Advanced Active Directory Security Monitoring with Wazuh: Detection and Forensics#

1
<ossec_config>
2
  <!-- Security Event Log -->
3
  <localfile>
4
    <location>Security</location>
5
    <log_format>eventchannel</log_format>
6
  </localfile>
7

8
  <!-- System Event Log -->
9
  <localfile>
10
    <location>System</location>
11
    <log_format>eventchannel</log_format>
12
  </localfile>
13

14
  <!-- PowerShell Event Logs -->
15
  <localfile>
16
    <location>Microsoft-Windows-PowerShell/Operational</location>
17
    <log_format>eventchannel</log_format>
18
  </localfile>
19

20
  <!-- DNS Server Logs -->
21
  <localfile>
22
    <location>DNS Server</location>
23
    <log_format>eventchannel</log_format>
24
  </localfile>
25

26
  <!-- AD Web Services -->
27
  <localfile>
28
    <location>Microsoft-Windows-ActiveDirectory_DomainService/Operational</location>
29
    <log_format>eventchannel</log_format>
30
  </localfile>
31

32
  <!-- File Integrity Monitoring for SYSVOL -->
33
  <syscheck>
34
    <directories check_all="yes" realtime="yes">C:\Windows\SYSVOL</directories>
35
    <directories check_all="yes" realtime="yes">C:\Windows\System32\config</directories>
36
  </syscheck>
37

38
  <!-- Registry monitoring -->
39
  <syscheck>
40
    <windows_registry>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS</windows_registry>
41
    <windows_registry>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders</windows_registry>
42
    <windows_registry>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon</windows_registry>
43
  </syscheck>
44

45
  <!-- Active Response -->
46
  <active-response>
47
    <disabled>no</disabled>
48
    <ca_store>etc/wpk_root.pem</ca_store>
49
    <ca_verification>yes</ca_verification>
50
  </active-response>
51
</ossec_config>

1
<ossec_config>
2
  <!-- Security Event Log -->
3
  <localfile>
4
    <location>Security</location>
5
    <log_format>eventchannel</log_format>
6
  </localfile>
7

8
  <!-- Sysmon Integration -->
9
  <localfile>
10
    <location>Microsoft-Windows-Sysmon/Operational</location>
11
    <log_format>eventchannel</log_format>
12
  </localfile>
13

14
  <!-- PowerShell Logs -->
15
  <localfile>
16
    <location>Microsoft-Windows-PowerShell/Operational</location>
17
    <log_format>eventchannel</log_format>
18
  </localfile>
19

20
  <!-- Process monitoring -->
21
  <syscheck>
22
    <directories check_all="yes" realtime="yes">C:\Windows\System32\drivers</directories>
23
    <directories check_all="yes" realtime="yes">C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup</directories>
24
  </syscheck>
25
</ossec_config>

1
#!/usr/bin/env python3
2
"""
3
Kerberoasting Detection Analysis
4
Analyzes Wazuh alerts for Kerberoasting patterns
5
"""
6

7
import json
8
import requests
9
from datetime import datetime, timedelta
10
import pandas as pd
11
import matplotlib.pyplot as plt
12

13
class KerberoastingAnalyzer:
14
    def __init__(self, wazuh_manager_url, auth_token):
15
        self.base_url = wazuh_manager_url
16
        self.headers = {
17
            'Authorization': f'Bearer {auth_token}',
18
            'Content-Type': 'application/json'
19
        }
20

21
    def get_kerberoasting_alerts(self, hours=24):
22
        """Retrieve Kerberoasting alerts from last N hours"""
23

24
        end_time = datetime.now()
25
        start_time = end_time - timedelta(hours=hours)
26

27
        query = {
28
            "query": {
29
                "bool": {
30
                    "must": [
31
                        {"match": {"rule.id": "100001"}},
32
                        {"range": {
33
                            "timestamp": {
34
                                "gte": start_time.isoformat(),
35
                                "lte": end_time.isoformat()
36
                            }
37
                        }}
38
                    ]
39
                }
40
            }
41
        }
42

43
        response = requests.post(
44
            f"{self.base_url}/alerts/_search",
45
            headers=self.headers,
46
            json=query
47
        )
48

