Leveraging Visual Basic for Security Poor Man’s IDS
Outline History of Poor Man’s IDS Environment What to monitor Scripts that make up PMIDS A bit of Geek 2/16/2019
Who am I AVP of IT at TAPCO Credit Union IT generalist Worked at financial institutions for last 16 years Developed security programs for Banks and Credit Unions 2/16/2019
History 15 years ago I developed the account lockout alert The idea of leveraging VB scripts for other monitoring started 6 or 7 years ago Has been a pet project During a Trust CC audit used it to catch one of Tom’s techs Dubbed Poor Man’s IDS 2/16/2019
Disclaimer Not all inclusive solution All open source Backs up other layers I am not a VB Scripting expert 2/16/2019
My Environment No local admins Right? Separate Domain admin accounts SMTP server OUs in AD and on workstations Task scheduler 2/16/2019
What to monitor Malicious activity Trusted users New accounts Restricted group membership Brute force hack process 2/16/2019
Scripts
Pieces Domain admin login Local admin login User lockout alert New domain account Dormant account Bad password count Domain Admin membership 2/16/2019
Layout What are we trying to capture Alert example Configuration Reaction to alert 2/16/2019
Domain admin login 2/16/2019
What are we trying to capture Unauthorized use of privilege account Domain Admin account used to log into a server or workstation Unexpected user added to domain admin group 2/16/2019
Alert Example (server) Sent to domain admin that logged in 2/16/2019
Alert Example (server non-admin user ) Sent to default email address 2/16/2019
Alert Example (workstation) Sent to email address when admin logs into workstation 2/16/2019
Configuration Run from OU that houses only domain admin accounts Added logic to not alert on certain users Section to list email addresses of each admin Send an email to a default address if no email listed for particular account 2/16/2019
Reaction User logs into server or workstation with domain admin account An alert is received in their non-admin email account If user logged into system no action necessary If not, admin should immediately change password and begin investigation Reboot remote system to kick user off 2/16/2019
local admin login 2/16/2019
What are we trying to capture Unexpected / unknown user in local admin user group Helps us find the outliers that have not been removed from local admin group Identifies any accounts added to local admin user group 2/16/2019
Alert Example 2/16/2019
Configuration Run from local GPO Local GPO created by copying files to each workstation Local policies stored in C:\windows\system32\grouppolicy Has logic to disable for certain workstations and user names Email sent to group 2/16/2019
Reaction If it is not a normal system the user logs into lock the account and contact user We use to find those users not previously removed from local admin group Reminds us in the event one of us put the user in local admin group to troubleshoot 2/16/2019
User lockout alert 2/16/2019
What are we trying to capture Invalid login attempts Alerted after account is locked out Brute force attacks Track lockouts / unlocks 2/16/2019
Alert Example 2/16/2019
Configuration Installed on domain controller Scheduled using task scheduler Runs every 2 minutes Keeps log Send only one alert 2/16/2019
Reaction Creates helpdesk ticket Internal procedure requires us to contact the user Unlock account 2/16/2019
New domain account 2/16/2019
What are we trying to capture Know when new account is created Knowledge of unauthorized account creation We attach alerts to help desk tickets 2/16/2019
Alert Example 2/16/2019
Configuration Runs on domain controller Scheduled using task scheduler Runs every 5 minutes 2/16/2019
Reaction Change control policy requires approval for all new accounts Unauthorized accounts are deleted Alert contains who created account 2/16/2019
Dormant account 2/16/2019
What are we trying to capture Identify “lingering” accounts Not logged into for 90 days Non-service accounts that have gone dormant 2/16/2019
Alert Example Text file contents 2/16/2019
Configuration Runs on domain controller Scheduled using task scheduler Runs on 1st of every month 2/16/2019
Reaction Reviewed monthly Automatically creates help desk ticket Lingering accounts investigated and appropriate action taken 2/16/2019
Bad password count 2/16/2019
What are we trying to capture Brute force password guessing Multiple accounts with 2 bad password count Automated password guessing would hit multiple accounts in very short time 2/16/2019
Alert Example 2/16/2019
Configuration Issues Runs on domain controller Bad password count not replicated across DCs Child OUs not parsed through Runs on domain controller Scheduled using task scheduler 2/16/2019
Reaction Admins would begin investigation Highten network monitoring level to find source Implement incident response program 2/16/2019
Geek out time Connecting to Active Directory 2/16/2019
Geek out time Looping through items in list Testing/verifications ' Bind to the local group. Set objLocalGroup = GetObject("WinNT://"& strComputerName &"/Administrators,group") ' Enumerate direct members of the local group. For Each objMember In objLocalGroup.Members 'check if logged on user is member of local Administrator group if objMember.Name = strUserName Then sendmsg=1 SendAlert End If Next Looping through items in list Testing/verifications Limitations Batch file hand offs 2/16/2019
Geek out time Connecting to Active Directory Testing/verifications 2/16/2019
Geek out time Looping through items in list Testing/verifications msgbox(objMember.name) Looping through items in list Testing/verifications 2/16/2019
Geek out time Connecting to Active Directory Testing/verifications Sending alert 2/16/2019
Geek out time Looping through items in list Testing/verifications Set objMessage = CreateObject("CDO.Message") objMessage.Subject = "Domain Admin Workstation login" objMessage.Sender = emlsender ' Sender email address objMessage.to = emlrecip objMessage.cc = emlrecipcc 'objMessage.addattachment Attachment objmessage.Textbody = msg objMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 'Name or IP of Remote SMTP Server objMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = emlsrvr 'Server port (typically 25) objMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25 objMessage.Configuration.Fields.Update objMessage.Send Looping through items in list Testing/verifications 2/16/2019
Geek out time Connecting to Active Directory Testing/verifications Sending alert Batch file hand offs Run as domain admin Limitations 2/16/2019
Conclusion Network security should be multi layered VB scripting is extremely powerful Many examples are available on the Internet 2/16/2019
Questions? John Eyre MCITP, CCNA, VCP, MCSE AVP of IT John.eyre@tapcocu.org 2/16/2019 Insert Footer