Detect Reverse Shells With Wazuh! - Let's Build A Host Intrusion Detection System

[@michailgiannopoulos5274]

Cool video. Please do more about Wazuh product. It looks phenomenal!

[@taylorwalton_socfortress]

Hey Michail, yes, wazuh is an awesome tool :) I have a lot of other wazuh videos so check those out if you haven’t already. Please feel free to make any recommendations for other tools! Thanks for watching!

[@alejandroparrello6493]

You're the master Taylor! 👏👏🤘🦸

[@alejandroparrello6493]

Dear taylor, I have a question: where/how did you learned about wazuh? Just from public wazuh documentation? Or some official course? Regards from Argentina 👋 😊

[@Damielsestrem]

Hi Taylor, how can i adapt your tutorial for windows? for example... to lateral moviment with eternalblue or something like that... is the same way? can u give me an example?

[@samuraidenis]

Thanks again. Thoughts on shell from Windows ?

[@yassine4855]

Great vid! I got a question for you bro I know that wazuh can monitor network devices like firewalls and switchs but is it possible to make the the firewall block IP address from wazuh using the response feature?

[@taylorwalton_socfortress]

Hey Yassine, good question. Wazuh can ingest syslog which firewalls and switches can be configured to output. However, firewalls and switches generally have their own OS which is far different than a Linux, Windows, etc. OS and a Wazuh Agent cannot be installed on those type of OS. I recommend deploying a Wazuh-Agent on a jumpserver, bastion, reverse proxy, etc. that end users must interact with before they can get into your network. For example, one of my networks has a bastion server that users must logon to before they can interact with any internal hosts. The bastion server is a linux distro, is facing the internet and is running a wazuh-agent. I have active response enabled on this server so, for example, when an Ip address is observed attempting to login with multiple failed logins, active response runs and adds their IP as an iptables drop to the bastion server. This is a server that sits behind the firewall and in front of the internal network so no traffic can get through unless a valid user has logged onto the bastion server first and is a similar solution to what you are looking for. Hope that helps and thanks for watching!

[@isriadeputra]

wrong password admin "metallica", and not can check ip with "ip a/ ifonfig" message :comand not found

[@antonandreea5291]

did you find the right password?

[@DavidLopez-fe7ue]

@@antonandreea5291 you have to log in via ssh, so: ssh admin@