The first workstation security solution in our list is the Enhanced Mitigation Experience Toolkit (EMET) from Microsoft. This tool helps to protect applications from being exploited if they contain software vulnerabilities. The tool uses a lot of protection techniques, including memory randomization and protection techniques as well as certificate pinning feature to withstand man-in-the-middle attacks. It can be obtained from the official website at http://www.microsoft.com/emet.

We are going to install EMET 5.2 on a Windows 7 workstation. The installation process using graphical interface is not complicated, so we will use a lot of screenshots.

Now, we can proceed with installing a host-based intrusion prevention system.

Like EMET, we need a HIPS and antivirus mostly for evasion testing purposes and for advanced attacks or research scenarios. You can choose any of the popular software and the more solutions you have in the lab, the better it is because it will allow you to test your payloads and evasion techniques against a wider range of detection and protection tools. This will give you a better chance of a successful attack.

For demonstration purposes, it will be enough to install just one solution, and preferably it should be free. We have chosen Comodo Internet Security 2015.

Comodo Internet Security (IS) is a solution that combines antivirus, firewall, and auto-sandbox software and has a free version available at Comodo's website. The steps are as follows:

Well, let's start with solution's installation. For obtaining the ClamAV distribution package, please visit the manufacturer's website http://www.clamav.net/download.html. Or, as in our case, you can use built-in operating system tools. Since we are using the Ubuntu Linux operating system 14.04.3, we just run following command in the console on behalf of the root user:

apt-get clamav clamav-daemon

If you prefer to use a normal user, you can execute following command:

sudo apt-get clamav clamav-daemon

After this, we will have a working instance of ClamAV. To start or stop the service, you can use the built-in tools of your operating system.

In the next step, we need to reconfigure ClamAV so that the ClamAV daemon uses TCP connections instead of a local Unix socket. For this, just execute the following command:

dpkg-reconfigure clamav-base

This command will start a configuration wizard. Let's leave all the answers at the default values, except for the following:

You can check or clarify your configuration of ClamAV by editing the configuration file /etc/clamav/clamd.conf.

After the reconfiguration process is completed, we need to restart the ClamAV daemon:

/etc/init.d/clamav-daemon restart

Next, we should update the database. For this, we need to execute the following command:

freshclam

We have installed the antivirus solution and updated the database. Now we need to check how it works. For example, to check a directory, run the following command:

clamscan -r /

This command will check the entire filesystem if it is necessary to check any particular directory; instead of /, specify the directory name. To check a suspicious file, just type clamscan FILENAME. Let's check our antivirus with an EICAR (European Institute for Computer Antivirus Research) test file. It is a standard file that is used to check whether the antivirus and inherently is not a virus. You can get this file at http://www.eicar.org/download/eicar.com.txt.

The next screenshot shows the output of ClamAV:

The ClamAV output

Next, we need to check the open port for connecting third-party applications. It's enough to execute the following command:

netstat -antp | grep clamd
tcp           0       0 0.0.0.0:3310        0.0.0.0:*        LISTEN       9917/clamd
tcp6          0       0 :::3310             :::0:*           LISTEN       9917/clamd

After checking that it works, let's make sure that our mail server scans all messages for viruses. To do this, perform the following steps:

Now all the traffic of the lab.local e-mail accounts is scanning on the ClamAV server.

Well, let's start with OSSEC by installing it in our infrastructure. First of all, we need to satisfy some requirements. OSSEC requires gcc, libc, and apache with php5 support. For this, we should execute the following commands:

apt-get install build-essential
apt-get install apache2 apache2-utils libapache2-mod-php5

Next, we need to obtain OSSEC. For this purpose, we should execute the following commands:

git clone https://github.com/ossec/ossec-hids
git clone https://github.com/ossec/ossec-wui

Now that we have installation packages, let's install them using the following command:

cd ossec-hids/
./install.sh

It starts a wizard with a few questions that we should answer. The most important question is about the type of installation. Here, we should create two different types of installation: for agents and for the server.

Next, let's install the web part of OSSEC. Move the ossec-wui directory to the folder where it can be accessed by the web server:

mv ossec-wui* /var/www/htdocs/ossec-wui

Then, execute the setup script:

cd /var/www/htdocs/ossec-wui
./setup.sh

The wizard will start, so we should answer questions such as login and password to gain access to the web interface of OSSEC.

OSSEC stores all the files in /var/ossec. Let's open the /var/ossec/ossec.conf file and give it the form we need. Here, we set sending alerts to e-mail by selecting the server address, mailing address, and the maximum possible number of messages per hour.

Then, there is a block of rules that describes what and how OSSEC will react.

The syscheck section sets the integrity check. Its meaning lies in the fact that the system calculates a hash of each file in the specified directory and checks them periodically. Here, we set what we will monitor in a directory and how long it will be checked for. The section describes the command scripts that can be used by the system under certain conditions.

In the end, we set log files that need to be analyzed and compared with the rules.

Now, the coarse settings of the OSSEC server are finished and we can run it:

service ossec-hids start

If successful, you will receive an e-mail with a message on startup in the mailing address.

After this, we need to add the user account of the web server (www-data) to the OSSEC group. Open the /etc/group file in editor:

nano /etc/group

Find the line ossec:x:1002 and change it to ossec:x:1002:www-data.

After that, we need to set permissions for the tmp directory of our OSSEC instance and restart Apache service.

chmod 770 tmp/
chgrp www-data tmp/
apachectl restart

Now we can access the OSSEC web interface using the following link: http://localhost/ossec-wui/.

Let's install an OSSEC agent from the same distribution. We choose the agent mode in the wizard. For the question "What's the IP Address or hostname of the OSSEC HIDS server?" we input the IP address of our OSSEC server. Now, we need to associate the OSSEC agent with our server. For this, we should go to the server and launch the manager working with the agents:

/var/ossec/bin/manage_agents

In the interactive mode, we need to perform the following steps:

Restart the server for the successful addition of the agent:

/etc/init.d/ossec restart

Then, let's go to our agent and go in the manager working with the agents:

/var/ossec/bin/manage_agents

In the interactive mode, we need to perform the following steps:

Then, we can run our agent:

/etc/init.d/ossec start

It should come in the mail notification that a new agent is connected. Go to the server to check whether the agent is connected:

/var/ossec/bin/agent_control -l

Here, we will see the list of our agents with the status Active. Also, /var/ossec/logs/alerts.alerts.log should have an event like that.

So the OSSEC agent is connected. Now, we can see our agent in the web interface.