🛡️ Team Vector — Cross-Platform Visibility Assessment & Telemetry Evaluation

<aside> 🛡️

Project: Week 2 Visibility Assessment & Telemetry Evaluation
Team: Team Vector (SOC Practice)
Target Endpoints: AHMEDWINDOWS (Agent 003) | ahmedkali (Agent 004)
SIEM Platform: Wazuh Enterprise Manager (100.92.87.105)
Final Verdict: YES (100% Incident Confirmation)

</aside>

1. Executive Summary

During a scheduled SOC visibility assessment across enterprise endpoints, Team Vector investigated an unannounced, high-risk administrative activity on endpoints AHMEDWINDOWS (Windows Endpoint) and ahmedkali (Kali Linux Endpoint). An administrative account (A.Shehu-IT on Windows and kali via sudo on Linux) executed elevated PowerShell scripts designed to bypass local security execution policies and establish persistent system background services (VectorTestSvc on Windows and vector-test.service on Linux) configured to launch automatically on system boot.
The primary objective was to evaluate detection efficacy under default OS logging versus enriched endpoint telemetry (Sysmon on Windows and auditd on Linux) ingested into the Wazuh SIEM.

<aside> 🛡️

EXECUTIVE VERDICT: YES — FULL INCIDENT CONFIRMATION
With Sysmon and Auditd telemetry ingested into Wazuh, the SOC possesses 100% actionable evidence. The captured logs conclusively prove administrative user attribution, execution policy bypass parameters, target service binaries, and unauthorized file system modifications across both OS platforms.

</aside>

2. Incident Scope & Investigation Questions

• Windows Endpoint: AHMEDWINDOWS (Agent ID 003, IP 100.126.248.186, Account: DESKTOP-C3U19M6\USER)
• Linux Endpoint: ahmedkali (Agent ID 004, IP 10.0.2.15, Account: kali / root)
• SIEM Infrastructure: Wazuh Central SIEM Manager (wazuh-server at 100.92.87.105)

1. Who performed the activity, and was privilege escalation or policy bypass involved?
2. What exact commands and arguments were executed via PowerShell (powershell.exe / pwsh)?
3. What persistence mechanisms were established on the hosts?
4. Could default logging provide sufficient telemetry to support executive board reporting?
5. Are the activities across Windows and Linux correlated as a single campaign?

3. Lab Architecture

+-------------------------------------------------------------------------------+
|                             WAZUH SIEM MANAGER                                |
|                        wazuh-server (100.92.87.105)                          |
+---------------------------------------+---------------------------------------+
                                        ^
                                        | (Port 1514 / Encrypted Protocol)
                   +--------------------+--------------------+
                   |                                         |
+------------------+------------------+   +------------------+------------------+
|           AHMEDWINDOWS              |   |                ahmedkali            |
|       (Windows 10/11 Endpoint)      |   |           (Kali Linux Endpoint)     |
|             Agent ID: 003           |   |             Agent ID: 004           |
|  IP: 100.126.248.186                |   |  IP: 10.0.2.15                      |
|                                     |   |                                     |
|  [Wazuh Agent]                      |   |  [Wazuh Agent]                      |
|    |-- Default Event Logs           |   |    |-- Default Journald/Syslog        |
|    |-- Sysmon (Event ID 1 & 4104)   |   |    |-- Auditd (execve & file watch)   |
+-------------------------------------+   +-------------------------------------+

4. Timeline Reconstruction

5. Telemetry Analysis & Screenshot Evidence

5.1 Windows Endpoint Analysis (AHMEDWINDOWS)

Without Sysmon, default process creation logging (Event ID 4688) omitted command-line execution parameters. Enriched telemetry via Sysmon Event ID 1 and PowerShell Operational Event ID 4104 recovered complete visibility into command parameters and service creation.

When executing the persistence command prior to enabling advanced telemetry, default Windows process creation (Event ID 4688) logged the launch of powershell.exe, but omitted the inline script text and parameters.

By enabling PowerShell Script Block Logging (Event ID 4104) and monitoring Service Control Manager Events (Event ID 7045) alongside Sysmon, Wazuh successfully captured the complete command string, target service display name, and underlying executable path (notepad.exe).

