WEBVTT

00:00:01.340 --> 00:00:03.460
Let's go into the Wazuh Kibana UI.

00:00:03.460 --> 00:00:06.570
You could find the Wazuh URL in notes number 7.

00:00:06.840 --> 00:00:08.930
If you see an invalid certificate warning,

00:00:08.940 --> 00:00:11.670
that is expected, as this is a local environment.

00:00:16.640 --> 00:00:20.190
Okay, we see there was a admin UI here.

00:00:20.200 --> 00:00:24.560
Let's go ahead and put in the username and password of admin and admin.

00:00:25.140 --> 00:00:25.740
Of course,

00:00:25.750 --> 00:00:30.450
you wouldn't be leveraging these default credentials in a non‑local environment.

00:00:32.740 --> 00:00:34.030
Oh, wow, nice.

00:00:34.250 --> 00:00:36.540
So we see one connected agent.

00:00:36.550 --> 00:00:38.040
That must be the victim's machine.

00:00:38.220 --> 00:00:40.570
Let's go ahead and click on Total agents.

00:00:47.240 --> 00:00:47.610
Okay,

00:00:47.620 --> 00:00:51.260
here we see the victim's agent. We see a little bit more of a granular view.

00:00:51.740 --> 00:00:54.560
Let's go ahead and drill into the victim a little bit more.

00:00:58.540 --> 00:01:00.550
Okay, so here we see some pretty graphs.

00:01:00.940 --> 00:01:03.850
Let's go ahead and click on Security events.

00:01:09.740 --> 00:01:16.710
Further, we need to click on the Events tab. As we scroll down

00:01:16.710 --> 00:01:21.210
here, we see this interesting alert, Listened ports status

00:01:21.220 --> 00:01:24.540
(netstat) changed (new port opened or closed).

00:01:24.550 --> 00:01:25.300
Hmmm.

00:01:25.310 --> 00:01:26.490
I wonder what that is.

00:01:26.500 --> 00:01:31.820
Let's go ahead and click on the triangle here and drill down a little

00:01:31.820 --> 00:01:39.000
bit more. Further, we'll go ahead and click on View single document so

00:01:39.000 --> 00:01:41.370
we can see this a little bit more close up.

00:01:47.940 --> 00:01:50.630
Note the previous_log and the full_log.

00:01:50.640 --> 00:01:53.930
It's evident that the listening port of the Merlin agent tripped

00:01:53.940 --> 00:01:57.650
this alert. For stealth, you should change the binary's name to be

00:01:57.650 --> 00:02:00.370
something that wouldn't be so suspicious.

00:02:00.840 --> 00:02:02.550
An example could be update checker.

00:02:03.140 --> 00:02:05.850
Let's mount some more attacks by Merlin and see how

00:02:05.850 --> 00:02:08.150
Wazuh and Suricata both respond.