Windows ETW Integration with Wazuh: A Comprehensive Production-Ready Guide#

1
<!-- Event Channel Collection -->
2
<localfile>
3
  <location>Microsoft-Windows-Sysmon/Operational</location>
4
  <log_format>eventchannel</log_format>
5
</localfile>
6

7
<!-- Traditional Event Logs -->
8
<localfile>
9
  <location>System</location>
10
  <log_format>eventlog</log_format>
11
</localfile>
12

13
<!-- Event Channel with XPath Filtering -->
14
<localfile>
15
  <location>Security</location>
16
  <log_format>eventchannel</log_format>
17
  <query>Event/System[EventID=4624 or EventID=4625]</query>
18
</localfile>

1
<!-- SilkETW Decoders -->
2
<decoder name="silketw">
3
  <prematch>"Collector":</prematch>
4
</decoder>
5

6
<decoder name="silketw-event">
7
  <parent>silketw</parent>
8
  <regex>"ProviderName":"([^"]+)"</regex>
9
  <order>etw_provider</order>
10
</decoder>
11

12
<!-- ETW Provider-Specific Decoders -->
13

14
<!-- .NET Runtime Events -->
15
<decoder name="etw-dotnet">
16
  <parent>silketw-event</parent>
17
  <prematch>Microsoft-Windows-DotNETRuntime</prematch>
18
  <regex>"EventID":(\d+).*"ProcessID":(\d+).*"ThreadID":(\d+)</regex>
19
  <order>event_id, process_id, thread_id</order>
20
</decoder>
21

22
<!-- LDAP Client Events -->
23
<decoder name="etw-ldap">
24
  <parent>silketw-event</parent>
25
  <prematch>Microsoft-Windows-LDAP-Client</prematch>
26
  <regex>"SearchFilter":"([^"]+)".*"BaseDN":"([^"]+)"</regex>
27
  <order>ldap_filter, base_dn</order>
28
</decoder>
29

30
<!-- DNS Client Events -->
31
<decoder name="etw-dns">
32
  <parent>silketw-event</parent>
33
  <prematch>Microsoft-Windows-DNS-Client</prematch>
34
  <regex>"QueryName":"([^"]+)".*"QueryType":"([^"]+)"</regex>
35
  <order>dns_query, query_type</order>
36
</decoder>
37

38
<!-- PowerShell Events -->
39
<decoder name="etw-powershell">
40
  <parent>silketw-event</parent>
41
  <prematch>Microsoft-Windows-PowerShell</prematch>
42
  <regex>"ScriptBlockText":"([^"]+)"</regex>
43
  <order>powershell_script</order>
44
</decoder>
45

46
<!-- WinINet HTTP Events -->
47
<decoder name="etw-wininet">
48
  <parent>silketw-event</parent>
49
  <prematch>Microsoft-Windows-WinINet</prematch>
50
  <regex>"URL":"([^"]+)".*"Method":"([^"]+)"</regex>
51
  <order>http_url, http_method</order>
52
</decoder>
53

54
<!-- Process and Thread Events -->
55
<decoder name="etw-process">
56
  <parent>silketw-event</parent>
57
  <prematch>Microsoft-Windows-Kernel-Process</prematch>
58
  <regex>"ProcessName":"([^"]+)".*"CommandLine":"([^"]+)"</regex>
59
  <order>process_name, command_line</order>
60
</decoder>

1
<group name="etw,windows,">
2
  <!-- Base ETW Rules -->
3
  <rule id="200000" level="0">
4
    <decoded_as>silketw</decoded_as>
5
    <description>SilkETW events grouped</description>
6
    <group>etw,</group>
7
  </rule>
8

9
  <!-- .NET Runtime Security Rules -->
10
  <rule id="200001" level="5">
11
    <if_sid>200000</if_sid>
12
    <field name="etw_provider">Microsoft-Windows-DotNETRuntime</field>
13
    <field name="event_id">200</field>
14
    <description>ETW: .NET assembly loaded - $(process_name)</description>
15
    <group>dotnet,assembly_load,</group>
16
  </rule>
17

18
  <rule id="200002" level="7">
19
    <if_sid>200001</if_sid>
20
    <match>System.Reflection|PowerShellRunner|Invoke-</match>
21
    <description>ETW: Suspicious .NET assembly load - potential PowerShell injection</description>
22
    <group>dotnet,powershell_injection,</group>
23
  </rule>
24

