Endpoint Security & Monitoring Report

Internee.pk Cybersecurity Internship

Name: Talha Imran Date: June 2025

---

Objective

The objective of this project was to secure organizational endpoints and servers against malware, unauthorized access, and suspicious activities by deploying an Endpoint Detection and Response (EDR) solution, enabling real-time monitoring, and configuring automated security alerts.

---

Tools Deployed

Tool	Purpose	Status
Wazuh 4.14.5	EDR & SIEM Platform	✅ Deployed
Wazuh Agent	Endpoint Monitoring	✅ Active
Sysmon	Advanced Windows Event Logging	✅ Running

---

Deployment Summary

1. Wazuh Manager Deployment

The Wazuh Manager (version 4.14.5) was deployed using the official OVA image within a virtualized environment.

Features Enabled

• Centralized log collection
• Security event analysis
• Rule-based threat detection
• Real-time alert generation
• Web-based security dashboard

The Wazuh dashboard was accessed through:

https://<wazuh-ip>

Screenshot

Insert Screenshot 1 – Wazuh Dashboard

---

2. Windows 10 Endpoint Configuration

A Windows 10 virtual machine was configured as the monitored endpoint.

Tasks Performed

• Installed Wazuh Agent
• Registered agent with Wazuh Manager
• Verified connectivity
• Enabled real-time log forwarding

Outcome

The endpoint successfully communicated with the Wazuh Manager, allowing centralized monitoring and event analysis.

Screenshot

Insert Screenshot 2 – Connected Agent

---

3. Sysmon Integration

Microsoft Sysmon was deployed using the widely adopted SwiftOnSecurity configuration.

Monitored Events

• Process creation
• Process termination
• Network connections
• Driver loading
• Registry modifications
• File creation and changes

Sysmon logs were forwarded to Wazuh for enhanced visibility and threat detection.

Screenshot

Insert Screenshot 3 – Sysmon Running

---

File Integrity Monitoring (FIM)

File Integrity Monitoring was enabled through Wazuh's configuration file:

/var/ossec/etc/ossec.conf

Monitored Directories

C:\Users
C:\Windows\System32

Detection Capabilities

• File creation
• File modification
• File deletion
• Unauthorized system file changes

Whenever changes occur within monitored directories, Wazuh automatically generates alerts under the Integrity Monitoring module.

Screenshot

Insert Screenshot 6 – File Integrity Monitoring Alert

---

User Activity Monitoring

Wazuh and Sysmon were configured to track user and system activities.

Events Monitored

• Successful login attempts
• Failed login attempts
• User account creation
• Process execution
• PowerShell activity
• Command Prompt activity
• Network connections

Examples

cmd.exe
powershell.exe

---

Custom Detection Rules

Custom rules were added to:

/var/ossec/etc/rules/local_rules.xml

Rule 100001

Multiple Failed Login Attempts

Detects brute-force or unauthorized login attempts.

Rule 100002

New User Account Creation

Triggers an alert whenever a new user account is created.

Rule 100003

Suspicious Process Execution

Detects execution of potentially dangerous commands and scripts.

Screenshot

Insert Screenshot 7 – User Activity Monitoring

---

Automated Alerting System

Wazuh automatically generates alerts based on severity levels.

Alert Level	Description
Level 7+	Medium Severity Events
Level 10+	High Severity Events
Level 12+	Critical Security Events

Examples of Critical Alerts

• New user account creation
• Privilege escalation attempts
• Malware execution
• Unauthorized system modifications

Alerts are displayed in real-time within the Security Events Dashboard.

Screenshot

Insert Screenshot 5 – Security Events Dashboard

---

Threat Intelligence Integration

MalwareBazaar Integration

To improve malware detection capabilities, MalwareBazaar (abuse.ch) was integrated as a threat intelligence source.

Integration Script

/var/ossec/active-response/bin/malwarebazaar-check.sh

Functionality

The script:

1. Extracts file hashes.
2. Queries MalwareBazaar's API.
3. Checks for known malicious indicators.
4. Generates alerts if malicious files are detected.

Benefits

• Real-time malware reputation checking
• Public threat intelligence integration
• Improved incident response capability

Screenshot

Insert Screenshot 9 – MalwareBazaar Integration

---

Results

Deliverable	Status
Wazuh EDR Deployment	✅ Complete
Windows Agent Connected	✅ Complete
Sysmon Installed & Logging	✅ Complete
File Integrity Monitoring Enabled	✅ Complete
User Activity Monitoring Enabled	✅ Complete
Automated Alerts Configured	✅ Complete
MalwareBazaar Integration	✅ Complete

---

Project Architecture

+-------------------+
|   Windows 10 VM   |
|-------------------|
| Wazuh Agent       |
| Sysmon            |
+---------+---------+
          |
          |
          v
+-------------------+
|   Wazuh Manager   |
|-------------------|
| Log Collection    |
| Rule Engine       |
| FIM Monitoring    |
| Alerting System   |
| Threat Detection  |
+---------+---------+
          |
          |
          v
+-------------------+
| Wazuh Dashboard   |
|-------------------|
| Security Events   |
| Alerts            |
| Monitoring        |
| Reporting         |
+-------------------+

---

Conclusion

The Endpoint Security Monitoring solution successfully provides comprehensive visibility into endpoint activities and security events.

By combining:

• Wazuh EDR
• Wazuh Agent
• Microsoft Sysmon
• File Integrity Monitoring
• Automated Alerting
• MalwareBazaar Threat Intelligence

the environment is capable of detecting unauthorized access, suspicious process execution, file modifications, and known malware indicators in real time.

This deployment demonstrates a practical implementation of modern endpoint detection and response (EDR) technologies and strengthens the overall cybersecurity posture of the infrastructure.