How to Forward Android Syslog to Wazuh#

1
<ossec_config>
2
  <remote>
3
    <connection>syslog</connection>
4
    <port>514</port>
5
    <protocol>udp</protocol>
6
    <allowed-ips>192.168.0.0/24</allowed-ips>
7
    <local_ip>192.168.0.200</local_ip>
8
  </remote>
9
</ossec_config>

1
<ossec_config>
2
  <global>
3
    <logall_json>yes</logall_json>
4
  </global>
5
</ossec_config>

1
{
2
  "timestamp":"2019-07-26T12:01:28.130+0000",
3
  "agent":{"id":"000","name":"master"},
4
  "manager":{"name":"master"},
5
  "id":"1564142488.2661882",
6
  "cluster":{"name":"wazuh","node":"node01"},
7
  "full_log":"07-26 14:01:27.025 991 1009 D : DpmQmiMgr areAllIfaceActive ",
8
  "decoder":{},
9
  "location":"192.168.0.139"
10
}

1
07-26 12:40:28.938 16091 16091 I Finsky : [2] lex.c(48): Successful install of com.airbnb.android (isid: c0whUj4AQ5C5HvBUpKinxg)

1
** Alert 1564143288.1: - android,android_install,
2
2019 Jul 26 12:14:48 master->stdin
3
Rule: 100003 (level 5) -> 'Android app installed: com.airbnb.android'
4
action_name: install
5
package_name: com.airbnb.android

1
<!-- Root detection -->
2
<decoder name="android-root-detection">
3
  <parent>android</parent>
4
  <prematch>\.+su|SuperSU|Magisk</prematch>
5
  <regex>\.+(granted|denied) root access to (\.+)</regex>
6
  <order>root_action,requesting_app</order>
7
</decoder>
8

9
<rule id="100010" level="12">
10
  <decoded_as>android-root-detection</decoded_as>
11
  <field name="root_action">granted</field>
12
  <description>Root access granted to $(requesting_app)</description>
13
  <options>alert_by_email</options>
14
  <group>android_root,</group>
15
</rule>
16

17
<!-- ADB connection -->
18
<decoder name="android-adb">
19
  <parent>android</parent>
20
  <prematch>\.+adbd</prematch>
21
  <regex>\.+connection from (\.+)</regex>
22
  <order>adb_source</order>
23
</decoder>
24

25
<rule id="100011" level="8">
26
  <decoded_as>android-adb</decoded_as>
27
  <description>ADB connection from $(adb_source)</description>
28
  <group>android_debug,</group>
29
</rule>
30

31
<!-- USB debugging -->
32
<decoder name="android-usb-debug">
33
  <parent>android</parent>
34
  <prematch>\.+UsbDebuggingManager</prematch>
35
  <regex>\.+USB debugging (enabled|disabled)</regex>
36
  <order>usb_debug_status</order>
37
</decoder>
38

39
<rule id="100012" level="9">
40
  <decoded_as>android-usb-debug</decoded_as>
41
  <field name="usb_debug_status">enabled</field>
42
  <description>USB debugging enabled on device</description>
43
  <group>android_security,</group>
44
</rule>

1
<!-- WiFi connection -->
2
<decoder name="android-wifi">
3
  <parent>android</parent>
4
  <prematch>\.+WifiStateMachine</prematch>
5
  <regex>\.+Connected to (\.+) with IP (\.+)</regex>
6
  <order>wifi_ssid,ip_address</order>
7
</decoder>
8

9
<rule id="100020" level="3">
10
  <decoded_as>android-wifi</decoded_as>
11
  <description>Connected to WiFi: $(wifi_ssid)</description>
12
  <group>android_network,</group>
13
</rule>
14

15
<!-- VPN connection -->
16
<decoder name="android-vpn">
17
  <parent>android</parent>
18
  <prematch>\.+Vpn</prematch>
19
  <regex>\.+VPN (connected|disconnected): (\.+)</regex>
20
  <order>vpn_status,vpn_name</order>
21
</decoder>
22

23
<rule id="100021" level="5">
24
  <decoded_as>android-vpn</decoded_as>
25
  <description>VPN $(vpn_status): $(vpn_name)</description>
26
  <group>android_network,</group>
27
</rule>
28

