]
12
        S2[Scheduled Scanner]
13
        H1[Hash Calculator]
14
        A1[Attribute Tracker]
15
        W1[Whodata Collector]
16
    end
17

18
    subgraph "Detection & Response"
19
        D1[Change Detection]
20
        R1[Rule Matching]
21
        AL1[Alert Generation]
22
        DB1[Dashboard Display]
23
    end
24

25
    F1 --> S1
26
    F2 --> S1
27
    F3 --> S1
28
    F4 --> S1
29
    F5 --> S1
30

31
    S1 --> H1
32
    S2 --> H1
33
    H1 --> D1
34
    A1 --> D1
35
    W1 --> D1
36

37
    D1 --> R1
38
    R1 --> AL1
39
    AL1 --> DB1
40

41
    style S1 fill:#51cf66
42
    style D1 fill:#4dabf7
43
    style AL1 fill:#ffd43b

1
import platform
2
import subprocess
3
import os
4
import time
5

6
# Function to detect the OS
7
def get_os():
8
    return platform.system()
9

10
# Function to create a file
11
def create_file(filename, content=""):
12
    with open(filename, 'w') as file:
13
        file.write(content)
14
        print(f"File created: {filename}")
15

16
# Function to modify a file
17
def modify_file(file_path, text_to_append):
18
    try:
19
        if os.path.isfile(file_path):
20
            with open(file_path, 'a') as file:
21
                file.write(text_to_append + '\n')
22
            print(f"Text appended to {file_path}")
23
        else:
24
            print(f"File not found: {file_path}")
25
    except IOError as e:
26
        print(f"Error modifying file: {e}")
27

28
# Function to find and modify files in the specified directory
29
def find_and_modify_files(directory, text_to_append, file_extension=None):
30
    for file in os.listdir(directory):
31
        if file_extension and not file.endswith(file_extension):
32
            continue
33
        file_path = os.path.join(directory, file)
34
        if os.path.isfile(file_path):
35
            modify_file(file_path, text_to_append)
36

37
# Function to delete a file
38
def delete_file(filename):
39
    try:
40
        os.remove(filename)
41
        print(f"File deleted: {filename}")
42
    except Exception as e:
43
        print(f"Error deleting file: {e}")
44

45
def create_registry_key(key_path, key_name, value="Your Value"):
46
    os_type = get_os()
47
    if os_type != "Windows":
48
        print("Registry operations are only supported on Windows.")
49
        return
50

51
    try:
52
        import winreg
53
        with winreg.ConnectRegistry(None, winreg.HKEY_LOCAL_MACHINE) as hkey:
54
            with winreg.CreateKey(hkey, key_path) as reg_key:
55
                winreg.SetValueEx(reg_key, key_name, 0, winreg.REG_SZ, value)
56
                print(f"Registry key {key_name} created at {key_path}")
57
    except Exception as e:
58
        print(f"Error creating registry key: {e}")
59

60
# Main function to use the above functions
61
def main():
62
    if get_os() == "Windows":
63
        directory = r"C:\WazuhFIMtest"
64
    elif get_os() == "Linux":
65
        directory = "/root/WazuhFIMtest"
66
    else:
67
        print("Unsupported operating system.")
68
        return
69

70
    print(f"The current working directory is {directory}")
71
    filename = os.path.join(directory, "malicious_file.txt")
72

73
    # Create malicious file
74
    create_file(filename)
75
    time.sleep(2)
76

77
    if get_os() == "Linux":
78
        # Change file permission to rwx for the root user
79
        subprocess.run(['chmod', '0744', filename], check=True)
80
        print(f"File permissions changed to rwx for the root user: {filename}")
81
        time.sleep(2)
82
    elif get_os() == "Windows":
83
        create_registry_key(r"SYSTEM\Setup\WazuhApp", "WazuhKey")
84

85
    # Modify files in the specified directory
86
    text_to_append = "Wazuh FIM test: malicious hex"
87
    find_and_modify_files(directory, text_to_append)
88

89
    # Wait for 5 seconds before deleting the file
90
    time.sleep(5)
91

92
    if get_os() == "Windows":
93
        delete_file(r"C:\WazuhFIMtest\financialrecord.txt")
94
    elif get_os() == "Linux":
95
        delete_file(r"/root/WazuhFIMtest/financialrecord.txt")
96
    else:
97
        print("Unsupported operating system.")
98

99
if __name__ == "__main__":
100
    main()

1
flowchart LR
2
    subgraph "Detected Events"
3
        E1[File Added<br/>malicious_file.txt]
4
        E2[Registry Key Created<br/>WazuhApp\WazuhKey]
5
        E3[Files Modified<br/>Content Changes]
6
        E4[File Deleted<br/>financialrecord.txt]
7
    end
8

9
    subgraph "Wazuh Alerts"
10
        A1[Rule 554<br/>File Added]
11
        A2[Rule 750<br/>Registry Added]
12
        A3[Rule 550<br/>File Modified]
13
        A4[Rule 553<br/>File Deleted]
14
    end
15

