| 1 | <!-- |
| 2 | - SOCFortress TEMPLATE TO PROVISION agent.conf IN A NEW GROUP |
| 3 | --> |
| 4 | <agent_config> |
| 5 | <labels> |
| 6 | <label key="customer">REPLACE</label> |
| 7 | </labels> |
| 8 | <client_buffer> |
| 9 | <!-- Agent buffer options --> |
| 10 | <disabled>no</disabled> |
| 11 | <queue_size>100000</queue_size> |
| 12 | <events_per_second>1000</events_per_second> |
| 13 | </client_buffer> |
| 14 | <!-- Policy monitoring --> |
| 15 | <rootcheck> |
| 16 | <disabled>no</disabled> |
| 17 | <windows_apps>./shared/win_applications_rcl.txt</windows_apps> |
| 18 | <windows_malware>./shared/win_malware_rcl.txt</windows_malware> |
| 19 | </rootcheck> |
| 20 | <sca> |
| 21 | <enabled>yes</enabled> |
| 22 | <scan_on_start>yes</scan_on_start> |
| 23 | <interval>12h</interval> |
| 24 | <skip_nfs>yes</skip_nfs> |
| 25 | </sca> |
| 26 | <!-- File integrity monitoring --> |
| 27 | <syscheck> |
| 28 | <disabled>no</disabled> |
| 29 | <!-- Frequency that syscheck is executed default every 12 hours --> |
| 30 | <frequency>43200</frequency> |
| 31 | <!-- Default files to be monitored. --> |
| 32 | <directories recursion_level="0" restrict="regedit.exe$|system.ini$|win.ini$">%WINDIR%</directories> |
| 33 | <directories recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedt32.exe|regsvr32.exe|runas.exe|sc.exe|schtasks.exe|sethc.exe|subst.exe$">%WINDIR%\SysNative</directories> |
| 34 | <directories recursion_level="0">%WINDIR%\SysNative\drivers\etc</directories> |
| 35 | <directories recursion_level="0" restrict="WMIC.exe$">%WINDIR%\SysNative\wbem</directories> |
| 36 | <directories recursion_level="0" restrict="powershell.exe$">%WINDIR%\SysNative\WindowsPowerShell\v1.0</directories> |
| 37 | <directories recursion_level="0" restrict="winrm.vbs$">%WINDIR%\SysNative</directories> |
| 38 | <!-- 32-bit programs. --> |
| 39 | <directories recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedit.exe$|regedt32.exe$|regsvr32.exe$|runas.exe$|sc.exe$|schtasks.exe$|sethc.exe$|subst.exe$">%WINDIR%\System32</directories> |
| 40 | <directories recursion_level="0">%WINDIR%\System32\drivers\etc</directories> |
| 41 | <directories recursion_level="0" restrict="WMIC.exe$">%WINDIR%\System32\wbem</directories> |
| 42 | <directories recursion_level="0" restrict="powershell.exe$">%WINDIR%\System32\WindowsPowerShell\v1.0</directories> |
| 43 | <directories recursion_level="0" restrict="winrm.vbs$">%WINDIR%\System32</directories> |
| 44 | <directories realtime="yes">%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup</directories> |
| 45 | <ignore>%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini</ignore> |
| 46 | <ignore type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|.dat$|.log1$|.log2$</ignore> |
| 47 | <!-- Windows registry entries to monitor. --> |
| 48 | <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\batfile</windows_registry> |
| 49 | <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\cmdfile</windows_registry> |
| 50 | <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\comfile</windows_registry> |
| 51 | <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\exefile</windows_registry> |
| 52 | <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\piffile</windows_registry> |
| 53 | <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects</windows_registry> |
| 54 | <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\Directory</windows_registry> |
| 55 | <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\Folder</windows_registry> |
| 56 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Classes\Protocols</windows_registry> |
| 57 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Policies</windows_registry> |
| 58 | <windows_registry>HKEY_LOCAL_MACHINE\Security</windows_registry> |
| 59 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer</windows_registry> |
| 60 | <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry> |
| 61 | <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs</windows_registry> |
| 62 | <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\winreg</windows_registry> |
| 63 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry> |
| 64 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</windows_registry> |
| 65 | <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</windows_registry> |
| 66 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL</windows_registry> |
| 67 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies</windows_registry> |
| 68 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows</windows_registry> |
| 69 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</windows_registry> |
| 70 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components</windows_registry> |
| 71 | <!-- Added by SOCFortress For ETW Tampering --> |
| 72 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security</windows_registry> |
| 73 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application</windows_registry> |
| 74 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System</windows_registry> |
| 75 | <windows_registry arch="both">HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational</windows_registry> |
| 76 | <!-- Windows registry entries to ignore. --> |
| 77 | <registry_ignore>HKEY_LOCAL_MACHINE\Security\Policy\Secrets</registry_ignore> |
| 78 | <registry_ignore>HKEY_LOCAL_MACHINE\Security\SAM\Domains\Account\Users</registry_ignore> |
| 79 | <registry_ignore type="sregex">\Enum$</registry_ignore> |
| 80 | <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\AppCs</registry_ignore> |
| 81 | <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\DHCP</registry_ignore> |
| 82 | <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn</registry_ignore> |
| 83 | <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut</registry_ignore> |
| 84 | <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap</registry_ignore> |
| 85 | <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\Teredo</registry_ignore> |
| 86 | <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PolicyAgent\Parameters\Cache</registry_ignore> |
| 87 | <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</registry_ignore> |
| 88 | <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ADOVMPPackage\Final</registry_ignore> |
| 89 | <!-- SOCFortress FIM Added --> |
| 90 | <directories realtime="yes">c:\users\*</directories> |
| 91 | <ignore type="sregex">\appdata</ignore> |
| 92 | <ignore>c:\users\*\ntuser.*</ignore> |
| 93 | <!-- Frequency for ACL checking (seconds) --> |
| 94 | <windows_audit_interval>60</windows_audit_interval> |
| 95 | <!-- Nice value for Syscheck module --> |
| 96 | <process_priority>10</process_priority> |
| 97 | <!-- Maximum output throughput --> |
| 98 | <max_eps>100</max_eps> |
| 99 | <!-- Database synchronization settings --> |
| 100 | <synchronization> |
| 101 | <enabled>yes</enabled> |
| 102 | <interval>5m</interval> |
| 103 | <max_interval>1h</max_interval> |
| 104 | <max_eps>10</max_eps> |
| 105 | </synchronization> |
| 106 | </syscheck> |
| 107 | <!-- System inventory --> |
| 108 | <wodle name="syscollector"> |
| 109 | <disabled>no</disabled> |
| 110 | <interval>1h</interval> |
| 111 | <scan_on_start>yes</scan_on_start> |
| 112 | <hardware>yes</hardware> |
| 113 | <os>yes</os> |
| 114 | <network>yes</network> |
| 115 | <packages>yes</packages> |
| 116 | <ports all="no">yes</ports> |
| 117 | <processes>yes</processes> |
| 118 | <users>yes</users> |
| 119 | <groups>yes</groups> |
| 120 | <services>yes</services> |
| 121 | <browser_extensions>yes</browser_extensions> |
| 122 | <!-- Database synchronization settings --> |
| 123 | <synchronization> |
| 124 | <max_eps>10</max_eps> |
| 125 | </synchronization> |
| 126 | </wodle> |
| 127 | <!-- CIS policies evaluation --> |
| 128 | <wodle name="cis-cat"> |
| 129 | <disabled>yes</disabled> |
| 130 | <timeout>1800</timeout> |
| 131 | <interval>1d</interval> |
| 132 | <scan-on-start>yes</scan-on-start> |
| 133 | <java_path>\\server\jre\bin\java.exe</java_path> |
| 134 | <ciscat_path>C:\cis-cat</ciscat_path> |
| 135 | </wodle> |
| 136 | <!-- Osquery integration --> |
| 137 | <wodle name="osquery"> |
| 138 | <disabled>yes</disabled> |
| 139 | <run_daemon>yes</run_daemon> |
| 140 | <bin_path>C:\Program Files\osquery\osqueryd</bin_path> |
| 141 | <log_path>C:\Program Files\osquery\log\osqueryd.results.log</log_path> |
| 142 | <config_path>C:\Program Files\osquery\osquery.conf</config_path> |
| 143 | <add_labels>yes</add_labels> |
| 144 | </wodle> |
| 145 | <!-- Active response --> |
| 146 | <active-response> |
| 147 | <disabled>no</disabled> |
| 148 | <ca_store>wpk_root.pem</ca_store> |
| 149 | <ca_verification>yes</ca_verification> |
| 150 | </active-response> |
| 151 | <!-- Log analysis --> |
| 152 | <localfile> |
| 153 | <location>Application</location> |
| 154 | <log_format>eventchannel</log_format> |
| 155 | </localfile> |
