u/hjb1002

This is kind of a long question so please bear with me. This is what I need to do:

- Create a website on windows server using IIS, what allow user to upload a file to a folder on the server. Don't need database, don't need to know who upload what, just click a button, choose the file then upload it.

- Exploit the website (don't need to be complicated) by uploading a web shell to it

- Get Wazuh to detect the activity of the web shell

What Im already done:

- Installed both the windows servers and Wazuh server on Vmware Workstation.

- Win server is an active agent of Wazuh server

- Install IIS and Wazuh server can see the default website

Using Wazuh 4.12.0, Win server 2022.

Wazuh server IP is 192,168,2,2 , Win server IP is 192,168,1,2. They are connected through a pfSense n firewall (not important tbh)

I have absolutely no idea where to start on this demo. Dont know how to make the web, never work with a real web shell.

All of this is on my personal laptop so lacking RAM and others hardware requirements also bugging me out.

This is the end of the question, thank for your time. If you want to know why I need this demo or really, just a brat complaining, you can continue:

I just graduated from college in cybersecurity, and it a "my dad know a guy" situation so Im start being an intern at a SOC department. 4 days in and I was requested to make this demo. Completely flabbergasted by how dumb I am, I was to naive to think just getting through the semester back then is enough. I just feel really lost by now.

The version im using is v4.12.0

Both of the rule are for a Window 10 agent on vmware workstation, they are just for testing and not on real system if you know what i mean.

The first rule is to send an alert after some failed login attemps, this is my version:

<rule id="100002" level="15" frequency="3" timeframe="120">

<if_matched_sid>60122</if_matched_sid>

<same_field>win.evendata.ipAddress</same_field>

<description>Multiple failed login attemps in 2 minutes</description>

</rule>

and when I test the rule by going to lock screen and enter incorrect password multiple times, the rule work just fine.

But the second rule (let call it 100003), which is to check if 10 second after the 100002 rule was alerted, if there are success login attemp then if will fire with something like "Login successfully after multiple failed attemps"

The rule id for success login is 60118

How do I write the second rule, please help me