{"id":11835,"date":"2022-03-17T22:04:48","date_gmt":"2022-03-17T19:04:48","guid":{"rendered":"https:\/\/kifarunix.com\/?p=11835"},"modified":"2024-03-09T11:09:59","modified_gmt":"2024-03-09T08:09:59","slug":"monitor-process-creation-events-on-windows-systems-using-wazuh-and-elk-stack","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/monitor-process-creation-events-on-windows-systems-using-wazuh-and-elk-stack\/","title":{"rendered":"Monitor Process Creation Events on Windows Systems using Wazuh and ELK stack"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to monitor process creation events on Windows systems using Wazuh and ELK Stack. On Windows systems, when a program runs, a process is created. Process creation events monitoring is paramount in detecting any would-be malicious (malware and threat actor) activities as it gives you more visibility into what is happening within your Windows system environment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Monitor Process Creation Events on Windows Systems using Wazuh and ELK stack<\/h2>\n\n\n\n<p>In order to monitor process creation events on Windows systems, you need to collect the process creation events and push them to Wazuh Manager.<\/p>\n\n\n\n<p>In this tutorial, we will be using Wazuh agents and Sysmon to collect events from various windows event channels including process creation events.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install and Integrate Wazuh Manager with ELK Stack<\/h3>\n\n\n\n<p>Thus before you begin, ensure that you have ELK Stack integrated with Wazuh manager installed and running. See example tutorials below;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/integrate-wazuh-manager-with-elk-stack\/\" target=\"_blank\" rel=\"noreferrer noopener\">Integrate Wazuh Manager with ELK Stack<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-wazuh-server-on-rocky-linux-8\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install Wazuh Server on Rocky Linux 8<\/a><\/p>\n\n\n\n<p>NOTE: We are running ELK 7.14.2 and Wazuh Manager 4.2.5.<\/p>\n\n\n\n<p>Kibana (ELK) version;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/usr\/share\/kibana\/package.json | grep version<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  \"version\": \"7.14.2\",<\/code><\/pre>\n\n\n\n<p>Wazuh Manager version;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/ossec\/bin\/wazuh-control info | grep WAZUH_VERSION<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>WAZUH_VERSION=\"v4.2.5\"<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Install Wazuh Agents on Windows Systems<\/h3>\n\n\n\n<p>In this example setup, I will be using Windows 10 system for demonstration purposes.<\/p>\n\n\n\n<p>To install Wazuh agent on Windows 10 and automatically add it to Wazuh manager, then;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open PowerShell as Administrative user;<\/li>\n\n\n\n<li>Next, download Wazuh agent from <a href=\"https:\/\/packages.wazuh.com\/4.x\/windows\/wazuh-agent-4.2.5-1.msi\" target=\"_blank\" rel=\"noreferrer noopener\">Wazuh agent downloads page<\/a>;<\/li>\n\n\n\n<li>In this example, we have downloaded the agent installer to Downloads folder;<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>cd C:\\Users\\&lt;username&gt;\\Downloads\\<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>To automatically install and register agent, then run the command below. <strong>Replace the IP address 192.168.58.26 with your Wazuh Manager IP address<\/strong>.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>.\\wazuh-agent-4.2.5-1.msi \/q WAZUH_MANAGER=\"192.168.58.26\" WAZUH_REGISTRATION_SERVER=\"192.168.58.26\"<\/code><\/pre>\n\n\n\n<p>Once the installation is done, Wazuh agent is started and enabled to run on system boot.<\/p>\n\n\n\n<p>It should also be showing on the Kibana Wazuh App.<\/p>\n\n\n\n<p>To confirm on Wazuh Manager command line;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/ossec\/bin\/agent_control -l<\/code><\/pre>\n\n\n\n<p>You should see it among the active agents.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install Sysmon on Windows Systems<\/h3>\n\n\n\n<p>In this example setup, we will install Sysmon with a customized SwiftOnSecurity configuration file template with default high-quality event tracing.<\/p>\n\n\n\n<p>Thus;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create <strong>Sysmon<\/strong> directory on <strong>C:\\Program Files<\/strong> folder.<\/li>\n\n\n\n<li>Download <a href=\"https:\/\/github.com\/SwiftOnSecurity\/sysmon-config\/blob\/master\/sysmonconfig-export.xml\" target=\"_blank\" rel=\"noreferrer noopener\">SwiftOnSecurity configuration file<\/a> template and save it under the <strong>C:\\Program Files\\Sysmon<\/strong> created above.<\/li>\n\n\n\n<li>Download Sysmon from the <a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/sysmon\" target=\"_blank\" rel=\"noreferrer noopener\">downloads page<\/a>.<\/li>\n\n\n\n<li>Extract the contents of the zipped Sysmon file to&nbsp;<strong>C:\\Program Files\\Sysmon<\/strong>&nbsp;directory.<\/li>\n\n\n\n<li>Navigate to <strong>C:\\Program Files\\Sysmon<\/strong> and install Sysmon by running the command below;<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>cd C:\\'Program Files'\\Sysmon<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>.\\Sysmon64.exe -i  .