29
<!-- Data usage alert -->
30
<decoder name="android-data-usage">
31
  <parent>android</parent>
32
  <prematch>\.+NetworkStats</prematch>
33
  <regex>\.+Data usage alert: (\.+) used (\.+) MB</regex>
34
  <order>app_name,data_mb</order>
35
</decoder>
36

37
<rule id="100022" level="6">
38
  <decoded_as>android-data-usage</decoded_as>
39
  <description>High data usage: $(app_name) used $(data_mb) MB</description>
40
  <group>android_network,</group>
41
</rule>

1
<!-- Battery events -->
2
<decoder name="android-battery">
3
  <parent>android</parent>
4
  <prematch>\.+BatteryService</prematch>
5
  <regex>\.+Battery level: (\d+)%, status: (\w+)</regex>
6
  <order>battery_level,battery_status</order>
7
</decoder>
8

9
<rule id="100030" level="4">
10
  <decoded_as>android-battery</decoded_as>
11
  <field name="battery_level" type="pcre2">^[0-9]$|^1[0-9]$</field>
12
  <description>Low battery: $(battery_level)%</description>
13
  <group>android_hardware,</group>
14
</rule>
15

16
<!-- Camera access -->
17
<decoder name="android-camera">
18
  <parent>android</parent>
19
  <prematch>\.+CameraService</prematch>
20
  <regex>\.+Camera access by (\.+): (\w+)</regex>
21
  <order>app_name,camera_action</order>
22
</decoder>
23

24
<rule id="100031" level="5">
25
  <decoded_as>android-camera</decoded_as>
26
  <description>Camera accessed by $(app_name)</description>
27
  <group>android_privacy,</group>
28
</rule>
29

30
<!-- Location access -->
31
<decoder name="android-location">
32
  <parent>android</parent>
33
  <prematch>\.+LocationManagerService</prematch>
34
  <regex>\.+Location request by (\.+) with accuracy (\w+)</regex>
35
  <order>app_name,accuracy</order>
36
</decoder>
37

38
<rule id="100032" level="5">
39
  <decoded_as>android-location</decoded_as>
40
  <description>Location requested by $(app_name)</description>
41
  <group>android_privacy,</group>
42
</rule>

1
<!-- Rate limiting for specific events -->
2
<rule id="100110" level="3" maxsize="100" frequency="10" timeframe="60">
3
  <if_sid>100007</if_sid>
4
  <same_field>location</same_field>
5
  <description>Android unlock events (rate limited)</description>
6
</rule>
7

8
<!-- Aggregate similar events -->
9
<rule id="100111" level="5" frequency="20" timeframe="300">
10
  <if_sid>100003</if_sid>
11
  <same_field>location</same_field>
12
  <description>Mass app installation detected</description>
13
  <group>android_suspicious,</group>
14
</rule>

1
#!/bin/bash
2
# deploy_android_monitoring.sh - Deploy monitoring to multiple devices
3

4
DEVICES_FILE="android_devices.txt"
5
WAZUH_SERVER="192.168.0.200"
6
WAZUH_PORT="514"
7
APK_PATH="LogcatUDP.apk"
8

9
while IFS= read -r device_ip; do
10
    echo "Deploying to device: $device_ip"
11

12
    # Connect via ADB over network
13
    adb connect "$device_ip:5555"
14

15
    # Install LogcatUDP
16
    adb -s "$device_ip:5555" install "$APK_PATH"
17

18
    # Grant permissions
19
    adb -s "$device_ip:5555" shell pm grant \
20
        sk.madzik.android.logcatudp android.permission.READ_LOGS
21

22
    # Configure via intent (if app supports it)
23
    adb -s "$device_ip:5555" shell am broadcast \
24
        -a sk.madzik.android.logcatudp.CONFIGURE \
25
        --es server "$WAZUH_SERVER" \
26
        --ei port "$WAZUH_PORT"
27

28
    # Start service
29
    adb -s "$device_ip:5555" shell am startservice \
30
        sk.madzik.android.logcatudp/.LogcatService
31

32
    # Disconnect
33
    adb disconnect "$device_ip:5555"
34

35
done < "$DEVICES_FILE"