25
  <!-- LDAP Query Monitoring -->
26
  <rule id="200010" level="4">
27
    <if_sid>200000</if_sid>
28
    <field name="etw_provider">Microsoft-Windows-LDAP-Client</field>
29
    <description>ETW: LDAP query executed - $(ldap_filter)</description>
30
    <group>ldap,reconnaissance,</group>
31
  </rule>
32

33
  <rule id="200011" level="8">
34
    <if_sid>200010</if_sid>
35
    <field name="ldap_filter" type="pcre2">objectClass=\*|adminCount=1|\(memberOf=</field>
36
    <description>ETW: Suspicious LDAP query - $(ldap_filter)</description>
37
    <group>ldap,privilege_escalation,</group>
38
  </rule>
39

40
  <!-- DNS Monitoring -->
41
  <rule id="200020" level="3">
42
    <if_sid>200000</if_sid>
43
    <field name="etw_provider">Microsoft-Windows-DNS-Client</field>
44
    <description>ETW: DNS query - $(dns_query)</description>
45
    <group>dns,</group>
46
  </rule>
47

48
  <rule id="200021" level="6">
49
    <if_sid>200020</if_sid>
50
    <list field="dns_query" lookup="address_match_key">etc/lists/suspicious_domains</list>
51
    <description>ETW: DNS query to suspicious domain - $(dns_query)</description>
52
    <group>dns,suspicious_domain,</group>
53
  </rule>
54

55
  <!-- PowerShell Script Block Logging -->
56
  <rule id="200030" level="5">
57
    <if_sid>200000</if_sid>
58
    <field name="etw_provider">Microsoft-Windows-PowerShell</field>
59
    <description>ETW: PowerShell script execution detected</description>
60
    <group>powershell,script_execution,</group>
61
  </rule>
62

63
  <rule id="200031" level="10">
64
    <if_sid>200030</if_sid>
65
    <field name="powershell_script" type="pcre2">Invoke-Expression|IEX|DownloadString|WebClient|System\.Net</field>
66
    <description>ETW: Suspicious PowerShell script - potential malware</description>
67
    <group>powershell,malicious_script,</group>
68
  </rule>
69

70
  <!-- HTTP Traffic Monitoring -->
71
  <rule id="200040" level="4">
72
    <if_sid>200000</if_sid>
73
    <field name="etw_provider">Microsoft-Windows-WinINet</field>
74
    <description>ETW: HTTP request - $(http_method) $(http_url)</description>
75
    <group>http,network,</group>
76
  </rule>
77

78
  <rule id="200041" level="7">
79
    <if_sid>200040</if_sid>
80
    <field name="http_url" type="pcre2">\.exe$|\.dll$|\.bat$|\.ps1$</field>
81
    <description>ETW: HTTP request for executable file - $(http_url)</description>
82
    <group>http,malware_download,</group>
83
  </rule>
84

85
  <!-- Process Creation via ETW -->
86
  <rule id="200050" level="3">
87
    <if_sid>200000</if_sid>
88
    <field name="etw_provider">Microsoft-Windows-Kernel-Process</field>
89
    <description>ETW: Process created - $(process_name)</description>
90
    <group>process_creation,</group>
91
  </rule>
92

93
  <rule id="200051" level="8">
94
    <if_sid>200050</if_sid>
95
    <field name="process_name" type="pcre2">powershell\.exe|cmd\.exe|rundll32\.exe</field>
96
    <field name="command_line" type="pcre2">-enc|-encoded|-e |bypass|unrestricted</field>
97
    <description>ETW: Suspicious process execution - $(process_name) $(command_line)</description>
98
    <group>process_creation,suspicious_execution,</group>
99
  </rule>
100

101
  <!-- Correlation Rules -->
102
  <rule id="200100" level="12" frequency="3" timeframe="300">
103
    <if_matched_group>dotnet,powershell_injection</if_matched_group>
104
    <same_field>process_id</same_field>
105
    <description>ETW: Multiple suspicious .NET activities in same process</description>
106
    <group>correlation,multi_stage_attack,</group>
107
  </rule>
108

