Advanced File Integrity Monitoring with Wazuh: Configuration and Forensic Analysis#

1
#!/usr/bin/env python3
2
"""
3
Advanced FIM Forensic Analysis Tool
4
Analyzes Wazuh FIM events for security incidents and compliance
5
"""
6

7
import json
8
import pandas as pd
9
import matplotlib.pyplot as plt
10
import seaborn as sns
11
import hashlib
12
import os
13
from datetime import datetime, timedelta
14
from collections import defaultdict
15
import networkx as nx
16

17
class FIMForensicAnalyzer:
18
    def __init__(self, wazuh_api):
19
        self.wazuh_api = wazuh_api
20
        self.event_types = {
21
            'added': 'File Added',
22
            'modified': 'File Modified',
23
            'deleted': 'File Deleted',
24
            'moved': 'File Moved',
25
            'registry_added': 'Registry Key Added',
26
            'registry_modified': 'Registry Key Modified',
27
            'registry_deleted': 'Registry Key Deleted'
28
        }
29

30
        self.risk_scores = {
31
            '/etc/passwd': 10,
32
            '/etc/shadow': 10,
33
            '/etc/sudoers': 9,
34
            'C:\\Windows\\System32': 8,
35
            '/bin': 8,
36
            '/sbin': 8,
37
            'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run': 9
38
        }
39

40
    def extract_fim_events(self, start_time, end_time, agent_id=None):
41
        """Extract FIM events for analysis"""
42

43
        query = {
44
            "query": {
45
                "bool": {
46
                    "must": [
47
                        {"range": {"rule.id": {"gte": 550, "lte": 599}}},
48
                        {"range": {
49
                            "timestamp": {
50
                                "gte": start_time.isoformat(),
51
                                "lte": end_time.isoformat()
52
                            }
53
                        }}
54
                    ]
55
                }
56
            },
57
            "sort": [{"timestamp": {"order": "asc"}}],
58
            "size": 10000
59
        }
60

61
        if agent_id:
62
            query["query"]["bool"]["must"].append({"match": {"agent.id": agent_id}})
63

64
        response = self.wazuh_api.search_alerts(query)
65

66
        events = []
67
        for hit in response['hits']['hits']:
68
            event = hit['_source']
69

70
            # Extract FIM-specific data
71
            syscheck_data = event.get('syscheck', {})
72

73
            fim_event = {
74
                'timestamp': event['timestamp'],
75
                'agent_id': event.get('agent', {}).get('id', ''),
76
                'agent_name': event.get('agent', {}).get('name', ''),
77
                'rule_id': event.get('rule', {}).get('id', ''),
78
                'rule_description': event.get('rule', {}).get('description', ''),
79
                'file_path': syscheck_data.get('path', ''),
80
                'event_type': syscheck_data.get('event', ''),
81
                'file_size': syscheck_data.get('size_after', 0),
82
                'permissions': syscheck_data.get('perm_after', ''),
83
                'owner': syscheck_data.get('uid_after', ''),
84
                'group': syscheck_data.get('gid_after', ''),
85
                'md5_before': syscheck_data.get('md5_before', ''),
86
                'md5_after': syscheck_data.get('md5_after', ''),
87
                'sha1_before': syscheck_data.get('sha1_before', ''),
88
                'sha1_after': syscheck_data.get('sha1_after', ''),
89
                'sha256_before': syscheck_data.get('sha256_before', ''),
90
                'sha256_after': syscheck_data.get('sha256_after', ''),
91
                'diff': syscheck_data.get('diff', ''),
92
                'changed_attributes': syscheck_data.get('changed_attributes', [])
93
            }
94

95
            # Calculate risk score
96
            fim_event['risk_score'] = self.calculate_risk_score(fim_event)
97

98
            events.append(fim_event)
99

100
        return events
101

102
    def calculate_risk_score(self, event):
103
        """Calculate risk score for FIM event"""
104

105
        base_score = 1
106
        file_path = event['file_path']
107
        event_type = event['event_type']
108

109
        # Path-based scoring
110
        for risky_path, score in self.risk_scores.items():
111
            if risky_path in file_path:
112
                base_score += score
113
                break
114

115
        # Event type scoring
116
        if event_type in ['added', 'deleted']:
117
            base_score += 2
118
        elif event_type == 'modified':
119
            base_score += 1
120

