3

As far as I know, OSSEC is a Open Source HIDS. It's a "Detection System". I read in journals, it collect logs and flag any anomaly that had been found in a system ( e.g. Debian Server ) and do some action with it.

Some of the OSSEC's rules, there's like a possible way for prevent the anomaly for doing it action like, prevent brute force by blocking an IP for 600 seconds if the authentication failed 2 times.

Is there any rules, or some active-response command that would stop some virus or anomaly from spreading, infect and crushing our system. Is there ever any demostration regarding those condition ? where could i find it ?

what i have tried is like blocking an ip for brute force attack (FTP, SSH), but what about if the hacker are in some condition could prevent the ossec rules blocking ip, and he started to spread some unwanted files/document as known as virus ? Is there any footage or demonstration about that ?

My question, How can OSSEC handle a virus that already spreading ? OSSEC is just like detect the anomaly and do some action. Is it possible ?

Improve this question
17
  • 1
    By "spreads to the deepest systems" do you mean a rootkit?
    – forest
    Apr 3, 2018 at 19:39
  • 1
    OSSEC cannot protect from that in any way. A rootkit is able to modify the memory of any HIDS at will and hook any interface they use for monitoring the system.
    – forest
    Apr 3, 2018 at 21:46
  • 1
    If a (kernel) rootkit is on the system, aka "spread to the deepest levels", then no, no HIDS can protect from that.
    – forest
    Apr 3, 2018 at 21:58
  • 2
    No program can solve that issue. If the kernel is owned, you are owned.
    – forest
    Apr 3, 2018 at 22:05
  • 1
    It sounds like you want mandatory access controls, not a HIDS.
    – forest
    Apr 3, 2018 at 22:19

2 Answers 2

Reset to default
3
+25

Yes, basically you've answered your own question. Active response allows you to run any commands. Since it accepts executables, start with shell scripts, chmod it and the script will run when the corresponding trigger comes. Then you can enhance it further with python scripting to do more things not possible by bash. You'll need some programming but because active-response allows any executable to handle the triggers, the possibilities are endless.

Start here:

  1. http://ossec-docs.readthedocs.io/en/latest/syntax/head_ossec_config.active-response.html
  2. https://github.com/ossec/ossec-docs/blob/master/docs/syntax/example_ossec_config.active-response.trst
Improve this answer
5
  • Do you know some rules example with active-respobse configuration that can handle those sitution ? I mean like a tutorial about that on the internet..
    – gagantous
    Apr 5, 2018 at 22:11
  • The links i've shared should definitely get you started on this.
    – Sangram Kesari Ray
    Apr 5, 2018 at 22:39
  • I am not quite sure how this (awesome by the way) feature will help in this situation at all. If the system is infected and the kernel is probably owned no script will ever be able to do anything. Once the virus is that deep inside the system ossec should not be relied on to secure everything again.
    – Nico
    Apr 10, 2018 at 12:23
  • @SangramKesariRay but i could find any active-response that delete any malicious file, it just like blocking, shutdown server, and i am not quite familiar with phyton language
    – gagantous
    Apr 11, 2018 at 12:02
  • any bash script should work, try in a VM, trigger an alert, which runs a bash script that creates a log file, start small, create just an empty file. Since we know which directory we're looking at, we can then parse those /var/logs files to find the file-name to delete. If found we can delete it. These all tasks shall be easier with Python, but can be done in Bash and grep and utilities like $rm -fr. First try to create a file, next delete file will come easy. Hope this helps!
    – Sangram Kesari Ray
    Apr 11, 2018 at 18:28
2

Suppose the exploit was from someone skilled, there might have been some skilled workarounds involving your IDS. Even then you may still not find what you are looking for, I would suggest a fresh restart. Otherwise, I, for one, wouldn't feel entirely sure all implementations were gone, given that it's a deep virus.

I believe that finding the source of exploit or catching an intruder in the act becomes unworthy of your time and attention at a certain point. However, that's just my personal experience and a voice speaking to how difficult perpetrators, in general, can be caught.

You might also start to use VMs with offsite backups. That way, you are further compartmentalized from the root system and functions while retaining the ability to recover from a hit with a few clicks.

On to the next. See @forest comments.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .