Full transcript
0:00It has been a while since I last got to
0:02play with wasa. And if you aren't
0:04familiar, WAZA is an open-source
0:07security platform. It's like endpoint
0:09detection, response, and security
0:11information event management allin one.
0:13You can spin it up in your own
0:14environment. You can use it to test
0:16different scenarios, look at different
0:17attacks. It's all this awesome stuff
0:20here. Configuration management, malware
0:22detection, file integrity monitoring,
0:23thread hunting, log data analysis,
0:25vulnerability detection, the list goes
0:27on and on. It's super cool. You can spin
0:29it up in your home lab or maybe you use
0:31it for real to protect your business or
0:33organization. But a lot of folks love
0:35Wuzza because Wuzza loves open source
0:38and making this accessible available for
0:40anyone. So I've got it spun up in my own
0:42environment here. And let me show you
0:44what I've got going on. I'll go ahead
0:45and log in. But I mentioned it's been a
0:48little bit since I've been able to go
0:49take a look at what WOA is up to. And
0:51now if I go take a look at the version
0:53here, we're up to version 4.14.1.
0:57And if you haven't been tracking, there
0:58are a lot of really sweet updates in
1:01this new version. Granted, a lot of
1:02these come from the new major release
1:044.14.0,
1:06right? The most recent major release in
1:09October 4.14.0
1:11brings a whole lot of new improvements
1:13to IT hygiene. So, let me show you what
1:16I've got going on here because I have a
1:18lot of virtual machines up and running.
1:19I have one host that's hosting the WASA
1:22server. I have a WA agent installed on
1:24one Windows 11 host. another agent
1:26installed on another Windows 11 host and
1:29another and a Windows 10 host. Now, of
1:32course, you all know Wuzza is extremely
1:34cross-platform. So, you could get an
1:36agent to run on Linux, of course. And if
1:38we were to go take a look at the agents
1:40that I have connected, those four,
1:42Windows 11 as the host name for one of
1:44these and then the other random computer
1:46names, computer host names for the other
1:48Windows hosts. But if we were to deploy
1:50a new agent, you could see this thing
1:51run on Linux, Windows, and Mac.
1:53Installation is super easy, right? We
1:55don't need to cruise through it.
1:56Honestly, you can just fill in the
1:57server address and then copy paste the
2:00invoke command to run this thing. I
2:02won't walk us through deploying an agent
2:03in this video because we've covered it
2:05in a lot of other WASA videos on the
2:07channel. So, check those out if you're
2:08interested. But with the agents
2:10connected, of course, we could drill
2:11down into one and get a lot of
2:14information. You've got all the usual
2:15wuzza visibility on compliance,
2:18vulnerabilities, MITER attack
2:19techniques, top five packages, different
2:21scans, file integrity monitoring, but I
2:24did want to show you some of the coolest
2:26new stuff with IT hygiene. So, I'll
2:29click into this here, but notice that
2:30I'm still pinned to my Windows 11 agent.
2:34Look at all the stuff that we see in the
2:36dashboard, the tab that we're on right
2:38now, between the operating system,
2:39packages that are installed, maybe some
2:41information on the system, running
2:43processes, CPU information, but this is
2:46all in the context currently of just one
2:49agent. Now, previously, historically,
2:51that's kind of how it's always been in
2:53Wuzza. You would just kind of drill down
2:55to one agent and look at this all kind
2:58of one by one. But if I unpin that
3:00agent, you get to see all of this
3:02inventory, all this intel across all of
3:05your connected agents. And this is super
3:07cool because now you've got that big
3:09picture visibility across everything
3:12across your entire environment or
3:14enterprise. I know I'm working with just
3:1604 hosts to kind of show the demo here,
3:18but let me look in the system tab. You
3:20could see all the different sort of
3:22operating systems that might be across
3:23your environment. If Linux were in the
3:25picture here, that could have a little
3:27bit more visibility. We could drill down
3:29into any one of these. Let me click
3:30inspect details. Here you've got the
3:33architecture, of course, the host name,
3:34the kernel release, specific version of
3:36the operating system, and that name. And
3:38that's just kind of scratching the
3:40surface. Like take a look at the
3:41hardware section. Now, we could get all
3:43this visibility for even the machine
3:46information. How many CPU cores does it
3:48have? What's the name of the processor?
