Regarding Wazuh differences with OSSEC, the Wazuh team is working on updating the documentation to explain those better (and on a new release and installers).
Wazuh new version (2.0, currently found under the master branch) highlights are:
OpenSCAP integrated as part of the agent, allowing users to run OVAL
New WUI on top of Kibana 5, and ...
No, Snort is not designed to log all application and events occurring in a system. A HIDS is not just a NIDS limited to just one host; it's a separate and additional layer of protections that can only be performed locally (like looking at files, processes, logs, and user contexts). Snort doesn't even try to do any of that.
A reasonable approach here might be to see what existing HIDS products do in this regard. If we take OSSEC as an example, per the book on their site has a long list of both files and registry keys that are monitored for changes (P84 in the linked PDF)
In general windows system files are mostly in c:\windows, so a lot of files to be monitored will be in ...
Although my opinion is probably biased here (I am part of the Wazuh team), here is an update on the differences between OSSEC and Wazuh:
Scalability and reliability
• Cluster support for managers to scale horizontally.
• Support for Puppet, Chef, Ansible and Docker deployments.
• TCP support for agent-manager communications.
• Anti-flooding feature ...
They serve different purposes. While a NIDS covers your servers in term of network level traffic it may not be sufficient on its own. For instance any SSL encrypted connection will not be transparent to the NIDS, which means that whatever is sent across to your servers, it won't be able to see it.
Additionally, a HIDS is also a lot more valuable than a ...
Bear in mind that OSSEC is a log-based HIDS. Knowing that, it is clear that OSSEC will be able to react only if someone (eg.: a daemon) adds a log that matches some Buffer Overflow rule.
See the official code example that you've mentioned.
PCI DSS requirement 11.5 requires a change detection mechanism (ie it doesn’t have to be FIM) for modification of files, not devices.
11.5 Deploy a change-detection mechanism (for example, file-integrity monitoring tools) to alert personnel to unauthorized modification
(including changes, additions, and deletions) of critical system
files, configuration ...
How do we measure the signatures efficiency?
You don't want too much false positives, or your users will be impacted for being denied access to legitimate sites. On the other hand, false negatives allows attackers to bypass the filters and attack your infrastructure. So an IDS with the lowest false positives/negatives rates is better than the others.
Wazuh engineer here.
I wonder how Virus are being detected in the first place. If you have some kind of AntiVirus solution, then you can do an integration and have Wazuh process AV alerts (triggering active response to remove malicious files or stop malicious processes).
Having said that, Wazuh can also detect malware looking for IOCs (rootchecks), ...
Wazuh has now rules for Suricata integration, meaning that you can combine best of both worlds in a single solution. NIDS and HIDS greatly complement each other.
You can run a Wazuh agent on your Suricata sensor and configure it to collect Suricata output. Configuration would look something like this:
Maybe it's too late to come up with an answer here. But, I think I should write this to present my approach which might be helpful to the beginners trying to find the catch.
Snort can be configured only as a Network IDS and not Host IDS considering the fact that it's only capable of watching the network traffic and not what happens inside of the HOST.
If you are looking for detection of stage-one attacks (shellcode in a process) there is EMET, WDEG aka EMET II (for Windows) and Lotan (cross-platform).
Leviathan Security has posted on Lotan at least twice here:
In a general sense, you can do this with standard security tools. Note: It would be hard to know ALL the ways to detect this from the VM before such an attack occurred versus after it's gotten access to the Host OS where it would be much easier to detect.
To detect a program while it is trying to escape you would have to be monitoring the VM OS.
To detect ...
IDS, IPS, and Firewall are just names describing the capabilities and purpose and are not technical descriptions. The differences are often murky and how a device is called is also affected by marketing.
Classical passive IDS like snort can be used inline too to prevent attacks and thus magically get an IPS. And IPS which are just used to watch but not ...
What you're doing wrong is assuming that multiple <match> elements in a rule are ANDed when actually they're concatenated. So your rule:-
<rule id="100200" level="0">
<match>Web vulnerability - Backdoors / Web based malware found - eval(base64_decode</match>
HIDS is very much overkill for a home PC unless you are doing something super-sensitive. More importantly though, HIDS is reactive and to react, you have to monitor it. So the HIDS app is only a part of the solution. You need event reporting and collation and you need both eyes on the output and a way to do something if you get an event. I've seen far too ...