109
  <rule id="200101" level="10">
110
    <if_matched_sid>200011</if_matched_sid>
111
    <if_matched_sid>200031</if_matched_sid>
112
    <same_field>process_id</same_field>
113
    <description>ETW: LDAP enumeration followed by PowerShell execution</description>
114
    <group>correlation,reconnaissance_and_execution,</group>
115
  </rule>
116
</group>

1
# Suspicious domains for DNS monitoring
2
# Format: domain:description
3
evil.com:Known malicious domain
4
c2server.net:Command and control server
5
malware-download.org:Malware hosting
6
phishing-site.com:Phishing domain

1
<ETWCollector>
2
  <Guid>12345678-1234-1234-1234-123456789ABC</Guid>
3
  <CollectorType>user</CollectorType>
4
  <ProviderName>Microsoft-Windows-DotNETRuntime</ProviderName>
5
  <UserTraceEventLevel>informational</UserTraceEventLevel>
6
  <UserKeywords>0x8</UserKeywords>
7
  <OutputType>eventlog</OutputType>
8
  <FilterOption>EventName</FilterOption>
9
  <FilterValue>AssemblyDCStart|AssemblyLoad</FilterValue>
10
</ETWCollector>

1
<rule id="200200" level="12">
2
  <if_sid>200030</if_sid>
3
  <field name="powershell_script" type="pcre2">Add-Type.*DllImport|VirtualAlloc|WriteProcessMemory</field>
4
  <description>ETW: PowerShell process injection detected</description>
5
  <group>powershell,process_injection,</group>
6
</rule>

1
<rule id="200210" level="9" frequency="10" timeframe="60">
2
  <if_sid>200010</if_sid>
3
  <same_field>process_id</same_field>
4
  <description>ETW: Rapid LDAP enumeration detected</description>
5
  <group>ldap,enumeration,</group>
6
</rule>

1
Performance Recommendations:
2
  CPU Usage:
3
    - Limit concurrent providers: 5-10 maximum
4
    - Use targeted keyword filtering
5
    - Monitor CPU impact regularly
6

7
  Memory Usage:
8
    - Set appropriate buffer sizes
9
    - Implement log rotation
10
    - Monitor memory consumption
11

12
  Disk I/O:
13
    - Use fast storage for ETL files
14
    - Implement compression where possible
15
    - Regular cleanup of old files
16

17
  Network:
18
    - Batch event forwarding
19
    - Use compression for log shipping
20
    - Consider local buffering

1
#!/usr/bin/env python3
2
# etw_health_monitor.py - Monitor ETW collection health
3

4
import json
5
import time
6
import requests
7
import win32evtlog
8
import win32con
9
from datetime import datetime, timedelta
10

11
class ETWHealthMonitor:
12
    def __init__(self, config_file="etw_monitor_config.json"):
13
        self.config = self.load_config(config_file)
14
        self.metrics = {
15
            "events_per_minute": {},
16
            "provider_health": {},
17
            "error_count": 0,
18
            "last_check": None
19
        }
20

21
    def load_config(self, config_file):
22
        """Load monitoring configuration"""
23
        try:
24
            with open(config_file, 'r') as f:
25
                return json.load(f)
26
        except FileNotFoundError:
27
            return {
28
                "providers": [
29
                    "Microsoft-Windows-DotNETRuntime",
30
                    "Microsoft-Windows-LDAP-Client",
31
                    "Microsoft-Windows-DNS-Client"
32
                ],
33
                "alert_thresholds": {
34
                    "events_per_minute_min": 1,
35
                    "events_per_minute_max": 1000,
36
                    "error_rate_max": 0.1
37
                },
38
                "webhook_url": None
39
            }
40

41
    def check_silketw_service(self):
42
        """Check SilkETW service status"""
43
        try:
44
            # Check Windows service
45
            import win32service
46
            import win32serviceutil
47

48
            status = win32serviceutil.QueryServiceStatus("SilkService")
49
            return status[1] == win32service.SERVICE_RUNNING
50
        except:
51
            return False
52

53
    def check_event_volume(self):
54
        """Monitor ETW event volume"""
55
        try:
56
            # Check SilkService-Log event log
57
            hand = win32evtlog.OpenEventLog(None, "SilkService-Log")
58

59
            # Get events from last 5 minutes
60
            flags = win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ
61
            events = win32evtlog.ReadEventLog(hand, flags, 0)
62