\\sysmonconfig-export.xml -accepteula<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>System Monitor v13.33 - System activity monitor\nBy Mark Russinovich and Thomas Garnier\nCopyright (C) 2014-2022 Microsoft Corporation\nUsing libxml2. libxml2 is Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved.\nSysinternals - www.sysinternals.com\n\nLoading configuration file with schema version 4.50\nSysmon schema version: 4.81\nConfiguration file validated.\nSysmon64 installed.\nSysmonDrv installed.\nStarting SysmonDrv.\nSysmonDrv started.\nStarting Sysmon64..\nSysmon64 started.\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Configure Wazuh agent to monitor Sysmon events<\/h3>\n\n\n\n<p>Next, you need to ensure that Wazuh agent can monitor Sysmon events.<\/p>\n\n\n\n<p>Thus, edit Wazuh agent configuration file, <strong><code>C:\\Program Files (x86)\\ossec-agent\\ossec.conf<\/code><\/strong> using your preferred notepad as administrator.<\/p>\n\n\n\n<p>Add the lines below to the config file;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>  &lt;localfile&gt;\n  &lt;location&gt;Microsoft-Windows-Sysmon\/Operational&lt;\/location&gt;\n  &lt;log_format&gt;eventchannel&lt;\/log_format&gt;\n  &lt;\/localfile&gt;\n<\/code><\/pre>\n\n\n\n<p>We put them just before the policy monitoring section;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>...\n  &lt;localfile&gt;\n    &lt;location&gt;active-response\\active-responses.log&lt;\/location&gt;\n    &lt;log_format&gt;syslog&lt;\/log_format&gt;\n  &lt;\/localfile&gt;\n  \n<strong>  &lt;localfile&gt;\n  &lt;location&gt;Microsoft-Windows-Sysmon\/Operational&lt;\/location&gt;\n  &lt;log_format&gt;eventchannel&lt;\/log_format&gt;\n  &lt;\/localfile&gt;<\/strong>\n\n  &lt;!-- Policy monitoring --&gt;\n  &lt;rootcheck&gt;\n    &lt;disabled&gt;no&lt;\/disabled&gt;\n    &lt;windows_apps&gt;.\/shared\/win_applications_rcl.txt&lt;\/windows_apps&gt;\n    &lt;windows_malware&gt;.\/shared\/win_malware_rcl.txt&lt;\/windows_malware&gt;\n  &lt;\/rootcheck&gt;\n  ...\n<\/code><\/pre>\n\n\n\n<p>Save and file once you add the lines.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Update Wazuh manager Rules<\/h3>\n\n\n\n<p>Next, you need to update Wazuh manager rules to process Sysmon events;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>cat &gt&gt; \/var\/ossec\/etc\/rules\/local_rules.xml &lt;&lt; 'EOL'\n&lt;group name=\"sysmon,\"&gt;\n  &lt;rule id=\"220000\" level=\"3\"&gt;\n    &lt;if_group&gt;sysmon&lt;\/if_group&gt;\n    &lt;description&gt;Windows Sysmon event. Event ID: $(win.system.eventID)&lt;\/description&gt;\n    &lt;options&gt;no_full_log&lt;\/options&gt;\n  &lt;\/rule&gt;\n&lt;\/group&gt;\nEOL\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Simulate Process Creation Events<\/h3>\n\n\n\n<p>Next, in order to verify that Wazuh-Sysmon integration can actually collect process creation events, you need to simulate these events and check whether they are appearing on the Kibana Wazuh App dashboard.<\/p>\n\n\n\n<p>To simulate process creation, try to run some programs. For example, let&#8217;s launch Notepad (it can be any program) by clicking the desktop app;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation.png\" class=\"td-modal-image\"><figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1018\" height=\"417\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation.png\" alt=\"Monitor Process Creation Events on Windows Systems using Wazuh and ELK stack\" class=\"wp-image-11847\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation.png?v=1647543486 1018w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-768x315.png?v=1647543486 768w\" sizes=\"(max-width: 1018px) 100vw, 1018px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Once it launches, go to Kibana Wazuh App and check the events sent by the Windows host.<\/p>\n\n\n\n<p>The System Process creation events are identified by <a href=\"https:\/\/www.ultimatewindowssecurity.com\/securitylog\/encyclopedia\/event.aspx?eventid=90001\" target=\"_blank\" rel=\"noreferrer noopener\">Event ID 1<\/a>. Hence, be on the look out for such events. See the event highlighted in the sample screenshot below;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events.png\" alt=\"Monitor Process Creation Events on Windows Systems using Wazuh and ELK stack\" class=\"wp-image-11848\" width=\"1068\" height=\"475\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events.png?v=1647543616 1893w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-768x342.png?v=1647543616 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-1536x684.png?v=1647543616 1536w\" sizes=\"(max-width: 1068px) 100vw, 1068px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>You can as well filter the events based on the ID, for example <strong>data.win.system.eventID: 1<\/strong>.<\/p>\n\n\n\n<p>Read more about Sysmon Events and IDS on <a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/sysmon#events\" target=\"_blank\" rel=\"noreferrer noopener\">Sysmon Events page<\/a>.<\/p>\n\n\n\n<p>Click the highlighted button to expand and see more details about the event including the extracted fields.<\/p>\n\n\n\n<p>When you scroll down the expanded view, you can see the event message. This is where you can see the details about the process created by launching Notepad++ with all the fields in one place.