Upload files to "3 DC/Agents"
This commit is contained in:
16
3 DC/Agents/1) DCO_GPO_CUSTOMER.md
Normal file
16
3 DC/Agents/1) DCO_GPO_CUSTOMER.md
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
[sysmon](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)
|
||||||
|
|
||||||
|
[sysmon config](https://github.com/olafhartong/sysmon-modular)
|
||||||
|
|
||||||
|
[inputs for splunk](https://github.com/mdecrevoisier/Splunk-input-windows-baseline/blob/main/splunk-windows-input/win_input.conf)
|
||||||
|
|
||||||
|
[splunk universal forwarder](https://www.splunk.com/en_us/download/universal-forwarder.html)
|
||||||
|
|
||||||
|
[elastic agent](https://www.elastic.co/downloads/elastic-agent)
|
||||||
|
|
||||||
|
|
||||||
|
## Event Logs
|
||||||
|
- process tracking #enables CMD logging
|
||||||
|
- enable wmi
|
||||||
|
- enable powershell remoting
|
||||||
|
- [Audit Policy](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations)
|
||||||
64
3 DC/Agents/2a) gpo deployment.md
Normal file
64
3 DC/Agents/2a) gpo deployment.md
Normal file
@ -0,0 +1,64 @@
|
|||||||
|
# Created by Ben
|
||||||
|
1. Create a software deployment share on your DC
|
||||||
|
a. Create a folder on the desktop of your DC, name it software
|
||||||
|
i. Rclick > properties > sharing
|
||||||
|
ii. Click Share > share to authenticated users and administrators
|
||||||
|
iii. apply
|
||||||
|
b. Create a folder in the share for the splunk UF and drop necessary files
|
||||||
|
i. Rclick > New Folder > Rename: SplunkUF
|
||||||
|
ii. Drop files in the new SplunkUF folder
|
||||||
|
1) inputs.conf
|
||||||
|
2) DeploySplunk.bat
|
||||||
|
3) SplunkUninstall.bat
|
||||||
|
4) splunkuniversalforwarder.msi (rename the UF to this filename or the .bat files won't work)
|
||||||
|
|
||||||
|
iii. Edit the DeploySplunk.bat file to match your infrastructure
|
||||||
|
1) @echo off
|
||||||
|
SET FLAG=C:\SplunkFlag.txt
|
||||||
|
IF EXIST %FLAG% GOTO END
|
||||||
|
echo "SplunkUF Installed" > %FLAG%
|
||||||
|
msiexec.exe /i "\\DC01\Software\SplunkUF\splunkuniversalforwarder.msi" DEPLOYMENT_SERVER="192.168.5.20:8089" RECEIVING_INDEXER="192.168.5.20:9997" AGREETOLICENSE=Yes SERVICESTARTTYPE=AUTO LAUNCHSPLUNK=1 SPLUNKUSERNAME=splunk GENRANDOMPASSWORD=1 WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 WINEVENTLOG_FWD_ENABLE=1 WINEVENTLOG_SET_ENABLE=1 PERFMON=network ENABLEADMON=1 /passive
|
||||||
|
copy "\\DC01\Software\SplunkUF\inputs.conf" "C:\Program Files\SplunkUniversalForwarder\etc\system\local\"
|
||||||
|
:END
|
||||||
|
|
||||||
|
2) The highlighted portions must be changed or else the file will not work. All filepaths must me changed to your share. all IP addresses must match your infrastructure.
|
||||||
|
|
||||||
|
2. Create an OU for the workstations you wish to add the UF to
|
||||||
|
a. open the Server Manager
|
||||||
|
i. Click Tools
|
||||||
|
1) Click the Active Directory Computers and Users
|
||||||
|
a) rclick your ad (example doge.AD in this instance)
|
||||||
|
i) Create a new Organizational Unit (OU) for your splunk Deployment (example RedDev)
|
||||||
|
b) Open the computers tab to view the AD computers on your domain
|
||||||
|
i) select the computers you want to add to this OU and drag/drop them into the OU
|
||||||
|
|
||||||
|
b. Open to Group Policy Management via the search bar
|
||||||
|
i. Navigate to your domain (doge.AD example) and view your OU (RedDev example) that you just created
|
||||||
|
1) Rclick > Create a GPO in this domain and link it here… (example SUF Installer)
|
||||||
|
a) Rclick the new GPO and edit
|
||||||
|
i) Computer Configuration > Policies > Windows Settings > Scripts > Startup (these scripts must be in this order)
|
||||||
|
1- Add > Name: [Full filepath to the share we made in step 1 (ex. \\DC01\Software\SplunkUF\SplunkUninstall.bat)]
|
||||||
|
2- Add > Name: [Full filepath to the share we made in step 1 (ex. \\DC01\Software\SplunkUF\DeploySplunk.bat)]
|
||||||
|
|
||||||
|
|
||||||
|
c. run this command in cmd (administrator)
|
||||||
|
i. gpupdate /force
|
||||||
|
|
||||||
|
d. restart the computers in your OU to apply the GPO
|
||||||
|
|
||||||
|
|
||||||
|
3. OPTIONAL ******************** Sysmon install
|
||||||
|
a. In your share make a new folder called SYSMON
|
||||||
|
b. put sysmon.exe in the folder as well as the DeploySysmon.bat
|
||||||
|
@echo off
|
||||||
|
SET FLAG=C:\SysmonFlag.txt
|
||||||
|
IF EXIST %FLAG% GOTO END
|
||||||
|
echo "Sysmon Installed" > %FLAG%
|
||||||
|
\\DC01\Software\Sysmon\sysmon.exe -i -accepteula
|
||||||
|
|
||||||
|
:END
|
||||||
|
|
||||||
|
c. change the filepath to point to your share and the sysmon.exe file
|
||||||
|
d. follow step 2b. but create a SYSMON installer with it as well
|
||||||
|
e. follow step 2c.