121
        # File extension scoring
122
        if file_path.endswith(('.exe', '.dll', '.so', '.bin')):
123
            base_score += 3
124
        elif file_path.endswith(('.sh', '.bat', '.ps1', '.py')):
125
            base_score += 2
126
        elif file_path.endswith(('.conf', '.config', '.cfg')):
127
            base_score += 1
128

129
        # Permission changes
130
        if 'permission' in event.get('changed_attributes', []):
131
            base_score += 2
132

133
        # Owner changes
134
        if 'ownership' in event.get('changed_attributes', []):
135
            base_score += 3
136

137
        return min(base_score, 10)  # Cap at 10
138

139
    def analyze_attack_patterns(self, events):
140
        """Analyze events for attack patterns"""
141

142
        df = pd.DataFrame(events)
143

144
        if df.empty:
145
            return {'message': 'No events to analyze'}
146

147
        # Convert timestamp to datetime
148
        df['timestamp'] = pd.to_datetime(df['timestamp'])
149

150
        patterns = {
151
            'timeline_analysis': self.analyze_timeline_patterns(df),
152
            'file_analysis': self.analyze_file_patterns(df),
153
            'agent_analysis': self.analyze_agent_patterns(df),
154
            'hash_analysis': self.analyze_hash_changes(df),
155
            'privilege_escalation': self.detect_privilege_escalation(df),
156
            'lateral_movement': self.detect_lateral_movement(df),
157
            'persistence_mechanisms': self.detect_persistence_mechanisms(df),
158
            'data_exfiltration': self.detect_data_exfiltration(df)
159
        }
160

161
        return patterns
162

163
    def analyze_timeline_patterns(self, df):
164
        """Analyze temporal patterns in FIM events"""
165

166
        timeline = {
167
            'total_events': len(df),
168
            'event_types': df['event_type'].value_counts().to_dict(),
169
            'hourly_distribution': df.groupby(df['timestamp'].dt.hour).size().to_dict(),
170
            'daily_distribution': df.groupby(df['timestamp'].dt.date).size().to_dict(),
171
            'peak_activity': None,
172
            'unusual_patterns': []
173
        }
174

175
        # Find peak activity
176
        hourly_counts = df.groupby(df['timestamp'].dt.hour).size()
177
        if not hourly_counts.empty:
178
            peak_hour = hourly_counts.idxmax()
179
            peak_count = hourly_counts.max()
180
            timeline['peak_activity'] = {
181
                'hour': peak_hour,
182
                'count': peak_count
183
            }
184

185
            # Detect unusual activity patterns
186
            if peak_hour < 6 or peak_hour > 22:
187
                timeline['unusual_patterns'].append(f"High activity during off-hours (hour {peak_hour})")
188

189
            if peak_count > df.shape[0] * 0.3:  # More than 30% of activity in one hour
190
                timeline['unusual_patterns'].append(f"Concentrated activity burst ({peak_count} events in hour {peak_hour})")
191

192
        # Detect rapid changes
193
        df_sorted = df.sort_values('timestamp')
194
        time_diffs = df_sorted['timestamp'].diff().dt.total_seconds()
195
        rapid_changes = (time_diffs < 5).sum()  # Changes within 5 seconds
196

197
        if rapid_changes > 10:
198
            timeline['unusual_patterns'].append(f"Rapid file changes detected ({rapid_changes} events within 5 seconds)")
199

200
        return timeline
201

202
    def analyze_file_patterns(self, df):
203
        """Analyze file-specific patterns"""
204

205
        file_analysis = {
206
            'most_affected_paths': df['file_path'].value_counts().head(10).to_dict(),
207
            'file_extensions': defaultdict(int),
208
            'large_files': [],
209
            'system_files_affected': 0,
210
            'suspicious_files': []
211
        }
212

213
        # Analyze file extensions
214
        for path in df['file_path']:
215
            if '.' in path:
216
                ext = os.path.splitext(path)[1].lower()
217
                file_analysis['file_extensions'][ext] += 1
218

219
        # Analyze file sizes
220
        for _, row in df.iterrows():
221
            if row['file_size'] > 100 * 1024 * 1024:  # > 100MB
222
                file_analysis['large_files'].append({
223
                    'path': row['file_path'],
224
                    'size': row['file_size'],
225
                    'timestamp': row['timestamp']
226
                })
227

228
        # Count system files
229
        system_paths = ['/etc/', '/bin/', '/sbin/', 'C:\\Windows\\System32', 'C:\\Program Files']
230
        for path in df['file_path']:
231
            if any(sys_path in path for sys_path in system_paths):
232
                file_analysis['system_files_affected'] += 1
233