1
#!/usr/bin/env python3
2
# mdm_android_monitoring.py - Deploy via MDM
3

4
import requests
5
import json
6

7
class MDMAndroidMonitoring:
8
    def __init__(self, mdm_api_url, api_key):
9
        self.mdm_api_url = mdm_api_url
10
        self.headers = {'Authorization': f'Bearer {api_key}'}
11

12
    def deploy_monitoring_profile(self, device_group):
13
        """Deploy Android monitoring configuration via MDM"""
14

15
        profile = {
16
            "name": "Wazuh Android Monitoring",
17
            "type": "android_configuration",
18
            "settings": {
19
                "apps": [{
20
                    "package": "sk.madzik.android.logcatudp",
21
                    "install_type": "force_installed",
22
                    "permissions": ["android.permission.READ_LOGS"],
23
                    "configuration": {
24
                        "server": "192.168.0.200",
25
                        "port": 514,
26
                        "auto_start": True
27
                    }
28
                }],
29
                "restrictions": {
30
                    "allow_usb_debugging": False,
31
                    "allow_unknown_sources": False
32
                }
33
            }
34
        }
35

36
        # Deploy profile
37
        response = requests.post(
38
            f"{self.mdm_api_url}/profiles",
39
            json=profile,
40
            headers=self.headers
41
        )
42

43
        # Assign to device group
44
        if response.status_code == 201:
45
            profile_id = response.json()['id']
46
            self.assign_profile_to_group(profile_id, device_group)
47

48
    def monitor_compliance(self):
49
        """Check if devices are sending logs"""
50

51
        # Get all managed devices
52
        devices = self.get_managed_devices()
53

54
        # Check Wazuh for each device
55
        non_compliant = []
56
        for device in devices:
57
            if not self.check_device_logs(device['id']):
58
                non_compliant.append(device)
59

60
        return non_compliant

1
#!/usr/bin/env python3
2
# android_dashboard.py - Create Android monitoring dashboard
3

4
import json
5
import requests
6
from datetime import datetime, timedelta
7

8
def create_android_dashboard():
9
    """Create Kibana dashboard for Android monitoring"""
10

11
    dashboard = {
12
        "version": "7.10.2",
13
        "objects": [{
14
            "id": "android-monitoring-dashboard",
15
            "type": "dashboard",
16
            "attributes": {
17
                "title": "Android Device Monitoring",
18
                "panels": [
19
                    {
20
                        "id": "android-app-installs",
21
                        "type": "visualization",
22
                        "gridData": {
23
                            "x": 0,
24
                            "y": 0,
25
                            "w": 24,
26
                            "h": 15
27
                        }
28
                    },
29
                    {
30
                        "id": "android-security-events",
31
                        "type": "visualization",
32
                        "gridData": {
33
                            "x": 24,
34
                            "y": 0,
35
                            "w": 24,
36
                            "h": 15
37
                        }
38
                    },
39
                    {
40
                        "id": "android-device-map",
41
                        "type": "visualization",
42
                        "gridData": {
43
                            "x": 0,
44
                            "y": 15,
45
                            "w": 48,
46
                            "h": 20
47
                        }
48
                    }
49
                ]
50
            }
51
        }]
52
    }
53

54
    # Create visualizations
55
    visualizations = [
56
        create_app_install_viz(),
57
        create_security_events_viz(),
58
        create_device_map_viz()
59
    ]
60

61
    # Upload to Kibana
62
    for viz in visualizations:
63
        upload_to_kibana(viz)
64

65
    # Upload dashboard
66
    upload_to_kibana(dashboard)
67

68
def create_app_install_viz():
69
    """Visualization for app installations"""
70

