Lakshan Sameera

Undergraduate

🛡️🔓 OSSEC HIDS: Detecting the EternalBlue (MS17-010) Exploitation

Category: Blue Team & Red Team | Host-Based Intrusion Detection | Exploit Simulation
Timeline: January 2025
Tools Used: OSSEC HIDS, Metasploit, Kali Linux, Windows 7 SP1, Ubuntu, OSSEC Web UI
🔗 Read Full Article

This project explored the end-to-end detection of the EternalBlue exploit (MS17-010) using OSSEC, an open-source Host-Based Intrusion Detection System (HIDS). Designed as a cross-functional Red and Blue Team exercise, it simulated a real-world cyberattack in a controlled lab environment and demonstrated how OSSEC can effectively detect and log malicious activity in real-time—underscoring the importance of proactive host-level security monitoring.

⚙️ Project Overview & Objectives:

Simulate a real-world EternalBlue attack using Metasploit and observe system behavior.
Configure OSSEC HIDS to detect critical Indicators of Compromise (IoCs) resulting from the exploitation.
Evaluate OSSEC’s role in real-time alerting, log analysis, and response recommendations.
Provide strategic defensive recommendations to harden infrastructure against future attacks.

🧪 Technical Implementation:

1. Lab Environment Design

Deployed a fully functional testbed:
- Attacker: Kali Linux
- Target: Windows 7 SP1 (vulnerable to MS17-010)
- Monitoring System: Ubuntu running OSSEC HIDS (server + agent setup)
Enabled OSSEC Web UI for real-time log analysis and visual alert monitoring.

2. OSSEC HIDS Deployment & Configuration

Installed and configured OSSEC server and agents, ensuring secure communication between endpoints.
Tuned OSSEC alerting thresholds and rule sets, focusing on:
- User account creation (Rule ID: 18110)
- Group membership modifications (Rule ID: 18223)
- Suspicious SMB-related activity

3. Simulated Attack – EternalBlue Exploitation

Executed the MS17-010 exploit via Metasploit to gain unauthorized access to the Windows 7 machine.
Simulated post-exploitation actions:
- Created new user accounts
- Elevated privileges
- Accessed sensitive directories and services
These actions were monitored and flagged in real-time by OSSEC, validating its detection capabilities.

4. Intrusion Detection & Log Analysis

OSSEC generated high-severity alerts corresponding to each major malicious action:
- Unauthorized account creation
- Group privilege changes
- SMB traffic anomalies
Logs were reviewed using both the OSSEC Web UI and log files for correlation and attack reconstruction.
Attack patterns were clearly identified, mapped against known IoCs, and documented.

📌 Key Findings & Security Gaps Identified:

Vulnerable SMB protocol (v1) exposed the system to remote code execution.
Lack of account privilege controls allowed attackers to escalate without detection pre-OSSEC.
Absence of SIEM/log aggregation prior to OSSEC left the network blind to subtle attack signs.

🛡️ Recommendations & Mitigations:

Technical Defenses:
- Immediate patching of all systems vulnerable to MS17-010
- Disable SMBv1 across all Windows hosts
- Harden user account controls and implement multi-factor authentication
Monitoring Enhancements:
- Integrate OSSEC logs into SIEM platforms (e.g., Splunk, Azure Sentinel) for centralized visibility
- Configure automated response mechanisms for high-severity events
Strategic Improvements:
- Enforce network segmentation to contain lateral movement
- Launch internal Red vs Blue simulations to improve team preparedness

🧠 Skills Demonstrated:

Host-based intrusion detection configuration and optimization
Exploitation of known vulnerabilities using Metasploit (Red Team skillset)
Real-time log analysis and rule-based alert correlation
Secure system architecture design in lab environments
Translation of technical evidence into clear incident reports and strategic recommendations

📈 Outcome & Impact:

The project provided a hands-on demonstration of how modern HIDS solutions can effectively detect and log complex threats like EternalBlue in real time. It also showcased how defensive tools can be enhanced through attacker mindset simulations, bridging the gap between Red and Blue Team operations.

Through this exercise, I gained a deeper understanding of host-level detection, alert management, and post-exploit activity tracking, while reinforcing the importance of layered security and proactive monitoring in today’s evolving threat landscape.

Showcase Your Work, Get Noticed!

Your projects deserve the spotlight! Share your best work, inspire others, and open doors to new opportunities. Whether you're a student or a pro, this is your stage to shine.

Get visibility from recruiters & peers
Build your portfolio & personal brand
Connect with like-minded developers

Let's put your work in front of the right people!

Similar Projects

Cyber Security

NmapOpenVASMetasploit FrameworkWHOISKali LinuxMeterpreter

Penetration Testing Simulation for Securing Organizational Systems (Penetration Testing - Ethical Hacking)

Penetration Testing Simulation for Securing Organizational Systems Conducted an in-depth penetration test and vulnerability assessment on a simulated...

View Project

Cyber Security

WiresharkSnortVirusTotalubuntulinux

Security Operations - Network Intrusion Analysis and Detection for DevonCinema (Security Operations and Network Intrusion Analysis)

Security Operations & Network Intrusion Analysis for DevonCinema Category : Blue Team | Network Forensics | Intrusion Detection Timeline : January 2...

View Project

Cyber Security

FTK ImagerAutopsyVolatilityKernel PST ViewerWiresharkMXToolboxvirusTotallinuxWindows

Comprehensive Digital Forensics Report for Cybersecurity Incident Response (Digital Forensics)

🧩 Digital Forensic Investigation into Unauthorized Data Exfiltration at ABC Company Coursework : PUSL3133 – Digital Forensics & Malware Analysis ...

View Project

Cyber Security

Azure SentinelPowerShellipgeolocation.ioWindows Event ViewerVisual Studio CodeGitHubKQL

🌐 Azure Sentinel (SIEM) Lab: Real-Time RDP Attack Detection with PowerShell (Cloud Security - Blue Teaming Security Operations )

🌐 Azure Sentinel (SIEM) Lab: Real-Time RDP Attack Detection with PowerShell Category : Blue Team | SIEM | Threat Monitoring | Automation Timeline ...

View Project

Cyber Security

PythonPowerShellC#socketOpenCVPyAutoGUIrequeststhreadingip-apiWiresharkVMwareWindows 10Kali LinuxVisual StudioGitHub

🧠 Reverse Shell – Remote Administration Tool (RAT) (Hacking Tool - Offensive Security )

🧠 Reverse Shell – Remote Administration Tool (RAT) Category : Red Team | Remote Access | Malware Simulation | Ethical Hacking Timeline : June 2024...

View Project

Cyber Security

C#.NET Framework 4.5+Visual StudioWindows APISystem.Net.MailIP Geolocation APIGitHubWindows OSmacintoshpyautoguisocket``threading``cv2``numpy`

🧠 Key Logger with Email Notifications: A Comprehensive Cybersecurity Monitoring Tool (KeyLogger - Offensive Security Tool )

🧠 Key Logger with Email Notifications: A Comprehensive Cybersecurity Monitoring Tool Category : Red Team | Offensive Security | Malware Simulation ...

View Project