234
        # Detect suspicious files
235
        suspicious_patterns = ['.exe', '.dll', '.scr', '.bat', '.cmd', '.ps1', '.vbs']
236
        for _, row in df.iterrows():
237
            path = row['file_path']
238
            if (any(pattern in path.lower() for pattern in suspicious_patterns) and
239
                'temp' in path.lower() or 'download' in path.lower()):
240
                file_analysis['suspicious_files'].append({
241
                    'path': path,
242
                    'event_type': row['event_type'],
243
                    'timestamp': row['timestamp'],
244
                    'risk_score': row['risk_score']
245
                })
246

247
        return file_analysis
248

249
    def analyze_hash_changes(self, df):
250
        """Analyze file hash changes for integrity verification"""
251

252
        hash_analysis = {
253
            'files_with_hash_changes': 0,
254
            'suspicious_hash_changes': [],
255
            'hash_patterns': defaultdict(list)
256
        }
257

258
        for _, row in df.iterrows():
259
            if row['md5_before'] and row['md5_after'] and row['md5_before'] != row['md5_after']:
260
                hash_analysis['files_with_hash_changes'] += 1
261

262
                change_info = {
263
                    'file_path': row['file_path'],
264
                    'timestamp': row['timestamp'],
265
                    'md5_before': row['md5_before'],
266
                    'md5_after': row['md5_after'],
267
                    'sha256_before': row['sha256_before'],
268
                    'sha256_after': row['sha256_after'],
269
                    'risk_score': row['risk_score']
270
                }
271

272
                # Flag high-risk hash changes
273
                if row['risk_score'] > 7:
274
                    hash_analysis['suspicious_hash_changes'].append(change_info)
275

276
                # Track hash patterns
277
                hash_analysis['hash_patterns'][row['md5_after']].append(row['file_path'])
278

279
        # Detect files with identical hashes (possible duplicate/spreading malware)
280
        duplicate_hashes = {hash_val: files for hash_val, files in hash_analysis['hash_patterns'].items() if len(files) > 1}
281
        hash_analysis['duplicate_hashes'] = duplicate_hashes
282

283
        return hash_analysis
284

285
    def detect_privilege_escalation(self, df):
286
        """Detect potential privilege escalation attempts"""
287

288
        escalation_indicators = []
289

290
        # Check for SUID/SGID changes
291
        suid_files = df[df['file_path'].str.contains('/usr/bin/|/bin/|/sbin/|/usr/sbin/', na=False)]
292
        for _, row in suid_files.iterrows():
293
            if 'permission' in row.get('changed_attributes', []):
294
                escalation_indicators.append({
295
                    'type': 'SUID/SGID modification',
296
                    'file': row['file_path'],
297
                    'timestamp': row['timestamp'],
298
                    'details': f"Permissions changed on system binary"
299
                })
300

301
        # Check for sudoers modifications
302
        sudoers_changes = df[df['file_path'].str.contains('sudo', na=False)]
303
        for _, row in sudoers_changes.iterrows():
304
            escalation_indicators.append({
305
                'type': 'Sudoers modification',
306
                'file': row['file_path'],
307
                'timestamp': row['timestamp'],
308
                'details': 'Sudo configuration modified'
309
            })
310

311
        # Check for passwd/shadow modifications
312
        auth_files = df[df['file_path'].str.contains('passwd|shadow', na=False)]
313
        for _, row in auth_files.iterrows():
314
            escalation_indicators.append({
315
                'type': 'Authentication file modification',
316
                'file': row['file_path'],
317
                'timestamp': row['timestamp'],
318
                'details': 'System authentication file modified'
319
            })
320

321
        return {
322
            'total_indicators': len(escalation_indicators),
323
            'indicators': escalation_indicators
324
        }
325

326
    def detect_persistence_mechanisms(self, df):
327
        """Detect persistence mechanism establishment"""
328

329
        persistence_indicators = []
330

331
        # Startup folder modifications
332
        startup_patterns = [
333
            'Startup',
334
            'Run',
335
            'RunOnce',
336
            '/etc/init',
337
            'crontab',
338
            'systemd'
339
        ]
340

341
        for pattern in startup_patterns:
342
            matches = df[df['file_path'].str.contains(pattern, case=False, na=False)]
343
            for _, row in matches.iterrows():
344
                persistence_indicators.append({
345
                    'type': f'{pattern} mechanism',
346
                    'file': row['file_path'],
347
                    'timestamp': row['timestamp'],
348
                    'event_type': row['event_type'],
349
                    'details': f'Persistence mechanism via {pattern}'
350
                })
351