3:50What's the speed? Total RAM. So, you
3:52could use this to even monitor health of
3:54your systems. But some of the coolest
3:56stuff is in the software tab in my
3:59opinion because you're tracking then all
4:01of the packages or installed software
4:04like programs and applications across
4:06each host. And again, of course, you
4:09could drill down, filter in, narrow to
4:11just one specific instance like one host
4:13or endpoint. Or you could see this
4:15across all of them. Like let me jump to
4:18page five and you'll see a different
4:20host name over on the far left side. So
4:22what we could do is actually just kind
4:24of filter out all of the default usual
4:27Microsoft Corporation or just even
4:30Microsoft signed or vendor specific
4:32software. So let me click the minus
4:34button here. So all those will go away.
4:36We might have been looking at like 400
4:38or something hits before. Now we could
4:40drill down to smaller stuff and we don't
4:42need to see solitire as one example.
4:44This way you could track a baseline like
4:46what's your gold image for a operating
4:49system for a new install of different
4:51computers and PCs in your environment.
4:53I've got a lot of Python stuff in here.
4:55We could tune that out. And when I do
4:56this, by the way, we're modifying or
4:58adding filters to the very top. And you
5:00could, as always, add your own advanced
5:03filters with specific queries that you
5:05might be trying to search for. While I'm
5:06here though, we could take a look at
5:08some of the other tabs like Windows
5:10knowledge bases, KBs or packages, hot
5:13fixes, patches that are applied. Having
5:14the inventory on that and then being
5:16able to declare what fields that you
5:19actually want to see or even track and
5:21filter down on is pretty awesome. And
5:23browser extensions. So no matter what
5:25different web browser anyone in your
5:27organization might be using, whether
5:29it's Edge, whether it's Firefox, whether
5:31it's Chrome, whether it's Brave, then
5:33you could see, are there any rogue
5:35browser extensions? Are they malicious?
5:38Are any of those a virus? In fact,
5:40actually, while we're on that topic, I
5:42think what would be kind of cool, maybe
5:44fun, maybe a little bit more of a demo
5:45for this video is to compromise one of
5:48these hosts and use this new visibility,
5:51this inventory from IT Hygiene to try to
5:54triage and see what's going down. So,
5:56bear with me for the showcase here, but
5:58say that some threat actor, some hacker,
6:01some cyber criminal had gained access to
6:03this machine. They had remote code
6:05execution and they already had admin
6:07privileges so they could run whatever
6:10code or commands they wanted. I'm going
6:12to simulate this. Obviously, I know I'm
6:14just sort of interacting like manually
6:15with that host in that computer, but
6:17let's say the malware has already fired.
6:20It's already invoked. It's already got
6:21its hooks and claws in there. And now we
6:23want to triage. So using Wuzza and this
6:26IT hygiene inventory, let's use that as
6:28some lens to be able to look through
6:30this stuff. I'm actually going to go
6:32take a look at the processes here and
6:34let's see what sticks out across all
6:36those different agents or computers that
6:38we're looking through here. Just as I
6:40mentioned, we could toggle any of the
6:42columns that are displayed and maybe
6:43reorder them. We could determine what
6:45fields we want to show on this table and
6:48filter out the stuff that we just don't
6:49care to see. We've got a lot of
6:51servicehost.exe entries. I'm going to
6:53ignore those. I know. Look, of course.
6:55Yeah, whatever process injections,
6:57tricks, maybe there's some malware that
6:59could hide in that file name, like in
7:01that program, that.exe process name. But
7:04for the sake of demonstration, let's
7:06keep cruising. You can see we have a lot
7:08of stuff running here. Access, smart
7:10search, access stuff over and over
7:12again. Trusted installer. Maybe that's
7:14another Windows default we could
7:16probably tune out. And I know looking
7:18through just a giant dump of running
7:20processes isn't really ideal for oh
7:22threat hunting especially when you've
7:24got pages upon pages of these rows and
7:26results here. So we can take another
7:28look at maybe some of the other tabs and
7:29get some other ideas. Say we look at the
7:32network tab and this lets us drill down
7:34to some other really interesting stuff
7:35just as well. By default it'll put us on
7:37the addresses page and maybe just a cool
7:40trick if you wanted to get the real
7:42inventory of what hosts have what IP
7:44addresses maybe IPv4. Well, we could
7:47just like filter out the IPv6 type. We
7:49don't need to see local host like this
7:52127001.