49
        return response.json()
50

51
    def analyze_attack_pattern(self, alerts):
52
        """Analyze Kerberoasting attack patterns"""
53

54
        analysis = {
55
            'total_alerts': len(alerts),
56
            'unique_sources': set(),
57
            'targeted_services': {},
58
            'encryption_types': {},
59
            'timeline': []
60
        }
61

62
        for alert in alerts:
63
            data = alert['_source']
64

65
            # Extract source information
66
            source_ip = data.get('data', {}).get('srcip', 'unknown')
67
            analysis['unique_sources'].add(source_ip)
68

69
            # Extract service information
70
            service_name = data.get('data', {}).get('win', {}).get('eventdata', {}).get('serviceName', 'unknown')
71
            analysis['targeted_services'][service_name] = analysis['targeted_services'].get(service_name, 0) + 1
72

73
            # Extract encryption type
74
            enc_type = data.get('data', {}).get('win', {}).get('eventdata', {}).get('ticketEncryptionType', 'unknown')
75
            analysis['encryption_types'][enc_type] = analysis['encryption_types'].get(enc_type, 0) + 1
76

77
            # Timeline
78
            timestamp = data.get('timestamp', '')
79
            analysis['timeline'].append({
80
                'timestamp': timestamp,
81
                'service': service_name,
82
                'source': source_ip
83
            })
84

85
        return analysis
86

87
    def generate_report(self, analysis):
88
        """Generate comprehensive attack report"""
89

90
        report = f"""
91
=== KERBEROASTING ATTACK ANALYSIS REPORT ===
92
Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}
93

94
SUMMARY:
95
- Total alerts: {analysis['total_alerts']}
96
- Unique source IPs: {len(analysis['unique_sources'])}
97
- Services targeted: {len(analysis['targeted_services'])}
98

99
TOP TARGETED SERVICES:
100
"""
101

102
        # Sort services by frequency
103
        sorted_services = sorted(analysis['targeted_services'].items(),
104
                               key=lambda x: x[1], reverse=True)
105

106
        for service, count in sorted_services[:10]:
107
            report += f"  - {service}: {count} requests\n"
108

109
        report += f"""
110
ENCRYPTION TYPES:
111
"""
112

113
        for enc_type, count in analysis['encryption_types'].items():
114
            enc_name = {
115
                '0x17': 'RC4-HMAC (Weak)',
116
                '0x12': 'AES128-CTS-HMAC-SHA1-96',
117
                '0x11': 'AES256-CTS-HMAC-SHA1-96'
118
            }.get(enc_type, enc_type)
119

120
            report += f"  - {enc_name}: {count} tickets\n"
121

122
        report += f"""
123
SOURCE IPs:
124
"""
125
        for ip in analysis['unique_sources']:
126
            report += f"  - {ip}\n"
127

128
        report += f"""
129
RECOMMENDATIONS:
130
1. Investigate source IPs for compromise indicators
131
2. Review service account configurations
132
3. Consider disabling RC4 encryption if possible
133
4. Implement service account password rotation
134
5. Monitor for lateral movement from identified sources
135
"""
136

137
        return report
138

139
    def create_timeline_visualization(self, analysis):
140
        """Create attack timeline visualization"""
141

142
        if not analysis['timeline']:
143
            return None
144

145
        df = pd.DataFrame(analysis['timeline'])
146
        df['timestamp'] = pd.to_datetime(df['timestamp'])
147
        df = df.sort_values('timestamp')
148

149
        plt.figure(figsize=(15, 8))
150

151
        # Timeline plot
152
        plt.subplot(2, 1, 1)
153
        plt.scatter(df['timestamp'], df['service'], alpha=0.6)
154
        plt.title('Kerberoasting Attack Timeline')
155
        plt.xlabel('Time')
156
        plt.ylabel('Service Targeted')
157
        plt.xticks(rotation=45)
158

159
        # Service frequency
160
        plt.subplot(2, 1, 2)
161
        service_counts = df['service'].value_counts()
162
        plt.bar(service_counts.index[:10], service_counts.values[:10])
163
        plt.title('Most Targeted Services')
164
        plt.xlabel('Service')
165
        plt.ylabel('Request Count')
166
        plt.xticks(rotation=45)
167

