Home

Awesome

IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases (as a lot of changes happened). All this will be updated in time when a stable version will be released (see Roadmap until next release). Feel free to run beta releases on your own and ask questions if you need help.

<p align="center"> <img src="./doc/img/logo.png" alt="logo" width="40%"> </p>

Slack Coverage Latest Commit Latest Release Downloads License <img src="https://validator.swagger.io/validator?url=https://raw.githubusercontent.com/0xrawsec/whids/master/doc/admin.openapi.json" style="height:20px">

What

EDR with artifact collection driven by detection. The detection engine is built on top of a previous project Gene specially designed to match Windows events against user defined rules.

What do you mean by "artifact collection driven by detection" ?

It means that an alert can directly trigger some artifact collection (file, registry, process memory). This way you are sure you collected the artifacts as soon as you could (near real time).

All this work has been done on my free time in the hope it would help other people, I hope you will enjoy it. Unless I get some funding to further develop this project, I will continue developing it on a best effort basis. I will make all I can to fix issues in time and provide updates. Feel free to open issues to improve that project and keep it alive.

Why

How

<p align="center"> <img src="./doc/img/big-picture.png" alt="big-picture"> </p>

NB: the EDR agent can be ran standalone (without being connected to an EDR manager)

What you have to know

Installation

Requirements

  1. Install Sysmon
  2. Configure Sysmon
    • You can find optimized Sysmon configurations here
    • Logging any ProcessCreate and ProcessTerminate is mandatory
  3. Take note of the path to your Sysmon binary because you will need it later on

NB: event filtering can be done at 100% with Gene rules so do not bother creating a complicated Sysmon configuration.

Pre-Installation Recommendations

In order to get the most of WHIDS you might want to improve your logging policy.

EDR Endpoint agent (Whids.exe)

This section covers the installation of the agent on the endpoint.

  1. Download and extract the latest WHIDS release https://github.com/0xrawsec/whids/releases
  2. Run manage.bat as administrator
  3. Launch installation by selecting the appropriate option
  4. Verify that files have been created at the installation directory
  5. Edit configuration file by selecting the appropriate option in manage.bat or using your preferred text editor
  6. Skip this if running with a connection to a manager, because rules will be updated automatically. If there is nothing in the rules directory the tool will be useless, so make sure there are some gene rules in there. Some rules are packaged with WHIDS and you will be prompted to choose if you want to install those or not. If you want the last up to date rules, you can get those here (take the compiled ones)
  7. Start the services from appropriate option in manage.bat or just reboot (preferred option otherwise some enrichment fields will be incomplete leading to false alerts)
  8. If you configured a manager do not forget to run it in order to receive alerts and dumps

NB: At installation time the Sysmon service will be made dependent of WHIDS service so that we are sure the EDR runs before Sysmon starts generating some events.

EDR Manager

The EDR manager can be installed on several platforms, pre-built binaries are provided for Windows, Linux and Darwin.

  1. Create TLS certificate if needed for HTTPS connections
  2. Create a configuration file (there is a command line argument to generate a basic config)
  3. Run the binary

Configuration Examples

Please visit doc/configuration.md

Further Documentation

Known Issues

Roadmap until next release

Changelog

v1.7

Related Work

Sponsors

Tines

Github:https://github.com/tines Website:https://www.tines.com/ Twitter:@tines_io