|
||||||
|
|
||||||
128
3 DC/Agents/2b) push_agents_SOG.md
Normal file
128
3 DC/Agents/2b) push_agents_SOG.md
Normal file
@ -0,0 +1,128 @@
|
|||||||
|
https://youtu.be/39iVugb9Y0c?si=Ob3HDfruGSvRYO5x&t=396
|
||||||
|
|
||||||
|
create a share in DC that everyone can access
|
||||||
|
|
||||||
|
put all files in DC directory
|
||||||
|
|
||||||
|
### Only for Splunk
|
||||||
|
```
|
||||||
|
splunkUF.msi
|
||||||
|
inputs.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
### Only for Security Onion
|
||||||
|
```
|
||||||
|
winlogbeat.yml - https://github.com/elastic/beats/blob/main/winlogbeat/winlogbeat.yml
|
||||||
|
winlogbeat.msi
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
### Only for sysmon
|
||||||
|
```
|
||||||
|
sysmon.exe
|
||||||
|
sysmonconfig.xml
|
||||||
|
```
|
||||||
|
|
||||||
|
## splunk UF
|
||||||
|
```
|
||||||
|
group policy management
|
||||||
|
(Your Organizational Unit) > new gpo
|
||||||
|
name:Install Splunk Universal Forwarder
|
||||||
|
source starter gpo: none
|
||||||
|
(right click) edit
|
||||||
|
Computer policies > software setting > software installation
|
||||||
|
(right click) new
|
||||||
|
specify splunk msi from netlogon share
|
||||||
|
preferences > windows settings > files
|
||||||
|
(right click) new > file
|
||||||
|
action: replace
|
||||||
|
source file(s): \\dc\NETLOGON\splunkUF\inputs.conf
|
||||||
|
destination file: \ProgramData\splunkUF\inputs.conf
|
||||||
|
preferences > control panel setttings > services
|
||||||
|
new > service
|
||||||
|
startup: automatic
|
||||||
|
service name: splunkUF.msi
|
||||||
|
service action: start service
|
||||||
|
Recovery
|
||||||
|
first failure: restart the service
|
||||||
|
second failure: restart the service
|
||||||
|
subsequent failures: restart the service
|
||||||
|
restart service every 5 minutes
|
||||||
|
```
|
||||||
|
|
||||||
|
# Splunk UF config
|
||||||
|
```
|
||||||
|
GPO setup
|
||||||
|
new gpo
|
||||||
|
startup scripts
|
||||||
|
DeploySplunk.bat
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
# sysmon
|
||||||
|
```
|
||||||
|
group policy management
|
||||||
|
all workstations > new gpo
|
||||||
|
name:Install Sysmon
|
||||||
|
edit
|
||||||
|
policies > software setting > software installation
|
||||||
|
specify msi from netlogon share
|
||||||
|
preferences > windows settings > files
|
||||||
|
new > file
|
||||||
|
action: replace
|
||||||
|
source file(s): \\dc\NETLOGON\sysmon\sysmonconfig.xml
|
||||||
|
destination file: \ProgramData\sysmon\sysmonconfig.xml
|
||||||
|
preferences > control panel setttings > services
|
||||||
|
new > service
|
||||||
|
startup: automatic
|
||||||
|
service name: sysmon.exe
|
||||||
|
service action: start service
|
||||||
|
Recovery
|
||||||
|
first failure: restart the service
|
||||||
|
second failure: restart the service
|
||||||
|
subsequent failures: restart the service
|
||||||
|
restart service every 5 minutes
|
||||||
|
```
|
||||||
|
|
||||||
|
# Sysmon config
|
||||||
|
```
|
||||||
|
GPO setup
|
||||||
|
new gpo
|
||||||
|
startup scripts
|
||||||
|
DeploySysmon.bat
|
||||||
|
```
|
||||||
|
|
||||||
|
## Winlogbeat
|
||||||
|
```
|
||||||
|
group policy management
|
||||||
|
(Your Organizational Unit) > new gpo
|
||||||
|
name:Install Winlogbeat
|
||||||
|
source starter gpo: none
|
||||||
|
(right click) edit
|
||||||
|
Computer policies > software setting > software installation
|
||||||
|
(right click) new
|
||||||
|
specify splunk msi from netlogon share
|
||||||
|
preferences > windows settings > files
|
||||||
|
(right click) new > file
|
||||||
|
action: replace
|
||||||
|
source file(s): \\dc\NETLOGON\winlogbeat\winlogbeat.yml
|
||||||
|
destination file: \ProgramData\Elastic\winlogbeat\winlogbeat.yml
|
||||||
|
preferences > control panel setttings > services
|
||||||
|
new > service
|
||||||
|
startup: automatic
|
||||||
|
service name: Elastic winlogbeat-Oss 7.#.#
|
||||||
|
service action: start service
|
||||||
|
Recovery
|
||||||
|
first failure: restart the service
|
||||||
|
second failure: restart the service
|
||||||
|
subsequent failures: restart the service
|
||||||
|
restart service every 5 minutes
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
```
|
||||||
|
the scripts both install splunk and sysmon, dropping a "flag.txt" file to confirm it's been run. if the flag file is there (it's a startup script) it won't run the installer again (it would be redundant)
|
||||||
|
so if the flag file is there it won't run the installer
|
||||||
|
if it is not ran, the installer will run and drop the flag file
|
||||||
|
good for troubleshooting too IMO cuz you can delete the file and run it again if you have changes
|
||||||
|
```
|
||||||
Reference in New Issue
Block a user