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1872\" height=\"843\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-details.png\" alt=\"\" class=\"wp-image-11849\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-details.png?v=1647543658 1872w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-details-768x346.png?v=1647543658 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-details-1536x692.png?v=1647543658 1536w\" sizes=\"(max-width: 1872px) 100vw, 1872px\" \/><\/figure><\/div>\n\n\n<p>You can also detect the process created by launching a program from powershell. For example, you can launch Notepad++ from Powershell by running;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>'C:\\Program Files\\Notepad++\\notepad++.exe'<\/code><\/pre>\n\n\n\n<p>The events will as well show up on the Kibana Wazuh app events dashboard;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1866\" height=\"734\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell.png\" alt=\"Monitor Process Creation Events on Windows Systems using Wazuh and ELK stack\" class=\"wp-image-11850\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell.png?v=1647543699 1866w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell-768x302.png?v=1647543699 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell-1536x604.png?v=1647543699 1536w\" sizes=\"(max-width: 1866px) 100vw, 1866px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>You can compare the two events above.<\/p>\n\n\n\n<p>Another example is to launch a program from powershell and pass the command line arguments. Example to open a file using Notepad++ from command line;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&amp; 'C:\\Program Files\\Notepad++\\notepad++.exe' 'C:\\Program Files (x86)\\ossec-agent\\ossec.conf'<\/code><\/pre>\n\n\n\n<p>Sample events;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_1.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1846\" height=\"822\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_1.png\" alt=\"Monitor Process Creation Events on Windows Systems using Wazuh and ELK stack\" class=\"wp-image-11851\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_1.png?v=1647543744 1846w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_1-768x342.png?v=1647543744 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_1-1536x684.png?v=1647543744 1536w\" sizes=\"(max-width: 1846px) 100vw, 1846px\" \/><\/figure><\/a><\/div>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_2.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1872\" height=\"717\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_2.png\" alt=\"Monitor Process Creation Events on Windows Systems using Wazuh and ELK stack\" class=\"wp-image-11852\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_2.png?v=1647543770 1872w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_2-768x294.png?v=1647543770 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/wazuh-process-creation-events-powershell_2-1536x588.png?v=1647543770 1536w\" sizes=\"(max-width: 1872px) 100vw, 1872px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>And there you go. That is how you can easily use Wazuh manager to monitor process creation events on Windows systems.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Reference<\/h3>\n\n\n\n<p><a href=\"https:\/\/wazuh.com\/blog\/learn-to-detect-threats-on-windows-by-monitoring-sysmon-events\/\" target=\"_blank\" rel=\"noreferrer noopener\">Detecting threats using Wazuh<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other Tutorials<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/monitor-changes-to-critical-files-on-windows-systems-using-wazuh-and-elk\/\" target=\"_blank\" rel=\"noreferrer noopener\">Monitor Changes to Critical Files on Windows Systems using Wazuh and ELK<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/integrate-osquery-manager-with-elk-stack\/\" target=\"_blank\" rel=\"noreferrer noopener\">Integrate Osquery Manager with ELK Stack<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/monitor-windows-systems-using-elastic-osquery-manager\/\" target=\"_blank\" rel=\"noreferrer noopener\">Monitor Windows Systems using Elastic Osquery Manager<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to monitor process creation events on Windows systems using Wazuh and ELK Stack. On Windows systems, when a<\/p>\n","protected":false},"author":3,"featured_media":11853,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[34,121,72],"tags":[4697,4696,4693,1036,4698,4694,3824,4695],"class_list":["post-11835","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-howtos","category-monitoring","tag-detect-process-creation-events-on-windows","tag-how-to-enable-process-creation-events","tag-monitor-process-creation-on-windows","tag-sysmon","tag-sysmon-events-process-creation","tag-use-sysmon-and-wazuh-to-monitor-process-creation-on-windows","tag-wazuh","tag-windows-process-creation","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/11835"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=11835"}],"version-history":[{"count":9,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/11835\/revisions"}],"predecessor-version":[{"id":20443,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/11835\/revisions\/20443"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/11853"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=11835"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=11835"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=11835"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}