1. Threat Hunting Overview

Figure 1: Wazuh Threat Hunting Event Table for AHMEDWINDOWS displaying correlated alerts for PowerShell script execution (Rule 91818) and Service Creation (Rule 61138)

1. PowerShell Script Block Telemetry (Event ID 4104)

New-Service -Name 'VectorTestSvc' -BinaryPathName 'C:\Windows\System32\notepad.exe' -StartupType Automatic -DisplayName 'VectorTeams Unauthorized Service' ; Start-Service 'VectorTestSvc'
```[cite: 29, 30]New-Service -Name 'VectorTestSvc' -BinaryPathName 'C:\Windows\System32\notepad.exe' -StartupType Automatic -DisplayName 'VectorTeams Unauthorized Service' ; Start-Service 'VectorTestSvc'
```[cite: 29, 30]

Figure 2: Windows PowerShell Operational Log (Event ID 4104) captured in Wazuh (Rule 91818), revealing the exact script block executed to register 'VectorTestSvc' pointing to notepad.exe (MITRE T1543.003).

1. Windows Service Registration Telemetry (Event ID 7045)

Figure 3: Windows System Event Log (Event ID 7045) captured in Wazuh (Rule 61138), confirming Service Control Manager registration of 'VectorTeams Unauthorized Service' with startup type 'auto start' under LocalSystem.

Telemetry Comparison & Investigative Value: While default Windows Event Log 4688 only alerted that powershell.exe was launched, deploying Microsoft-Windows-Sysmon (Event ID 1) closed the critical visibility gap. Sysmon provided the SOC with:

1. Complete Command Arguments: Revealing the explicit use of -ExecutionPolicy Bypass and the creation of background service VectorTestSvc pointing to notepad.exe.

2. Cryptographic Hashes: Generating SHA256 hashes for process image verification.

3. Parent-Child Correlation: Linking Process ID 8828 directly to Parent Process ID 2116 and User DESKTOP-C3U19M6\USER

4. Full Sysmon Command-Line Telemetry

Figure 4: Enriched Sysmon Event ID 1 telemetry in Wazuh capturing full commandLine details, execution policy bypass parameters, SHA256 executable hashes, and High process integrity level.

data.win.eventdata.commandLine: Shows the full execution string: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "New-Service -Name 'VectorTestSvc' -BinaryPathName 'C:\Windows\System32\notepad.exe' -StartType Automatic -DisplayName 'VectorTeams Unauthorized Service' ; Start-Service 'VectorTestSvc'".   

data.win.eventdata.hashes: SHA256 hash tracking for powershell.exe (9785B01B0DCF755EDD88AF294A373C0B87B2498660F724E76C4D53F9C217C7A3)

data.win.eventdata.integrity: High Level

data.win.eventdata.parentProcessId: 2116

1. Wazuh Rule & MITRE ATT&CK Mapping

Figure 5: Wazuh Rule 92027 triggering on Sysmon Event ID 1, mapping the execution policy bypass to MITRE ATT&CK Technique T1059.001 (PowerShell Execution)

rule.id: 92027 (PowerShell process spawned powershell instance). 
rule.groups: sysmon, sysmon_eid1_detections, windows.
rule.mitre.id: T1059.001.  
rule.mitre.tactic: Execution. 

1. Process Lifecycle & Parent GUID Details

Figure 6: Sysmon Event ID 1 process metadata capturing ProcessGuid, ParentProcessId (2116), and User context (DESKTOP-C3U19M6\USER).

data.win.eventdata.processId: 8828.
data.win.eventdata.parentUser: DESKTOP-C3U19M6\USER.   
data.win.eventdata.utcTime: 2026-10-21 15:58:55.933.

5.2 Linux Endpoint Analysis (ahmedkali)

1. Baseline Visibility (Without Auditd)

Execution Context: The persistence attack payload was executed on host ahmedkali using sudo pwsh before configuring kernel-level auditd monitoring.

Observed Telemetry in Wazuh: Default Linux logging (journald / /var/log/auth.log) captured only the basic authentication event (Wazuh Rule 5402: Successful sudo to ROOT executed).

Critical Visibility Gaps (What Was Missing):

1. No Inline Command-Line Parameters: Default logs recorded that sudo launched pwsh, but completely omitted the inline script arguments (Set-Content, /etc/systemd/system/vector-test.service, and systemctl enable --now).
2. No File Integrity / Directory Write Tracking: Standard syslog generated zero events when the new unit file /etc/systemd/system/vector-test.service was created and modified on disk
3. No Daemon Management Tracking: Systemd service reloads (systemctl daemon-reload) and service activation commands were invisible.

2. Enriched Telemetry (With Auditd & Wazuh Ingestion)

To eliminate these blind spots, Linux kernel auditd rules were configured:

1. Syscall Auditing: -a always,exit -F arch=b64 -S execve -k command_execution
2. File System Watch: -w /etc/systemd/system/ -p wa -k unauthorized_service

Wazuh was configured via /var/ossec/etc/ossec.conf to ingest /var/log/audit/audit.log, recovering complete operational visibility.