Derion Crawford 

Honestly, as a cybersecurity analyst to be, I got to say there really is a lot to worry about in the grand scheme of things. I'm not letting my anxiety take over or anything, but there seems to be a lot of holes to cover, and when it comes to network vulnerabilities, you can't cover all of them. Learning new and more ways to protect a network just means there are more ways to break in. Great for me that I'm highly competitive and don't like to get beat at my own game. I'll admit I'm still new to this game, but I'll catch up quick enough. Learning to deploy a SIEM has been a skill of relief and has me ready to learn more and test my skills; I guess a great start to that is this blog post.  
The last few months I've been working on understanding data and security in a way that would roll off the tongue when asked about. A decent amount of projects have been completed, but I honestly think this one can show the growth I developed over the last 6 months. The exploration in this project is great for the overall growth of an analyst's mind. You're able to push your boundaries and questions in a safe environment to make mistakes, and with mistakes comes understanding.  
To start out with my Wazuh environment, I first added more endpoints to the SIEM. I chose the play-server because it was the endpoint with the fewest mods to it. Set up a player server to forward logs to the Wazuh SIEM. Installed sysmon on device to send queries to the Wazuh SIEM to monitor web security. This modification will forward logs from the play server to the blue team station where the SIEM is. Allowing for alerts to come through. After installing Sysmon on the play server, we are able to see the core behaviors of alerts from malicious content. After setting up the baseline for the environment, I was then ready to start with the experimentation.  
Tested ART atomic TTP for access token manipulation on Windows AD01. This experiment was a success; on the podcast Security Weekly, I listened to a topic of discussion last week: token manipulation and how an attacker can gain access to anyone and steal important information. Also, how are tokens getting more expensive but saying the costs are going down, haha? Tested ART atomic TTP data destruction on the Linux system play-server. Data destruction was a TTP that stood out to me in earlier sprints, and I immediately thought about spy movies where you have to wipe the computer clean to make sure information doesn't leak. Though exciting, to think about this experiment was not a success. I couldn't get ART to host the play server even with the instructor's help; it wouldn't allow me to run atomic on the remote server. I tried manually, and it still didn't work. I ran an auditing tool (Lynis) on the Linux play server for security posture improvement. Because I couldn't run any atomics on the play server, I decided to still buff up the endpoint by installing an audit tool to backcheck everything. When I felt that wasn't enough, I added a basic firewall in the mix.  
Out of the 3 experiments I ran, 2 were fully successful, and I believe I learned more from the one that failed than the 2 that were complete. I didn't notice the growth I developed behind the computer. It was fun to actually figure out what the solution to a problem is. trying to create files that don't need to be there or searching and creating commands to try and insert your solution. The experiments that were successful taught about consistency. The more I'm in the CLI, the better I am at navigating. The more tricks I learn, the better I get at speaking the language. Take your time; sometimes I can get real anxious and just want to be done, not saying it's not fun or I'm dreading it; it's just been some years since I accomplished anything, and patience is a virtue. I also feel like I waited too long to ask for help. I feel like we're supposed to just enumerate any problem we have. But if you do get stuck on the road, it's ok to ask for help. in this type of field when configuring or coding 1 little mess-up, a misspelled word, or a finger slip can affect a lot. Cross every T and dot every I. Take your time, and you'll be fine.

Enter fullscreen mode Exit fullscreen mode

  1. Wazuh modification
    https://wazuh.com/platform/siem/
    https://medium.com/@cyberlois/how-i-set-up-a-siem-using-wazuh-f2e833a16374
    https://github.com/SwiftOnSecurity/sysmon-config
    Website that gives instruction on how to navigate the Wazuh SIEM

  2. Ad01 atomic attempt.
    https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.001/T1134.001.yaml

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.001/T1134.001.md
https://www.manageengine.com/products/eventlog/sem/glp/log-analysis-tool.html?camid=470879231&adgid=1301822911771830&kwd=Log%20analyzer&matchtype=p&adid=&network=o&adposition=&loc=49290&placement=&target=&searchquery=lynis%20linux%20audit&kwdmatchtype=bp&msclkid=d7f439babf1f17cb68e153e7bd4e5f7f
shows list of tactics and commands to use to run TTP T1134 .

  1. Play-server atomic attempt. https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md
Shows list of tactics and commands to use to run atomics to show log events in Wazuh SIEM