~3m27:43
Taylor Walton

Isolate a Compromised Server Before It Infects Others! Let's Build a Host Intrusion Detection System

Apr 25, 2021

Read: ~3m · You save: 25 min

Isolate a Compromised Server Using Wazoo's Active Response

Learn to automatically isolate compromised servers with Wazoo's active response! Prevent malware spread using iptables. Step-by-step tutorial.

This article details a method for proactively isolating potentially compromised servers within a network using WAZU's Active Response feature. The objective is to prevent the spread of malware or unauthorized communication by disabling a server's network interface upon detection of a high-severity alert, such as a rootkit installation.

The Problem: Slow Response to Compromise

In a typical security scenario, when WAZU detects a critical threat like a rootkit on a server, the security team must manually investigate the alert. This process can involve coordinating with network administrators to isolate the affected server, which can be time-consuming. During this delay, malware could potentially spread to other systems within the network, or the compromised server could be used for malicious activities like command and control.

The Solution: Automated Network Isolation

The proposed solution leverages WAZU's Active Response to automate the isolation process. When a predefined high-severity alert triggers, a script is executed to disable the server's network interface, effectively blocking all inbound and outbound traffic. This immediate isolation prevents further lateral movement of threats.

Technical Implementation

The core of this solution involves configuring WAZU to execute custom scripts that manipulate the server's firewall rules.

  1. Understanding iptables: The process relies on iptables, a Linux firewall utility. The firewall_drop.sh script, provided by WAZU by default, demonstrates how to create iptables rules to block inbound traffic from a specific IP address.

    • The script sets an IP variable and then constructs an iptables rule to drop traffic destined for that IP.
    • For example, executing iptables -A INPUT -s 8.8.8.8 -j DROP would block all inbound traffic from the IP address 8.8.8.8.

  2. Blocking Outbound Traffic: To achieve complete isolation, outbound traffic must also be blocked. This can be accomplished by creating an iptables rule that targets the server's network interface card (NIC).

    • Using ifconfig, one can identify the active NIC (e.g., eth0).
    • An iptables rule such as iptables -A OUTPUT -o eth0 -j DROP can be used to block all outgoing traffic from the eth0 interface.

  3. Creating a Custom Active Response Script: A new script, outbound-drop.sh, was created by modifying the default firewall_drop.sh. This custom script is designed to block outbound traffic from a specific interface.

    • The script was edited to remove the IP address variable and directly target the eth0 interface.
    • The script was placed in the WAZU agent's active response directory and its ownership was set to root to allow WAZU execution.

  4. Configuring WAZU Manager: The WAZU manager needs to be configured to recognize and execute the new outbound-drop.sh script.

    • A new command tag, outbound-drop, was created in the WAZU configuration.
    • This tag specifies the executable script (outbound-drop.sh).
    • The configuration was updated to define an active response rule. This rule was set to trigger on a specific rule ID (e.g., `

Introduction: The Need for Server Isolation

Introduction to the problem: a compromised server can spread malware. The goal is to automatically isolate it using Wazoo's active response to prevent further damage.

  • A compromised server can spread malware to other systems.
  • Wazoo's active response can be used to automatically isolate a server.
  • Isolation prevents malware from spreading within the network.

Leveraging Wazoo Active Response and iptables

Wazoo's active response can trigger scripts to disable a server's network interface, blocking both inbound and outbound traffic. This is achieved using iptables rules.

  • Wazoo can execute scripts as part of its active response.
  • Scripts can modify iptables rules to block traffic.
  • Both inbound and outbound traffic can be blocked.
  • Isolation is achieved by disabling the network interface (e.g., eth0).

Creating a Custom Isolation Script

The tutorial details creating a custom `outbound-drop.sh` script by modifying Wazoo's default `firewall-drop.sh`. This script is configured to block traffic on a specific interface (eth0).

  • A custom script outbound-drop.sh is created.
  • The script is based on Wazoo's firewall-drop.sh.
  • The script uses iptables to block traffic on eth0.
  • The script is placed on the agent, not the manager.

Configuring Wazoo for Active Response

The custom script is configured within Wazoo's manager by defining a new command tag and associating it with an active response rule. A specific rule ID (5715 - authentication success) is used for testing.

  • A new command tag is created in Wazoo configuration.
  • The command tag points to the custom bash script.
  • Active response rules can be triggered by specific rule IDs or severity levels.
  • Rule ID 5715 (authentication success) is used for demonstration.

Testing and Verification of Isolation

Testing the active response shows that upon triggering rule 5715, the server's network interface is blocked, causing the SSH session to drop. A timeout mechanism is implemented to remove the iptables rule after 20 seconds, restoring connectivity.

  • Testing involves triggering the configured rule (5715).
  • The active response successfully isolates the server by blocking traffic.
  • The SSH session is lost upon isolation.
  • A timeout (e.g., 20 seconds) is used to automatically remove the iptables rule.
  • Connectivity is restored after the timeout.

Important Considerations and Best Practices

The tutorial emphasizes the power and potential risks of this technique. It advises rigorous testing in production environments due to the possibility of breaking critical services with false positives.

  • This method is powerful but carries risks.
  • Rigorous testing is crucial before production deployment.
  • False positives can lead to unintended service disruptions.
  • The script can be made more sophisticated (e.g., dynamic interface detection).
  • Careful configuration of trigger rules is essential.