7:53Let's remove that. And then the network
7:55IP address that doesn't really work with
7:58whatever net mask or subnet that's
7:59associated with, we could filter that
8:01out just to get the specific local IP
8:03addresses. Let me tune out these. Cool.
8:06So now all of our four agents and hosts,
8:08we could track down what their actual IP
8:11address is. Do that across your entire
8:13environment. That might be pretty handy.
8:14And you could track different
8:16interfaces. A lot of these are in
8:17specific virtual machines for me. So
8:19nothing super specific. Could take a
8:21look at protocols. And of course, we
8:23could drill down into each and kind of
8:24every one of these if you did want to
8:26inspect the details, see whether or not
8:28it's getting an IP address from DHCP,
8:30know what the actual gateway is, all
8:32that handy stuff. But I think listeners
8:35are really the most interesting
8:36perspective because of hey maybe some of
8:39those are an open door like open ports
8:42or listening services that are waiting
8:44for connections like malware might be or
8:46anything that could be used for a back
8:48door. We can see from the graphs here
8:50that system might be serving some and if
8:53I filter on strictly that we could see
8:55all the different ports that it might be
8:57hosting. We can take a look at another
8:59remove that filter some of the top five
9:01processes. cuz I'm just looking in this
9:03chart for now. How about services.exe?
9:05Just what's naturally running from here?
9:07Let me try and look for some binded
9:10ports from maybe some of the top five
9:12processes that seem to be listening.
9:14They have some port open. Often times
9:16the system process is usually what you
9:19could track down for different services
9:21that might be running. So I'm going to
9:22click in there even just from this top
9:24five processes graph and then we could
9:26see if anything kind of sticks out to
9:28us. a lot of 445 like SMB 137 138139
9:32also pretty common in the Windows world
9:34445 maybe we filter out some of the UDP
9:39listening endpoints oh and I see some
9:41down here 8080 that's an odd port to be
9:44listening on with TCP can we drill down
9:47into that that's bound on all interfaces
9:50so 0000
9:52as the IP address listening on 8080 but
9:55with the process ID of four it's just
9:58coming from system, which isn't all that
10:00helpful. But that might mean it is a
10:02running service. It is on the Windows 11
10:05host, though based off of that host
10:07name. So, what if I just went back to
10:10processes and actually, let me drill
10:12down to specifically explore one of
10:14these agents. Well, you could search for
10:16any that you'd like across your entire
10:18fleet. Let me use that Windows 11 one to
10:21zoom in and specifically be looking at
10:23that agent. What processes are running
10:25here? Okay, one sticks out. PowerShell,
10:28right? PowerShell doesn't normally run
10:30on the enduser workstation if we're
10:33going along with this scenario. You know
10:35that in this scenario though, our bad
10:37actor hacker cyber criminal and thread
10:39actor did probably open up PowerShell
10:41just for the demonstration sake. So, let
10:43me open up command prompt specifically,
10:45not to trigger like a PowerShell.exe,
10:48but we at least have okay, some command
10:50prompt. Can I list out and maybe I'm
10:52doing my triage here and maybe I'm using
10:54our RMM remote monitoring and management
10:56tool to kind of go validate and look is
10:58that actually running. Could I filter
11:01for an image name? Just a quick check of
11:04the usage. Looks like I can use /fi and
11:07then something specific like an image
11:10name if it's equal to. So let me try
11:12that task list
11:15image name equal to PowerShell.exe.
11:19Okay, it is running with that specific
11:21PID just like we saw in W wasa. But can
11:23I kill that? It shouldn't be running,
11:26right? Power powershell.exe killed. Is
11:28it gone? No, it's back. Different PID
11:31this time. 3,956.
11:33Let's kill it again. Is it STILL
11:35RUNNING? IT'S BACK. OKAY, SO THIS
11:37machine is infected. Are you playing
11:38along? And what is hosting on 8080? Even
11:42if we weren't on this compromised host,
11:45we know the IP address from the network
11:46tab. that sweet inventory from WO was in
11:48the IT hygiene module. So let's go check
11:51out port 8080.