168
        plt.tight_layout()
169
        plt.savefig('kerberoasting_analysis.png', dpi=300, bbox_inches='tight')
170
        return 'kerberoasting_analysis.png'
171

172
# Usage example
173
if __name__ == "__main__":
174
    analyzer = KerberoastingAnalyzer(
175
        wazuh_manager_url="https://wazuh-manager:55000",
176
        auth_token="your_wazuh_api_token"
177
    )
178

179
    # Get alerts
180
    alerts_response = analyzer.get_kerberoasting_alerts(hours=24)
181
    alerts = alerts_response.get('hits', {}).get('hits', [])
182

183
    # Analyze patterns
184
    analysis = analyzer.analyze_attack_pattern(alerts)
185

186
    # Generate report
187
    report = analyzer.generate_report(analysis)
188
    print(report)
189

190
    # Save report
191
    with open('kerberoasting_report.txt', 'w') as f:
192
        f.write(report)
193

194
    # Create visualization
195
    chart_file = analyzer.create_timeline_visualization(analysis)
196
    if chart_file:
197
        print(f"Timeline visualization saved as {chart_file}")

1
#!/usr/bin/env python3
2
"""
3
Golden Ticket Detection and Analysis
4
Monitors for Golden Ticket attacks and persistence
5
"""
6

7
import re
8
import json
9
import hashlib
10
from datetime import datetime, timedelta
11

12
class GoldenTicketDetector:
13
    def __init__(self, wazuh_api):
14
        self.wazuh_api = wazuh_api
15
        self.known_krbtgt_hashes = set()
16
        self.baseline_tgt_requests = {}
17

18
    def detect_golden_ticket_indicators(self, event):
19
        """Detect Golden Ticket attack indicators"""
20

21
        indicators = {
22
            'suspicious_tgt_requests': False,
23
            'unusual_encryption': False,
24
            'krbtgt_targeting': False,
25
            'timing_anomalies': False,
26
            'impossible_travel': False
27
        }
28

29
        # Check for TGT requests to krbtgt
30
        if event.get('win', {}).get('eventdata', {}).get('serviceName') == 'krbtgt':
31
            indicators['krbtgt_targeting'] = True
32

33
            # Check encryption type (RC4 often used in Golden Tickets)
34
            enc_type = event.get('win', {}).get('eventdata', {}).get('ticketEncryptionType')
35
            if enc_type == '0x17':  # RC4
36
                indicators['unusual_encryption'] = True
37

38
        # Check for impossible travel (same user, different locations)
39
        user = event.get('win', {}).get('eventdata', {}).get('targetUserName')
40
        source_ip = event.get('srcip')
41
        timestamp = event.get('timestamp')
42

43
        if user and source_ip:
44
            last_location = self.get_user_last_location(user)
45
            if last_location and self.is_impossible_travel(last_location, source_ip, timestamp):
46
                indicators['impossible_travel'] = True
47

48
        # Check timing patterns
49
        if self.is_unusual_timing(event):
50
            indicators['timing_anomalies'] = True
51

52
        return indicators
53

54
    def analyze_krbtgt_account(self):
55
        """Analyze krbtgt account for compromise indicators"""
56

57
        analysis = {
58
            'password_last_changed': None,
59
            'unusual_activity': False,
60
            'multiple_krbtgt_accounts': False,
61
            'recommendations': []
62
        }
63

64
        # Query for krbtgt password changes
65
        query = {
66
            "query": {
67
                "bool": {
68
                    "must": [
69
                        {"match": {"rule.id": "60135"}},  # Password change
70
                        {"match": {"data.win.eventdata.targetUserName": "krbtgt"}}
71
                    ]
72
                }
73
            },
74
            "sort": [{"timestamp": {"order": "desc"}}],
75
            "size": 1
76
        }
77

78
        result = self.wazuh_api.search_alerts(query)
79

80
        if result['hits']['total']['value'] > 0:
81
            last_change = result['hits']['hits'][0]['_source']['timestamp']
82
            analysis['password_last_changed'] = last_change
83

