crowdsecurity · bouddha-fr · Jan 9, 2025 · Jan 9, 2025 · Jan 9, 2025 · Jan 9, 2025
diff --git a/collections/bouddha/wazuh.md b/collections/bouddha/wazuh.md
diff --git a/collections/bouddha/wazuh.yaml b/collections/bouddha/wazuh.yaml
@@ -0,0 +1,11 @@
+parsers:
+  - bouddha/wazuh-logs
+scenarios:
+  - bouddha/wazuh-bf
+description: "Wazuh support : parser and brute-force detection"
+author: bouddha
+tags:
+  - soc
+  - security
+  - wazuh
+  - bruteforce
diff --git a/parsers/s01-parse/bouddha/wazuh-logs.md b/parsers/s01-parse/bouddha/wazuh-logs.md
@@ -0,0 +1,3 @@
+Wazuh authentication failure parser.
+
+Reference:
diff --git a/parsers/s01-parse/bouddha/wazuh-logs.yaml b/parsers/s01-parse/bouddha/wazuh-logs.yaml
@@ -0,0 +1,25 @@
+name: bouddha/wazuh-logs
+description: "Parse Wazuh web interface logs for failed login attempts"
+filter: "evt.Parsed.program == 'opensearch-dashboards' && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, 'wazuh') in ['', nil]"
+onsuccess: next_stage
+statics:
+  - meta: service
+    value: wazuh
+  - meta: source_ip
+    expression: evt.Unmarshaled.wazuh.req.remoteAddress
+  - meta: log_type
+    expression: |
+        (
+          evt.Unmarshaled.wazuh.type == 'response' &&
+          evt.Unmarshaled.wazuh.method == 'post' &&
+          evt.Unmarshaled.wazuh.statusCode in [401, '401'] &&
+          evt.Unmarshaled.wazuh.req.url == '/auth/login?dataSourceId='
+        ) ? 'wazuh_failed_auth' : ''
+  - meta: timestamp
+    expression: evt.Unmarshaled.wazuh['@timestamp']
+  - meta: status_code
+    expression: evt.Unmarshaled.wazuh.statusCode
+  - meta: url
+    expression: evt.Unmarshaled.wazuh.req.url
+  - target: evt.StrTime
+    expression: evt.Unmarshaled.wazuh['@timestamp']
diff --git a/scenarios/bouddha/wazuh-bf.md b/scenarios/bouddha/wazuh-bf.md
@@ -0,0 +1,3 @@
+Detect failed Wazuh authentications:
+
+ - leakspeed of 10s, capacity of 5 from same IP
diff --git a/scenarios/bouddha/wazuh-bf.yaml b/scenarios/bouddha/wazuh-bf.yaml
@@ -0,0 +1,18 @@
+# Wazuh web auth bruteforce
+type: leaky
+name: bouddha/wazuh-bf
+description: "Detect bruteforce attempts on Wazuh web interface"
+filter: evt.Meta.log_type == 'wazuh_failed_auth'
+leakspeed: "10s"
+capacity: 5
+groupby: evt.Meta.source_ip
+blackhole: 5m
+labels:
+  remediation: true
+  confidence: 3
+  spoofable: 0
+  classification:
+    - attack.T1110
+  behavior: "http:bruteforce"
+  label: "Wazuh Bruteforce"
+  service: wazuh
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		Wazuh authentication failure parser.

		Reference:
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		Detect failed Wazuh authentications:

		- leakspeed of 10s, capacity of 5 from same IP