11:53Rogue service is alive. Provide cmd
11:57equals like to run a command. Okay, so
11:59this looks like some internal local area
12:02network realistically backdoor. This is
12:04a webshell, right? Simple setup, but say
12:07this webshell malware could be used to
12:10oh run different commands and have
12:12backdoor access to fire up and do
12:14anything else. That's their persistence
12:16mechanism. But we start to wonder, how
12:18can they keep respawning this
12:20PowerShell.exe if that's what's running
12:23this port 8080 while that's listening?
12:26Is that set up as a service? We've seen
12:29processes. We've seen the network tab.
12:31You can of course take a look at traffic
12:32and maybe we'll even be able to see a
12:34lot of the communication now to 8080.
12:36Cruising through these, we've seen the
12:38processes tab. We've seen the network
12:40tab. If you want to take a look at the
12:42identity tab, that'll give you inventory
12:44of specific users or groups. Of course,
12:46crossplatform as always, drill down, do
12:49whatever filters, toggle any fields that
12:51you might like. But let's hop over to
12:53the services tab because now I'm
12:55wondering what sticks out here. We're
12:57pinned to our Windows 11 host still. We
12:59know that could be our compromised
13:01instance. But let me rearrange this.
13:03Maybe we add some other available fields
13:05here because I'm wondering could we go
13:07track down is PowerShell running as some
13:10sort of executable? Is that what is set
13:12up as a service? Let's add a filter and
13:14try to look for that process.executable
13:17could be like anything with PowerShell
13:20in the name, right? So, I'm using the
13:22stars as a wild card. Are there any hits
13:24there? No. Okay. So, what is this thing?
13:26Let's clear out that filter and let's
13:28just explore. Granted, there are 640 of
13:31these. Maybe that is going to be tough
13:33to look through with all of the specific
13:35like Windows Microsoft defaults, right?
13:37But something's got to stick out like a
13:39sore thumb if it's probably not running
13:41out of system 32. Maybe it is, maybe it
13:43isn't. Again, the premise here is that
13:45our admin, our thread actor, our hacker
13:48had admin privileges. So, there could be
13:50something running in system 32. But just
13:52to go kind of clear that out, let's
13:54remove any executable path that's not
13:57containing the substring system 32. That
14:00brings us down to like 275. A little bit
14:02easier to start with. And I've seen this
14:04actually be a little bit finicky with
14:06lowercase S for system 32. I don't know
14:08if it's case sensitivity or not. So, let
14:10me add an and not process executable
14:13with the lowercase one here. What do we
14:14got? What else is running? VMware stuff.
14:17Microsoft Defender was itself. Windows
14:20Defender. SQL Server Writer. That's odd.
14:23Overlay things. What is that at the very
14:26bottom? You see that? Windows helper
14:28service running from chocolaty nssm.exe.
14:32Okay, let's explore what the heck that
14:34is. Gives us the path. Gives us the
14:37process ID and that is running as
14:39system. So I wonder if that is it local
14:41system as the ID, right? But that's
14:43still what's serving this 8080
14:46potentially. Could we go triage that on
14:48the host? Again, stick with me. I know
14:50I'm cheating going in and out of the
14:51host itself. We don't always have that
14:53luxury, but let me go take a look at the
14:54services. Of course, we've got this
14:56inventory from Wuzza already, but I want
14:59to just double check for our Windows
15:01Health service, Windows helper service.
15:04Let me stop that service and then let's
15:07go back to our terminal. Do we still see
15:11the PowerShell process running? We
15:14don't. It never came back. Was that
15:16managed by our Windows helper service?
15:18NSSM. Let me go take a look at that
15:21browser page. Right. Nope. That's
15:23spinning. It's not going to be there.
15:25Okay. So, that was uh oh, a rogue
15:27malicious service hosting, serving,
15:30providing this backd dooror via simple
15:32web shell. Even in the local area
15:34network, that's still something that
15:35could be used for lateral movement.
15:37Maybe that's even funneled out with Enro
15:39or some other tunneling capability. All
15:41that is to say, we got to track that
15:43down amongst however many other agents
15:46that you might have endpoints in your
15:48environment and filter and track and
15:50identify and have the inventory even at
15:53a bird's eye view of all of the system
15:56information, operating system details,
15:58software, processes, network identity
16:00and services and browser extensions,
16:02too. Like that's so cool. So, let me
16:05take you a little bit behind the scenes.