63
            recent_events = 0
64
            five_minutes_ago = datetime.now() - timedelta(minutes=5)
65

66
            for event in events:
67
                if datetime.fromtimestamp(event.TimeGenerated) > five_minutes_ago:
68
                    recent_events += 1
69

70
            win32evtlog.CloseEventLog(hand)
71

72
            events_per_minute = recent_events / 5
73
            self.metrics["events_per_minute"]["current"] = events_per_minute
74

75
            return events_per_minute
76

77
        except Exception as e:
78
            self.metrics["error_count"] += 1
79
            print(f"Error checking event volume: {e}")
80
            return 0
81

82
    def check_provider_health(self):
83
        """Check health of individual ETW providers"""
84
        healthy_providers = 0
85

86
        for provider in self.config["providers"]:
87
            # Check if provider is generating events
88
            try:
89
                # Implementation would check recent events from each provider
90
                # For brevity, using placeholder logic
91
                is_healthy = self.check_provider_activity(provider)
92
                self.metrics["provider_health"][provider] = is_healthy
93

94
                if is_healthy:
95
                    healthy_providers += 1
96

97
            except Exception as e:
98
                print(f"Error checking provider {provider}: {e}")
99
                self.metrics["provider_health"][provider] = False
100

101
        return healthy_providers / len(self.config["providers"])
102

103
    def check_provider_activity(self, provider_name):
104
        """Check if specific provider is active"""
105
        # Placeholder - would implement actual provider activity check
106
        return True
107

108
    def send_alert(self, alert_message):
109
        """Send alert notification"""
110
        if self.config.get("webhook_url"):
111
            try:
112
                payload = {
113
                    "text": f"ETW Monitoring Alert: {alert_message}",
114
                    "timestamp": datetime.now().isoformat(),
115
                    "metrics": self.metrics
116
                }
117

118
                response = requests.post(
119
                    self.config["webhook_url"],
120
                    json=payload,
121
                    timeout=10
122
                )
123

124
                print(f"Alert sent: {response.status_code}")
125
            except Exception as e:
126
                print(f"Failed to send alert: {e}")
127
        else:
128
            print(f"ALERT: {alert_message}")
129

130
    def run_health_check(self):
131
        """Run comprehensive health check"""
132
        print(f"Running ETW health check at {datetime.now()}")
133

134
        # Check service status
135
        service_running = self.check_silketw_service()
136
        if not service_running:
137
            self.send_alert("SilkETW service is not running")
138
            return False
139

140
        # Check event volume
141
        events_per_minute = self.check_event_volume()
142
        min_threshold = self.config["alert_thresholds"]["events_per_minute_min"]
143
        max_threshold = self.config["alert_thresholds"]["events_per_minute_max"]
144

145
        if events_per_minute < min_threshold:
146
            self.send_alert(f"Low ETW event volume: {events_per_minute}/min (threshold: {min_threshold})")
147
        elif events_per_minute > max_threshold:
148
            self.send_alert(f"High ETW event volume: {events_per_minute}/min (threshold: {max_threshold})")
149

150
        # Check provider health
151
        provider_health_ratio = self.check_provider_health()
152
        if provider_health_ratio < 0.8:
153
            self.send_alert(f"ETW provider health degraded: {provider_health_ratio:.1%} healthy")
154

155
        self.metrics["last_check"] = datetime.now().isoformat()
156

157
        print(f"Health check completed - Events/min: {events_per_minute}, Provider health: {provider_health_ratio:.1%}")
158
        return True
159

160
    def continuous_monitoring(self, interval_minutes=5):
161
        """Run continuous health monitoring"""
162
        print(f"Starting continuous ETW monitoring (interval: {interval_minutes} minutes)")
163

164
        while True:
165
            try:
166
                self.run_health_check()
167
                time.sleep(interval_minutes * 60)
168
            except KeyboardInterrupt:
169
                print("Monitoring stopped by user")
170
                break
171
            except Exception as e:
172
                print(f"Monitoring error: {e}")
173
                time.sleep(60)  # Wait 1 minute on error
174

175
def main():
176
    monitor = ETWHealthMonitor()
177
    monitor.continuous_monitoring()
178

179
if __name__ == "__main__":
180
    main()