fix: corregir reglas Wazuh reales en fases 2/4/8 + fix corrupción visual terminal#1
Open
Data-Unix wants to merge 2 commits into
Open
fix: corregir reglas Wazuh reales en fases 2/4/8 + fix corrupción visual terminal#1Data-Unix wants to merge 2 commits into
Data-Unix wants to merge 2 commits into
Conversation
- Fase 2: sustituir regla 100014 (no dispara) por 100040 real (31123->100040 via errores 503) - Fase 4: eliminar alerta 100010 (no dispara); solo 100040 salta en Cowrie fail - Fase 8: reemplazar impacket por smbclient interactivo (SMB real en Dionaea) - Sesion smbclient C$ interactiva para jurado no tecnico - Sonda MSSQL muestra error TLS como firma de honeypot - Narrativa referencia recon Fase 1 en lugar de "descubrir" servicios de nuevo - Executor.run(shell=True): añadir stdin=DEVNULL + start_new_session=True para evitar que sshpass corrompa modo terminal de Rich (tcsetattr en fd0) - TimeoutExpired: eliminar UI.warn redundante en timeout de subprocesos
… su propia linea)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resumen
Correcciones derivadas de pruebas reales en laboratorio (VM100 Kali + VM106 T-Pot + VM103 Fail2Ban). Las reglas Wazuh mostradas en demo no coincidían con las que realmente disparan en el entorno.
Cambios
Reglas Wazuh corregidas
100014nunca dispara con ffuf → sustituida por100040real (cadena: errores 503 → regla base31123→ correlación100040)100010nunca dispara en este flujo → eliminada; solo100040salta tras intentos fallidosFase 8 Dionaea — sesión interactiva real
impacket-smbclient/mssqlclient(incompatible con Dionaea TLS 1.0) porsmbclientnativosmb: \>contra//172.17.0.16/C$— el jurado ve carpetas Windows falsas en directoFix corrupción visual terminal (Fase 4)
Executor.run(shell=True): añadidosstart_new_session=True+stdin=subprocess.DEVNULLsshpassllamatcsetattr(0, TCSANOW, ...)sobre fd 0 heredado (terminal Rich), desactivaONLCRy corrompe el salto de línea. Constdin=DEVNULLel fd 0 apunta a/dev/null(no es tty) →tcgetattrdevuelveENOTTY→ sshpass no puede modificar el terminalUI.warnredundante enTimeoutExpiredVerificado en
nc//172.17.0.16/C$: sesión interactiva funcional