16:06I think it would be kind of fun to get
16:08an idea as to what was actually ran on
16:11this host as the malware showcase. Here
16:15I have a PowerShell HTTP script. Let's
16:18open that up just so I could show you
16:19the code. And as always, let me be real
16:21with you. This is some AI slop. I'm not
16:24shy about vibe coding and speedrunning
16:26to solutions when they work for a little
16:28cutesy showcase. We have a simple
16:30PowerShell script. I think for a proof
16:32of concept and demo that still works for
16:34the video fireworks. Here, look, we have
16:36some parameters to host and serve on a
16:38specific port. We have a default Windows
16:41helper service name and then a toggle as
16:43to whether or not we'll install a
16:44service. Of course, we've got the
16:46functionality to make sure that we are
16:47elevated running as admin. And if we
16:50actually toggle the switch to install a
16:52service, then we use chocolatey.
16:54Chocolatey, if you haven't heard before,
16:56let me pull it up for you. I think I've
16:57even showcased this before in other was
16:59a videos. So, it's nothing new by any
17:01means, but it's a sweet, easy, oh, quick
17:04sort of package manager, quick installer
17:06in the Windows world. I should be using
17:08Windet, but I'm just so naturally used
17:10to Chocolatey. With Chocolatey, we
17:12install NSSM. And I don't know if I've
17:15covered NSSM in another video before.
17:18So, I hope this is some sweet education,
17:19just if you haven't seen it before, but
17:21NSSM is the non-sucking service manager.
17:26Clicking on the page here, it's an
17:27open-source utility to be able to easily
17:30manage Windows services. And honestly,
17:32you may very well see some malware that
17:35bundles it in because it's just so quick
17:37and easy to get a service up and
17:39running. And like I ran a PowerShell
17:42script with this, not a full-blown
17:44Windows binary, not a compiled program
17:46or application. It just crapped out spin
17:49up and ran the PowerShell service. That
17:51is simply a PowerShell script to host an
17:54HTTP server. That is our backd dooror.
17:57That is our webshell. So, since this
17:59thing was shut down, we did stop that
18:01service. Let me show you just what it
18:02looks like while we're running it. Run
18:04as the administrator. Let me run our
18:06PowerShell http and let me use install
18:09service. That will then okay see that it
18:12is already set up. install NSM if it
18:14doesn't have it and create it even
18:15though it does already exist in that
18:17case. While all that was fun, the real
18:19demo here is was and their IT hygiene
18:22new feature set with some of the latest
18:24versions that they've got out the door
18:2614.0. It's just cool. Honestly, I still
18:29feel like I barely scratched the surface
18:31of all the stuff that it can do because
18:33it even includes some Microsoft Graph
18:36API. Sweet little dashboard for
18:38monitoring activity, audit events from
18:40Microsoft cloud services. So think like
18:42Entra ID, think Azure Active Directory.
18:44All that's hooked in with the Microsoft
18:46Graph API. Of course, it's got all the
18:48tweaks, it's got all the bug fixes, it's
18:50got better stability, performance, etc.,
18:52etc. But goodness gracious, I do like
18:54that IT hygiene dashboard having that
18:57big picture visibility, being able to
18:59zoom in, drill down when you need to.
19:00And the icing on the cake, if you wanted
19:02to generate a report, they make that
19:04super easy with just a quick button just
19:06as well. Look at this. Can distribute
19:08that if you ever need to. And that gets
19:10all the sweet deets. Hey, thanks so much
19:12for watching everybody. Hope you enjoyed
19:13the video. Hope you enjoyed that little
19:14showcase. Just some pseudo investigation
19:17using WAZA and their IT hygiene with the
19:19new version 14.04.1
19:22and more to come. Hope there was some
19:24good education in there for Chocolatey
19:25if you haven't seen that before. NSSM,
19:27the non-sucking service manager. Maybe
19:29you'll see that around. And yeah, you
19:31can host an HTTP web server with just
19:33pure PowerShell, which is kind of cool.
19:35Please do give WA some love. There's a
19:36link in the video description if you are
19:37getting that running in your own home
19:39lab or in your environment in your
19:40organization. I'm just a fanboy. They
19:42have cool stuff. Thank you again and
19:43again again. Please do all those YouTube
19:44algorithm things. Like, comment,
19:45subscribe, and I'll see you in the next