| 156 | |
| 157 | <localfile> |
| 158 | <location>Security</location> |
| 159 | <log_format>eventchannel</log_format> |
| 160 | <query>Event/System[EventID != 5145 and EventID != 5156 and EventID != 5447 and |
| 161 | EventID != 4656 and EventID != 4658 and EventID != 4663 and EventID != 4660 and |
| 162 | EventID != 4670 and EventID != 4690 and EventID != 4703 and EventID != 4907 and |
| 163 | EventID != 5152 and EventID != 5157]</query> |
| 164 | </localfile> |
| 165 | |
| 166 | <localfile> |
| 167 | <location>System</location> |
| 168 | <log_format>eventchannel</log_format> |
| 169 | </localfile> |
| 170 | <localfile> |
| 171 | <location>active-response\active-responses.log</location> |
| 172 | <log_format>syslog</log_format> |
| 173 | </localfile> |
| 174 | <localfile> |
| 175 | <location>Microsoft-Windows-Sysmon/Operational</location> |
| 176 | <log_format>eventchannel</log_format> |
| 177 | </localfile> |
| 178 | <localfile> |
| 179 | <location>Windows PowerShell</location> |
| 180 | <log_format>eventchannel</log_format> |
| 181 | </localfile> |
| 182 | <localfile> |
| 183 | <location>Microsoft-Windows-CodeIntegrity/Operational</location> |
| 184 | <log_format>eventchannel</log_format> |
| 185 | </localfile> |
| 186 | <localfile> |
| 187 | <location>Microsoft-Windows-TaskScheduler/Operational</location> |
| 188 | <log_format>eventchannel</log_format> |
| 189 | </localfile> |
| 190 | <localfile> |
| 191 | <location>Microsoft-Windows-PowerShell/Operational</location> |
| 192 | <log_format>eventchannel</log_format> |
| 193 | </localfile> |
| 194 | <localfile> |
| 195 | <location>Microsoft-Windows-Windows Firewall With Advanced Security/Firewall</location> |
| 196 | <log_format>eventchannel</log_format> |
| 197 | </localfile> |
| 198 | <localfile> |
| 199 | <location>Microsoft-Windows-Windows Defender/Operational</location> |
| 200 | <log_format>eventchannel</log_format> |
| 201 | </localfile> |
| 202 | <localfile> |
| 203 | <location>FSecureUltralightSDK</location> |
| 204 | <log_format>eventchannel</log_format> |
| 205 | </localfile> |
| 206 | <wodle name="command"> |
| 207 | <disabled>no</disabled> |
| 208 | <tag>sigcheck</tag> |
| 209 | <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\ossec-agent\active-response\bin\sigcheck.ps1"</command> |
| 210 | <interval>1d</interval> |
| 211 | <ignore_output>yes</ignore_output> |
| 212 | <run_on_start>yes</run_on_start> |
| 213 | <timeout>0</timeout> |
| 214 | </wodle> |
| 215 | <wodle name="command"> |
| 216 | <disabled>no</disabled> |
| 217 | <tag>autoruns</tag> |
| 218 | <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\ossec-agent\active-response\bin\autoruns.ps1"</command> |
| 219 | <interval>1d</interval> |
| 220 | <ignore_output>yes</ignore_output> |
| 221 | <run_on_start>yes</run_on_start> |
| 222 | <timeout>0</timeout> |
| 223 | </wodle> |
| 224 | <wodle name="command"> |
| 225 | <disabled>no</disabled> |
| 226 | <tag>logonsessions</tag> |
| 227 | <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\ossec-agent\active-response\bin\logonsessions.ps1"</command> |
| 228 | <interval>1h</interval> |
| 229 | <ignore_output>yes</ignore_output> |
| 230 | <run_on_start>yes</run_on_start> |
| 231 | <timeout>0</timeout> |
| 232 | </wodle> |
| 233 | <wodle name="command"> |
| 234 | <disabled>no</disabled> |
| 235 | <tag>open-audit</tag> |
| 236 | <command>"C:\Program Files (x86)\ossec-agent\active-response\bin\open_audit.cmd"</command> |
| 237 | <interval>24h</interval> |
| 238 | <ignore_output>yes</ignore_output> |
| 239 | <run_on_start>yes</run_on_start> |
| 240 | <timeout>0</timeout> |
| 241 | </wodle> |
| 242 | <wodle name="command"> |
| 243 | <disabled>no</disabled> |
| 244 | <tag>dll_for_chainsaw</tag> |
| 245 | <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\CLUSTER_NAME\Files\install_dll.ps1"</command> |
| 246 | <interval>24h</interval> |
| 247 | <ignore_output>yes</ignore_output> |
| 248 | <run_on_start>yes</run_on_start> |
| 249 | <timeout>0</timeout> |
| 250 | </wodle> |
| 251 | <wodle name="command"> |
| 252 | <disabled>no</disabled> |
| 253 | <tag>clear_active_responses_logs</tag> |
| 254 | <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\ossec-agent\active-response\bin\clear_active_responses_logs.ps1"</command> |
| 255 | <interval>24h</interval> |
| 256 | <ignore_output>yes</ignore_output> |
| 257 | <run_on_start>yes</run_on_start> |
| 258 | <timeout>0</timeout> |
| 259 | </wodle> |
| 260 | </agent_config> |