352
        # Service modifications
353
        service_matches = df[df['file_path'].str.contains('service|Services', case=False, na=False)]
354
        for _, row in service_matches.iterrows():
355
            persistence_indicators.append({
356
                'type': 'Service modification',
357
                'file': row['file_path'],
358
                'timestamp': row['timestamp'],
359
                'details': 'System service configuration modified'
360
            })
361

362
        return {
363
            'total_indicators': len(persistence_indicators),
364
            'indicators': persistence_indicators
365
        }
366

367
    def generate_forensic_report(self, events, patterns):
368
        """Generate comprehensive forensic report"""
369

370
        report_time = datetime.now().strftime('%Y-%m-%d %H:%M:%S')
371

372
        report = f"""
373
=== FILE INTEGRITY MONITORING FORENSIC REPORT ===
374
Generated: {report_time}
375
Analysis Period: {events[0]['timestamp'] if events else 'N/A'} to {events[-1]['timestamp'] if events else 'N/A'}
376
Total Events Analyzed: {len(events)}
377

378
EXECUTIVE SUMMARY:
379
"""
380

381
        if not events:
382
            report += "No FIM events found in the specified time period.\n"
383
            return report
384

385
        # High-level statistics
386
        high_risk_events = [e for e in events if e['risk_score'] >= 8]
387
        medium_risk_events = [e for e in events if 5 <= e['risk_score'] < 8]
388

389
        report += f"""
390
- High Risk Events: {len(high_risk_events)}
391
- Medium Risk Events: {len(medium_risk_events)}
392
- Total Affected Systems: {len(set(e['agent_name'] for e in events))}
393
- Most Active System: {max(set(e['agent_name'] for e in events), key=lambda x: sum(1 for e in events if e['agent_name'] == x)) if events else 'N/A'}
394
"""
395

396
        # Timeline analysis
397
        timeline = patterns.get('timeline_analysis', {})
398
        report += f"""
399
TIMELINE ANALYSIS:
400
- Peak Activity Hour: {timeline.get('peak_activity', {}).get('hour', 'N/A')}
401
- Events During Peak: {timeline.get('peak_activity', {}).get('count', 'N/A')}
402
- Unusual Patterns: {len(timeline.get('unusual_patterns', []))}
403
"""
404

405
        for pattern in timeline.get('unusual_patterns', []):
406
            report += f"  ⚠️ {pattern}\n"
407

408
        # Security analysis
409
        privilege_esc = patterns.get('privilege_escalation', {})
410
        persistence = patterns.get('persistence_mechanisms', {})
411

412
        report += f"""
413
SECURITY INDICATORS:
414
- Privilege Escalation Indicators: {privilege_esc.get('total_indicators', 0)}
415
- Persistence Mechanism Indicators: {persistence.get('total_indicators', 0)}
416
"""
417

418
        # File analysis
419
        file_analysis = patterns.get('file_analysis', {})
420
        report += f"""
421
FILE ANALYSIS:
422
- System Files Affected: {file_analysis.get('system_files_affected', 0)}
423
- Suspicious Files Detected: {len(file_analysis.get('suspicious_files', []))}
424
- Large Files Modified: {len(file_analysis.get('large_files', []))}
425
"""
426

427
        # Hash analysis
428
        hash_analysis = patterns.get('hash_analysis', {})
429
        report += f"""
430
INTEGRITY ANALYSIS:
431
- Files with Hash Changes: {hash_analysis.get('files_with_hash_changes', 0)}
432
- Suspicious Hash Changes: {len(hash_analysis.get('suspicious_hash_changes', []))}
433
- Files with Duplicate Hashes: {len(hash_analysis.get('duplicate_hashes', {}))}
434
"""
435

436
        # Top risk events
437
        report += f"""
438
TOP 10 HIGH-RISK EVENTS:
439
"""
440

441
        sorted_events = sorted(events, key=lambda x: x['risk_score'], reverse=True)[:10]
442
        for i, event in enumerate(sorted_events, 1):
443
            report += f"""
444
{i}. Risk Score: {event['risk_score']}/10
445
   File: {event['file_path']}
446
   Event: {event['event_type']}
447
   Time: {event['timestamp']}
448
   System: {event['agent_name']}
449
   {'='*50}
450
"""
451

452
        # Recommendations
453
        report += f"""
454
RECOMMENDATIONS:
455

