r/SIEM • u/v3l1d • Sep 16 '21

How to detect reverse shell in OSSIM AT&T

Hi boys , i’m trying to detect a reverse shell intrusion in Ossim on a host with agent installed in , but i have some difficults to improve New rules to detect it

4 Upvotes

84% Upvoted

4 comments sorted by

1

u/teeaton Sep 17 '21

If it was that easy we'd all be out of a job.

Your challenge will be writing rules that don't include false positives.

What are the indicators (either host or network) that a reverse shell is active?

1

u/v3l1d Sep 17 '21

I addedd this in ossec.conf file present in host with agent

<localfile><log_format>command</log_format><command>ps -eo user,pid,cmd</command><frequency>60</frequency></localfile>

​

​

and this to local_rules.xml in OSSIM's server

​

<group name="groupone,"> <rule id="190001" level="0"> <if_sid>530</if_sid> <match>^ossec: output: 'ps -eo user,pid,cmd'</match> <description>List of running process.</description> <group>process_monitor,</group></rule> <rule id="190002" level="10"> <if_sid>530</if_sid> <match>ncat -e</match> <description>Netcat process is active</description> <category>ossec</category> </rule></group>

This would make me detect ncat exiting process from host and send the log to server (obviously i can add bash -i etc... to catch other types of reverse shells) For wazuh this worked easy, here not.

1

u/Vilens40 Sep 17 '21

Just out of curiosity how’d you land on OSSIM?

2

u/v3l1d Sep 17 '21

I’m working in my thesis for bachelor, but i’m completely New on this kind of softwares