16
    E1 --> A1
17
    E2 --> A2
18
    E3 --> A3
19
    E4 --> A4
20

21
    style E1 fill:#ffd43b
22
    style E2 fill:#ff6b6b
23
    style E3 fill:#4dabf7
24
    style E4 fill:#ff6b6b

1
<group name="fim_advanced,">
2
  <!-- Detect executable file creation -->
3
  <rule id="100200" level="8">
4
    <if_sid>554</if_sid>
5
    <field name="file">\.exe$|\.dll$|\.so$|\.sh$|\.py$</field>
6
    <description>Executable file created: $(file)</description>
7
  </rule>
8

9
  <!-- Detect configuration file changes -->
10
  <rule id="100201" level="7">
11
    <if_sid>550</if_sid>
12
    <field name="file">\.conf$|\.cfg$|\.ini$|\.json$|\.xml$</field>
13
    <description>Configuration file modified: $(file)</description>
14
  </rule>
15

16
  <!-- Detect sensitive file deletion -->
17
  <rule id="100202" level="10">
18
    <if_sid>553</if_sid>
19
    <field name="file">financial|sensitive|confidential|secret</field>
20
    <description>Sensitive file deleted: $(file)</description>
21
    <options>alert_by_email</options>
22
  </rule>
23

24
  <!-- Detect mass file modifications -->
25
  <rule id="100203" level="9" frequency="10" timeframe="60">
26
    <if_sid>550</if_sid>
27
    <description>Multiple files modified in short time</description>
28
  </rule>
29
</group>

1
<ossec_config>
2
  <syscheck>
3
    <!-- System directories -->
4
    <directories check_all="yes" realtime="yes">/etc,/bin,/sbin</directories>
5

6
    <!-- User home directories -->
7
    <directories check_all="yes" whodata="yes">/home</directories>
8

9
    <!-- Web server files -->
10
    <directories check_all="yes" report_changes="yes">/var/www</directories>
11

12
    <!-- Exclude temporary files -->
13
    <ignore>/tmp</ignore>
14
    <ignore>/var/cache</ignore>
15
    <ignore type="sregex">\.log$</ignore>
16

17
    <!-- Frequency settings -->
18
    <frequency>43200</frequency>
19

20
    <!-- Maximum files per second -->
21
    <max_eps>100</max_eps>
22

23
    <!-- Database synchronization -->
24
    <synchronization>
25
      <enabled>yes</enabled>
26
      <interval>12h</interval>
27
      <max_interval>1d</max_interval>
28
    </synchronization>
29
  </syscheck>
30
</ossec_config>

1
Critical Directories to Monitor:
2
  System:
3
    - /etc (Linux) or C:\Windows\System32 (Windows)
4
    - /bin, /sbin, /usr/bin, /usr/sbin (Linux)
5
    - Boot directories
6

7
  Application:
8
    - Web server roots
9
    - Application configuration directories
10
    - Database directories
11

12
  Security:
13
    - SSH keys directory
14
    - Certificate stores
15
    - Authentication files

1
<!-- Optimize for large filesystems -->
2
<syscheck>
3
  <!-- Limit scan frequency -->
4
  <frequency>86400</frequency>  <!-- Daily scans -->
5

6
  <!-- Exclude non-critical large files -->
7
  <ignore type="sregex">\.log$|\.tmp$|\.cache$</ignore>
8

9
  <!-- Set maximum depth -->
10
  <max_depth>10</max_depth>
11

12
  <!-- Limit files per second -->
13
  <max_eps>50</max_eps>
14
</syscheck>

1
<!-- Block user after unauthorized file modification -->
2
<active-response>
3
  <command>disable-account</command>
4
  <location>local</location>
5
  <rules_id>100202</rules_id>
6
</active-response>

1
<rule id="100204" level="12">
2
  <if_sid>550</if_sid>
3
  <match>CVE-2023</match>
4
  <description>Vulnerable file modified: $(file)</description>
5
</rule>

1
# Check file hash against threat intelligence
2
def check_threat_intel(file_hash):
3
    threat_feeds = load_threat_feeds()
4
    if file_hash in threat_feeds:
5
        generate_alert("Malicious file detected", severity="critical")

1
<rule id="100205" level="12" frequency="20" timeframe="60">
2
  <if_sid>550</if_sid>
3
  <field name="changed_attributes">^.*size.*$</field>
4
  <description>Possible ransomware activity - mass file encryption</description>
5
</rule>

1
<rule id="100206" level="10">
2
  <if_sid>550</if_sid>
3
  <field name="uname">^(?!root|admin)</field>
4
  <field name="file">/etc/passwd|/etc/shadow</field>
5
  <description>Non-admin user modified critical auth file</description>
6
</rule>

1
#!/bin/bash
2
# Generate FIM compliance report
3

4
echo "=== FIM Compliance Report ==="
5
echo "Date: $(date)"
6
echo ""
7

8
# PCI DSS 11.5 - Critical file changes
9
echo "Critical File Changes (Last 24h):"
10
grep -E "rule:550|rule:553|rule:554" /var/ossec/logs/alerts/alerts.json | \
11
  jq -r 'select(.timestamp > (now - 86400)) |
12
    "\(.timestamp) - \(.rule.description) - \(.data.file)"'