nonso-cybersec/wazuh-custom-detection-rules

This project is a custom detection rule for Wazuh, an open source security monitoring tool, built to catch a specific kind of attack called password spraying. Password spraying is when an attacker tries a small number of common passwords against many different user accounts from the same source, hoping at least one account uses a weak password, rather than trying many passwords against a single account like a normal brute force attack does. The problem this project solves is that Wazuh's default brute force rule treats both attack types the same way, firing an identical alert whether one account or fifty accounts were targeted. A security analyst reading that alert cannot tell whether to lock down a single account or investigate the whole organization, and the correct response is very different in each case. The author noticed this gap while running an attack simulation against a test Active Directory environment and built a new rule, numbered 100300, specifically to close it. The new rule watches for individual login failure events from the same source IP address, but only fires once that IP has failed to log in as several different usernames within a two minute window. This distinguishes a spray, many usernames from one address, from ordinary repeated failures against one account. It fires at a higher severity level than the default rule and maps to a more precise category in the MITRE ATT&CK framework, a widely used reference for classifying attack techniques. The project documents the full setup: a lab with a Wazuh manager, a Windows Server domain controller running the Wazuh agent, and a Kali Linux machine used to simulate the attack. It also documents how the rule was deployed, tested with a live password spray, and measured, reporting that all twelve times it fired during testing were genuine detections with no false alarms. This is a hands-on security engineering project meant to demonstrate detection rule writing and testing, not a general purpose tool you install and run.