84
            # Check if password was changed recently (potential response to compromise)
85
            change_time = datetime.fromisoformat(last_change.replace('Z', '+00:00'))
86
            if datetime.now() - change_time < timedelta(hours=48):
87
                analysis['unusual_activity'] = True
88
                analysis['recommendations'].append("Recent krbtgt password change detected - investigate if this was planned")
89
        else:
90
            analysis['recommendations'].append("krbtgt password has not been changed recently - consider regular rotation")
91

92
        return analysis
93

94
    def create_golden_ticket_response(self, indicators):
95
        """Create automated response for Golden Ticket detection"""
96

97
        response_actions = []
98

99
        if indicators['krbtgt_targeting'] and indicators['unusual_encryption']:
100
            response_actions.extend([
101
                "CRITICAL: Potential Golden Ticket attack detected",
102
                "Action: Immediately reset krbtgt password (twice, 10 hours apart)",
103
                "Action: Force re-authentication of all users",
104
                "Action: Audit all recent administrative actions",
105
                "Action: Check for persistence mechanisms"
106
            ])
107

108
        if indicators['impossible_travel']:
109
            response_actions.extend([
110
                "WARNING: Impossible travel detected",
111
                "Action: Disable affected user account",
112
                "Action: Investigate source IP addresses",
113
                "Action: Review authentication logs for timeline"
114
            ])
115

116
        return response_actions
117

118
    def generate_golden_ticket_playbook(self):
119
        """Generate response playbook for Golden Ticket attacks"""
120

121
        playbook = """
122
=== GOLDEN TICKET ATTACK RESPONSE PLAYBOOK ===
123

124
IMMEDIATE ACTIONS (0-30 minutes):
125
1. Isolate affected systems from network
126
2. Capture memory dumps from suspect systems
127
3. Document all IOCs and timeline
128
4. Notify incident response team
129

130
SHORT-TERM ACTIONS (30 minutes - 4 hours):
131
1. Reset krbtgt password (TWICE, 10 hours apart)
132
   - This invalidates all existing Kerberos tickets
133
   - First reset invalidates current tickets
134
   - Second reset (after 10 hours) invalidates tickets created between resets
135

136
2. Force user re-authentication
137
   - Group Policy: "Interactive logon: Require smart card"
138
   - Clear cached credentials on all systems
139

140
3. Audit administrative accounts
141
   - Review all privileged account activity
142
   - Check for unauthorized privilege escalation
143

144
MEDIUM-TERM ACTIONS (4-24 hours):
145
1. Forensic analysis
146
   - Analyze Domain Controller logs
147
   - Check for lateral movement indicators
148
   - Review authentication patterns
149

150
2. Hunt for persistence
151
   - Check AdminSDHolder modifications
152
   - Review scheduled tasks and services
153
   - Audit group policy changes
154

155
LONG-TERM ACTIONS (1-7 days):
156
1. Implement monitoring improvements
157
   - Enhanced Kerberos logging
158
   - Behavioral analytics for authentication
159
   - Privileged account monitoring
160

161
2. Security hardening
162
   - Disable RC4 encryption
163
   - Implement PAW (Privileged Access Workstations)
164
   - Enhanced domain controller security
165

166
DETECTION QUERIES:
167

168
Golden Ticket Creation:
169
- Event ID 4769 with Service Name: krbtgt
170
- Encryption Type: RC4 (0x17)
171
- Unusual ticket lifetimes
172

173
Golden Ticket Usage:
174
- Successful authentications with suspicious timing
175
- Cross-domain authentication anomalies
176
- Service access without corresponding TGT requests
177

178
PREVENTION MEASURES:
179
1. Regular krbtgt password rotation (every 180 days)
180
2. Disable RC4 encryption where possible
181
3. Implement Just-in-Time (JIT) admin access
182
4. Use Privileged Identity Management (PIM)
183
5. Monitor for unusual Kerberos activity
184
"""
185

186
        return playbook
187

188
# Integration with Wazuh rules
189
golden_ticket_rules = """
190
<!-- Golden Ticket Detection Rules -->
191
<group name="golden_ticket,kerberos">
192