71
    return {
72
        "id": "android-app-installs",
73
        "type": "visualization",
74
        "attributes": {
75
            "title": "Android App Installations",
76
            "visState": {
77
                "type": "line",
78
                "params": {
79
                    "grid": {"categoryLines": False},
80
                    "categoryAxes": [{
81
                        "id": "CategoryAxis-1",
82
                        "type": "category",
83
                        "position": "bottom",
84
                        "show": True,
85
                        "style": {},
86
                        "scale": {"type": "linear"},
87
                        "labels": {"show": True, "truncate": 100},
88
                        "title": {}
89
                    }],
90
                    "valueAxes": [{
91
                        "id": "ValueAxis-1",
92
                        "name": "LeftAxis-1",
93
                        "type": "value",
94
                        "position": "left",
95
                        "show": True,
96
                        "style": {},
97
                        "scale": {"type": "linear", "mode": "normal"},
98
                        "labels": {"show": True, "rotate": 0},
99
                        "title": {"text": "App Install Count"}
100
                    }]
101
                },
102
                "aggs": [{
103
                    "id": "1",
104
                    "enabled": True,
105
                    "type": "count",
106
                    "schema": "metric",
107
                    "params": {}
108
                }, {
109
                    "id": "2",
110
                    "enabled": True,
111
                    "type": "date_histogram",
112
                    "schema": "segment",
113
                    "params": {
114
                        "field": "timestamp",
115
                        "interval": "auto",
116
                        "customInterval": "2h",
117
                        "min_doc_count": 1,
118
                        "extended_bounds": {}
119
                    }
120
                }]
121
            },
122
            "kibanaSavedObjectMeta": {
123
                "searchSourceJSON": {
124
                    "index": "wazuh-alerts-*",
125
                    "query": {"match": {"rule.groups": "android_install"}},
126
                    "filter": []
127
                }
128
            }
129
        }
130
    }

1
#!/usr/bin/env python3
2
# secure_android_syslog.py - Implement secure syslog forwarding
3

4
import ssl
5
import socket
6
import hashlib
7
import hmac
8

9
class SecureAndroidSyslog:
10
    def __init__(self, server, port, shared_key):
11
        self.server = server
12
        self.port = port
13
        self.shared_key = shared_key.encode()
14

15
    def create_secure_connection(self):
16
        """Create TLS-encrypted syslog connection"""
17

18
        # Create SSL context
19
        context = ssl.create_default_context()
20
        context.check_hostname = False
21
        context.verify_mode = ssl.CERT_NONE  # Use proper certs in production
22

23
        # Create socket
24
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
25
        secure_sock = context.wrap_socket(sock)
26
        secure_sock.connect((self.server, self.port))
27

28
        return secure_sock
29

30
    def send_authenticated_log(self, log_message):
31
        """Send HMAC-authenticated log message"""
32

33
        # Create HMAC
34
        timestamp = str(int(time.time()))
35
        message = f"{timestamp}:{log_message}"
36
        signature = hmac.new(
37
            self.shared_key,
38
            message.encode(),
39
            hashlib.sha256
40
        ).hexdigest()
41

42
        # Send authenticated message
43
        authenticated_message = f"{signature}:{message}"
44
        return authenticated_message

1
<!-- Sanitize sensitive data -->
2
<rule id="100200" level="0">
3
  <program_name>android</program_name>
4
  <regex>password|pin|token|key</regex>
5
  <description>Dropped: Log contains sensitive data</description>
6
</rule>
7

8
<!-- Anonymize phone numbers -->
9
<decoder name="android-call-sanitized">
10
  <parent>android</parent>
11
  <prematch>\.+InCallUI</prematch>
12
  <regex>\.+(IncomingCall|OutgoingCall) from</regex>
13
  <order>call_type</order>
14
  <use_own_name>yes</use_own_name>
15
  <plugin>sanitize_phone.so</plugin>
16
</decoder>

1
#!/bin/bash
2
# android_device_whitelist.sh - Maintain device whitelist
3

4
WHITELIST="/var/ossec/etc/lists/android_devices"
5
ALLOWED_NETWORKS="192.168.0.0/24,10.0.0.0/24"
6

7
# Create device whitelist
8
cat > "$WHITELIST" << EOF
9
# Authorized Android devices
10
# Format: IP:Device_ID:User
11
192.168.0.101:SM-G950F:john.doe
12
192.168.0.102:Pixel-4:jane.smith
13
192.168.0.103:OnePlus-8:bob.jones
14
EOF
15

16
# Update Wazuh configuration
17
cat >> /var/ossec/etc/rules/local_rules.xml << EOF
18
<rule id="100300" level="10">
19
  <program_name>android</program_name>
20
  <list field="srcip" lookup="not_address_match_key">etc/lists/android_devices</list>
21
  <description>Unauthorized Android device detected</description>
22
  <group>android_unauthorized,</group>
23
</rule>
24
EOF

