- Microsoft Azure Sentinel (Virtual Machines/Compute)
- Remote Desktop
- Windows 10 (21H2)
- Setup Resources in Azure
- Create Log Analytics Workspace
- Enable gathering VM logs in Security Center
- Setup Azure Sentinel
- Create custom fields/extract fields from raw custom log data
- Setup map in sentinel with Latitude and Longitude (or country)
Create a Resource Group and VM
Create a new NIC by clicking advanced
Remove the default NIC
Add Inbound Rules
Create the VM
Create a Logs Analytics Workspace
Name the Analytics Workspace
Turn on Microsoft Defender
Turn SQL Servers Off for the honeypot and click save
Refresh the page and install Data Collections
Go to environment settings and open Azure Subscription and click on the honeypot
Click on Data Collection and select All Events and save
Go back to log analytics workspace to connect it to the VM
Open the log analytics workspace and click on virtual machines on the left
Click on the VM created in the beginning
Click connect
Setup Sentinel
Choose the honeypot
Go back to main page on Azure and click on the VM
Copy the public IP Address
Open remote desktop and log into the machine with credentials that were created int he beginning. Purposefully put in the wrong password on the first try.
Initial password input was wrong. This will be logged for us to see.
Once logged in, go to Event Viewer
Go to Windows Logs and Security on the left
vHere we can see our login failure
You can double click to see the details of that log
Now try to login again but this time put in the wrong username and password.
Login attempt with wrong username
Now an IP address shows from the attempted login.
Open the firewall on the VM. wf.msc in the search bar
Click on Windows Defender Firewall properties
Ping the VM's IP Address and notice that echo requests are allowed and we are getting return messages
Turn off the Domain, Public and Private firewalls and click apply
Launch Powershell ISE and copy and paste the Log Exporter script
Make an account on ipgeolocation.io and copy and paste your API key into the script
The script is a loop that runs perpetually and looks through the event viewer and security log and grabs the IP addresses of failed logins and geo locates them and creates a new log file
The file will be created in the ProgramData file that you will have to access manually.
Run the script to see the failed logon file being created from the failed attempts earlier
Go to log analytics workspaces
Go to custom logs and add a custom log
Copy and paste the logs within the VM file
Create a text file on your computer and paste the logs and save it on your desktop to upload to the custom logs on Azure
Upload the custom log
Hit next and it should look like this
Direct the custom log on Azure to be fetched from the file on the VM
Name the custom log
Head over to Log analytics workspaces and to the honeypot logs on the bottom left. Run a search query on the log file to show the failed attempts.
Right click and click extract fields from.
Highlight the fields to extract them
Check to see if the extraction is properly trained and save
Repeat steps for logitude and modify incorrect data to train the algorithm
Repeat steps for destination host
Repeat steps for username
Repeat steps for sourcehost
Repeat steps for State
Repeat steps for Country
Repeat steps for label
Finally finish up with timestamp
Run the query again and notice the created custom fields. On subsequent logs, they will be properly parsed out
Click on custom logs and custom fields to see the fields
Go back to Azure Sentinel
Add a new Workbook on the left
Add a new workbook and edit
Remove the default widgets
Edit and run query with a map visualization. Choose country as location info
Set map settings and labels
Set additional map setting and labels. Now observe as you track the hackers from around the world!
Roughly 30 minutes after lab has been completed
Roughly 7 hours after lab was complete
Approximately 12 hours after lab completion