193
  <!-- Suspicious TGT Request Pattern -->
194
  <rule id="100030" level="12">
195
    <if_sid>60106</if_sid>
196
    <field name="win.eventdata.serviceName">krbtgt</field>
197
    <field name="win.eventdata.ticketEncryptionType">0x17</field>
198
    <field name="win.eventdata.ticketOptions">0x40810010</field>
199
    <description>Potential Golden Ticket attack - Suspicious TGT request pattern</description>
200
    <mitre>
201
      <id>T1558.001</id>
202
    </mitre>
203
  </rule>
204

205
  <!-- Unusual TGT Lifetime -->
206
  <rule id="100031" level="10">
207
    <if_sid>60106</if_sid>
208
    <field name="win.eventdata.serviceName">krbtgt</field>
209
    <field name="win.eventdata.ticketLifetime">^(?!.*[0-6][0-9]{3}$).*</field>
210
    <description>Suspicious TGT with unusual lifetime detected</description>
211
  </rule>
212

213
  <!-- Cross-Domain Golden Ticket -->
214
  <rule id="100032" level="12">
215
    <if_sid>60106</if_sid>
216
    <field name="win.eventdata.serviceName">krbtgt</field>
217
    <field name="win.eventdata.clientAddress">^(?!192\.168\.|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.).*</field>
218
    <description>Potential Golden Ticket from external domain</description>
219
  </rule>
220

221
</group>
222
"""

1
#!/usr/bin/env python3
2
"""
3
DCSync Attack Detection and Response
4
Monitors for DCSync attacks and unauthorized replication requests
5
"""
6

7
import json
8
import requests
9
import time
10
from datetime import datetime, timedelta
11

12
class DCSyncMonitor:
13
    def __init__(self, wazuh_manager, api_token):
14
        self.wazuh_manager = wazuh_manager
15
        self.api_token = api_token
16
        self.headers = {
17
            'Authorization': f'Bearer {api_token}',
18
            'Content-Type': 'application/json'
19
        }
20

21
        # DCSync-related object GUIDs
22
        self.dcsync_guids = {
23
            '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2': 'DS-Replication-Get-Changes',
24
            '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2': 'DS-Replication-Get-Changes-All',
25
            '89e95b76-444d-4c62-991a-0facbeda640c': 'DS-Replication-Get-Changes-In-Filtered-Set'
26
        }
27

28
    def monitor_dcsync_activities(self):
29
        """Monitor for DCSync attack indicators"""
30

31
        while True:
32
            try:
33
                # Query for recent replication events
34
                query = {
35
                    "query": {
36
                        "bool": {
37
                            "must": [
38
                                {"match": {"rule.id": "100003"}},
39
                                {"range": {
40
                                    "timestamp": {
41
                                        "gte": (datetime.now() - timedelta(minutes=5)).isoformat()
42
                                    }
43
                                }}
44
                            ]
45
                        }
46
                    },
47
                    "sort": [{"timestamp": {"order": "desc"}}]
48
                }
49

50
                response = requests.post(
51
                    f"{self.wazuh_manager}/alerts/_search",
52
                    headers=self.headers,
53
                    json=query
54
                )
55

56
                alerts = response.json().get('hits', {}).get('hits', [])
57

58
                for alert in alerts:
59
                    self.analyze_dcsync_alert(alert['_source'])
60

61
                time.sleep(30)  # Check every 30 seconds
62

63
            except Exception as e:
64
                print(f"Error monitoring DCSync activities: {e}")
65
                time.sleep(60)
66

67
    def analyze_dcsync_alert(self, alert):
68
        """Analyze DCSync alert for threat indicators"""
69

70
        analysis = {
71
            'severity': 'HIGH',
72
            'user': alert.get('data', {}).get('win', {}).get('eventdata', {}).get('subjectUserName', 'unknown'),
73
            'source_ip': alert.get('data', {}).get('srcip', 'unknown'),
74
            'timestamp': alert.get('timestamp', ''),
75
            'properties': alert.get('data', {}).get('win', {}).get('eventdata', {}).get('properties', ''),
76
            'object_dn': alert.get('data', {}).get('win', {}).get('eventdata', {}).get('objectDN', ''),
77
            'indicators': []
78
        }
79

80
        # Analyze replication properties
81
        for guid, permission in self.dcsync_guids.items():
82
            if guid in analysis['properties']:
83
                analysis['indicators'].append(f"Requested {permission} permission")
84