1
Android Monitoring Strategy:
2
  Device Groups:
3
    Corporate:
4
      - Full logging enabled
5
      - Real-time alerts
6
      - Strict compliance
7

8
    BYOD:
9
      - Privacy-focused logging
10
      - Critical events only
11
      - User consent required
12

13
    Test:
14
      - Verbose logging
15
      - All events captured
16
      - Performance testing

1
#!/usr/bin/env python3
2
# android_log_retention.py - Manage Android log retention
3

4
def configure_retention_policy():
5
    """Configure different retention for Android logs"""
6

7
    retention_policies = {
8
        "android_security": {
9
            "days": 365,
10
            "compress": True,
11
            "archive": "glacier"
12
        },
13
        "android_app_usage": {
14
            "days": 90,
15
            "compress": True,
16
            "archive": "standard"
17
        },
18
        "android_debug": {
19
            "days": 7,
20
            "compress": False,
21
            "archive": None
22
        }
23
    }
24

25
    # Apply policies
26
    for group, policy in retention_policies.items():
27
        apply_retention_policy(group, policy)

1
<!-- Production-ready Android rules -->
2
<group name="android_production,">
3
  <!-- Critical: Malware detection -->
4
  <rule id="100400" level="14">
5
    <if_sid>100003</if_sid>
6
    <list field="package_name" lookup="match_key">
7
      etc/lists/known_malware_packages
8
    </list>
9
    <description>Known malware installed: $(package_name)</description>
10
    <options>alert_by_email</options>
11
  </rule>
12

13
  <!-- High: Rooting attempt -->
14
  <rule id="100401" level="12">
15
    <program_name>android</program_name>
16
    <match>su binary|Superuser.apk|magisk</match>
17
    <description>Android rooting attempt detected</description>
18
  </rule>
19

20
  <!-- Medium: Policy violation -->
21
  <rule id="100402" level="8">
22
    <if_sid>100003</if_sid>
23
    <list field="package_name" lookup="not_match_key">
24
      etc/lists/approved_apps
25
    </list>
26
    <description>Unapproved app installed: $(package_name)</description>
27
  </rule>
28
</group>

1
#!/usr/bin/env python3
2
# mdm_integration.py - Integrate Android monitoring with MDM
3

4
class MDMIntegration:
5
    def handle_security_event(self, alert):
6
        """Handle security events from Wazuh"""
7

8
        device_id = self.extract_device_id(alert['location'])
9

10
        if alert['rule']['groups'] == ['android_malware']:
11
            # Quarantine device
12
            self.mdm_api.quarantine_device(device_id)
13

14
        elif alert['rule']['groups'] == ['android_root']:
15
            # Remove corporate access
16
            self.mdm_api.remove_corporate_profile(device_id)
17

18
        elif alert['rule']['groups'] == ['android_unauthorized']:
19
            # Block device
20
            self.mdm_api.block_device(device_id)

1
#!/usr/bin/env python3
2
# android_active_response.py - Automated response to Android events
3

4
def respond_to_android_alert(alert):
5
    """Automated response to Android security events"""
6

7
    responses = {
8
        'android_malware': remote_wipe,
9
        'android_root': revoke_certificates,
10
        'android_data_theft': lock_device,
11
        'android_suspicious': increase_monitoring
12
    }
13

14
    for group in alert['rule']['groups']:
15
        if group in responses:
16
            responses[group](alert)

1
#!/usr/bin/env python3
2
# android_compliance_report.py - Generate compliance reports
3

4
def generate_android_compliance_report():
5
    """Generate Android device compliance report"""
6

7
    report = {
8
        'date': datetime.now().isoformat(),
9
        'total_devices': 0,
10
        'compliant_devices': 0,
11
        'violations': [],
12
        'metrics': {}
13
    }
14

15
    # Check each device
16
    for device in get_android_devices():
17
        report['total_devices'] += 1
18

19
        violations = check_device_compliance(device)
20
        if not violations:
21
            report['compliant_devices'] += 1
22
        else:
23
            report['violations'].append({
24
                'device': device,
25
                'issues': violations
26
            })
27

28
    # Calculate metrics
29
    report['metrics']['compliance_rate'] = (
30
        report['compliant_devices'] / report['total_devices'] * 100
31
    )
32

33
    return report