456
IMMEDIATE ACTIONS:
457
1. Investigate high-risk events (score >= 8) immediately
458
2. Verify integrity of critical system files
459
3. Check for unauthorized access on affected systems
460
4. Review user activity during peak event periods
461

462
INVESTIGATION STEPS:
463
1. Correlate FIM events with authentication logs
464
2. Check network connections from affected systems
465
3. Analyze process execution around event timestamps
466
4. Review file contents for malicious code
467
5. Verify digital signatures of modified executables
468

469
LONG-TERM IMPROVEMENTS:
470
1. Tune FIM rules to reduce false positives
471
2. Implement automated response for critical changes
472
3. Enhance monitoring coverage for identified gaps
473
4. Regular baseline updates and integrity verification
474
5. Improve change management processes
475

476
FORENSIC ARTIFACTS TO PRESERVE:
477
- File system snapshots from affected systems
478
- Memory dumps during suspicious activity periods
479
- Network traffic captures
480
- System logs and audit trails
481
- File samples and hash comparisons
482
"""
483

484
        return report
485

486
    def create_visual_analysis(self, events, patterns):
487
        """Create visual analysis charts"""
488

489
        if not events:
490
            return None
491

492
        df = pd.DataFrame(events)
493
        df['timestamp'] = pd.to_datetime(df['timestamp'])
494

495
        fig, axes = plt.subplots(2, 2, figsize=(16, 12))
496

497
        # Timeline of events
498
        timeline_data = df.groupby(df['timestamp'].dt.floor('H')).size()
499
        axes[0, 0].plot(timeline_data.index, timeline_data.values, marker='o')
500
        axes[0, 0].set_title('FIM Events Timeline')
501
        axes[0, 0].set_xlabel('Time')
502
        axes[0, 0].set_ylabel('Event Count')
503
        axes[0, 0].tick_params(axis='x', rotation=45)
504

505
        # Risk score distribution
506
        risk_counts = df['risk_score'].value_counts().sort_index()
507
        axes[0, 1].bar(risk_counts.index, risk_counts.values, color='red', alpha=0.7)
508
        axes[0, 1].set_title('Risk Score Distribution')
509
        axes[0, 1].set_xlabel('Risk Score')
510
        axes[0, 1].set_ylabel('Event Count')
511

512
        # Event types
513
        event_type_counts = df['event_type'].value_counts()
514
        axes[1, 0].pie(event_type_counts.values, labels=event_type_counts.index, autopct='%1.1f%%')
515
        axes[1, 0].set_title('Event Type Distribution')
516

517
        # Top affected systems
518
        agent_counts = df['agent_name'].value_counts().head(10)
519
        axes[1, 1].barh(range(len(agent_counts)), agent_counts.values)
520
        axes[1, 1].set_yticks(range(len(agent_counts)))
521
        axes[1, 1].set_yticklabels(agent_counts.index)
522
        axes[1, 1].set_title('Most Affected Systems')
523
        axes[1, 1].set_xlabel('Event Count')
524

525
        plt.tight_layout()
526

527
        # Save the plot
528
        timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
529
        filename = f'fim_analysis_{timestamp}.png'
530
        plt.savefig(filename, dpi=300, bbox_inches='tight')
531
        plt.close()
532

533
        return filename
534

535
# Usage Example
536
if __name__ == "__main__":
537
    # Initialize forensic analyzer
538
    analyzer = FIMForensicAnalyzer(wazuh_api_client)
539

540
    # Define analysis period
541
    end_time = datetime.now()
542
    start_time = end_time - timedelta(hours=24)
543

544
    print("Extracting FIM events...")
545
    events = analyzer.extract_fim_events(start_time, end_time)
546

547
    print(f"Analyzing {len(events)} FIM events...")
548
    patterns = analyzer.analyze_attack_patterns(events)
549

550
    print("Generating forensic report...")
551
    report = analyzer.generate_forensic_report(events, patterns)
552

553
    # Save report
554
    timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
555
    report_filename = f"fim_forensic_report_{timestamp}.txt"
556

557
    with open(report_filename, 'w') as f:
558
        f.write(report)
559

560
    # Generate visualizations
561
    chart_filename = analyzer.create_visual_analysis(events, patterns)
562

563
    print(f"\nForensic analysis complete!")
564
    print(f"Report saved as: {report_filename}")
565
    print(f"Charts saved as: {chart_filename}")
566
    print(f"Total events analyzed: {len(events)}")
567
    print(f"High-risk events: {len([e for e in events if e['risk_score'] >= 8])}")