> For the complete documentation index, see [llms.txt](https://faresbltagy.gitbook.io/footprintinglabs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faresbltagy.gitbook.io/footprintinglabs/build-home-lab-soc-automation/execute-mimikatz-and-create-detection-rules-in-wazuh.md). # Execute Mimikatz & create detection rules in Wazuh First, let's open **Virus & Threat Protection** to add the **Downloads** folder as an exclusion.
Now, let's install Mimikatz from this link:
Now, let's execute `mimikatz.exe` and review the Wazuh dashboard for any related detections or alerts. ```powershell .\mimikatz.exe Add-MpPreference -ExclusionProcess "mimikatz.exe" ```
When I execute `mimikatz.exe`, Windows Defender blocks it. To proceed, I need to exclude the `mimikatz` process from detection. Now, let's check the Wazuh dashboard for any related detections or alerts.
Upon reviewing Wazuh, I did not find any indicators related to Mimikatz. By default, Wazuh does not log all events; it only generates logs when a rule is triggered or an alert is generated. However, this behavior can be modified by configuring the `ossec.conf` file within the Wazuh Manager to enable comprehensive logging. Alternatively, specific rules can be created to monitor particular events. When these events occur, they will trigger an alert in Wazuh, allowing for efficient searching and analysis. Next, let's proceed with editing the `ossec.conf` file. ```bash nano /var/ossec/etc/ossec.conf ```
Now, let's restart the Wazuh manager. ```bash systemctl restart wazuh-manager ``` This action compels Wazuh to start archiving all logs and store them in a file named "archives." ```bash cd /var/ossec/logs/archives/ ls ```
We also need to configure the `filebeat.yml` file.
Next, let's restart the Filebeat manager. ```bash systemctl restart filebeat ``` Next, we need to create an index for the archives. Let's move forward with this step.
Let's return to the Discover page.
Let's execute Mimikatz again and review the logs in the Wazuh dashboard.
We now need to create a rule to detect and generate an alert for Mimikatz activity.
We need to copy this section as it will be used to create a custom rule.
Let's proceed with creating our custom rule.
```xml sysmon_event1 (?i)mimikatz\.exe Mimikatz Usage Detected T1003 ```
The `win.eventdata.originalFileName` field refers to the original name embedded within the file's metadata, which doesn't change even if the file is renamed on disk. Therefore, if an attacker simply renames `mimikatz.exe` to another name, this rule would still trigger an alert because the original filename remains `mimikatz.exe`. Let's rename **`mimikatz.exe`** to an alternative name, execute it, and verify whether Wazuh generates an alert.
If the rule is based on the image, the alert will not be triggered. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faresbltagy.gitbook.io/footprintinglabs/build-home-lab-soc-automation/execute-mimikatz-and-create-detection-rules-in-wazuh.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.