85
        # Check if user is authorized for replication
86
        authorized_users = ['DOMAIN$', 'Administrator', 'krbtgt']
87
        if not any(auth_user in analysis['user'] for auth_user in authorized_users):
88
            analysis['indicators'].append("Unauthorized user performing replication")
89
            analysis['severity'] = 'CRITICAL'
90

91
        # Check for suspicious timing
92
        alert_time = datetime.fromisoformat(analysis['timestamp'].replace('Z', '+00:00'))
93
        if alert_time.hour < 6 or alert_time.hour > 22:  # Outside business hours
94
            analysis['indicators'].append("Replication outside business hours")
95

96
        # Generate alert if suspicious
97
        if analysis['indicators']:
98
            self.generate_dcsync_alert(analysis)
99

100
    def generate_dcsync_alert(self, analysis):
101
        """Generate detailed DCSync attack alert"""
102

103
        alert_message = f"""
104
=== DCSYNC ATTACK DETECTED ===
105
Severity: {analysis['severity']}
106
Timestamp: {analysis['timestamp']}
107
User: {analysis['user']}
108
Source IP: {analysis['source_ip']}
109
Object DN: {analysis['object_dn']}
110

111
INDICATORS:
112
"""
113

114
        for indicator in analysis['indicators']:
115
            alert_message += f"- {indicator}\n"
116

117
        alert_message += """
118
IMMEDIATE ACTIONS REQUIRED:
119
1. Disable the compromised user account immediately
120
2. Reset passwords for all privileged accounts
121
3. Check for lateral movement from source IP
122
4. Audit recent administrative actions
123
5. Verify integrity of domain database
124

125
FORENSIC STEPS:
126
1. Capture network traffic from source IP
127
2. Review authentication logs for user
128
3. Check for credential dumping artifacts
129
4. Analyze other systems accessed by this user
130
"""
131

132
        # Send to security team (implement your notification method)
133
        self.send_security_alert(alert_message)
134

135
        # Log to file
136
        with open(f"dcsync_alert_{datetime.now().strftime('%Y%m%d_%H%M%S')}.txt", 'w') as f:
137
            f.write(alert_message)
138

139
    def send_security_alert(self, message):
140
        """Send alert to security team"""
141
        # Implement your notification system
142
        # Examples: Email, Slack, Teams, PagerDuty, etc.
143
        print(message)
144

145
        # Example: Send to Slack
146
        # webhook_url = "https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK"
147
        # payload = {"text": f"🚨 DCSync Attack Detected!\n```{message}```"}
148
        # requests.post(webhook_url, json=payload)
149

150
# DCSync detection rule for Wazuh
151
dcsync_rule = """
152
<group name="dcsync,active_directory">
153

154
  <!-- DCSync Attack Detection -->
155
  <rule id="100003" level="12">
156
    <if_sid>60002</if_sid>
157
    <field name="win.eventdata.properties">.*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2.*</field>
158
    <description>DCSync attack detected - DS-Replication-Get-Changes permission requested</description>
159
    <mitre>
160
      <id>T1003.006</id>
161
    </mitre>
162
  </rule>
163

164
  <!-- DCSync All Changes -->
165
  <rule id="100040" level="14">
166
    <if_sid>60002</if_sid>
167
    <field name="win.eventdata.properties">.*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2.*</field>
168
    <description>Critical DCSync attack - DS-Replication-Get-Changes-All requested</description>
169
    <mitre>
170
      <id>T1003.006</id>
171
    </mitre>
172
  </rule>
173

174
  <!-- Filtered Set Replication -->
175
  <rule id="100041" level="12">
176
    <if_sid>60002</if_sid>
177
    <field name="win.eventdata.properties">.*89e95b76-444d-4c62-991a-0facbeda640c.*</field>
178
    <description>DCSync filtered replication detected</description>
179
    <mitre>
180
      <id>T1003.006</id>
181
    </mitre>
182
  </rule>
183

184
</group>
185
"""
186

187
if __name__ == "__main__":
188
    monitor = DCSyncMonitor(
189
        wazuh_manager="https://wazuh-manager:55000",
190
        api_token="your_api_token"
191
    )
192

193
    print("Starting DCSync monitoring...")
194
    monitor.monitor_dcsync_activities()