Monitoring and Threat Hunting Asustor NAS (Embedded devices running busybox)

[adgrant93]

Hi Team,

I hope someone might be able to assist me with this. I installed security onion and noticed my NAS was reaching out to several Tor nodes and establishing sessions all on its own. I can't see the traffic as its encrypted but obviously this is a bad sign. I disconnected it from the network until I can resolve this. My plan of action was to install beat/wazuh and use those tools to find the process that is initiating these outbound connections and eradicate the infection. I tried installing beats but the version of file beats doesn't appear to be compatible with the NAS version of linux. Linux GeekLove 5.13.x #1 SMP Fri Apr 14 00:13:58 CST 2023 x86_64 GNU/Linux

I also tried installing/starting Wazuh as can be seen below. I'm starting to realize it may be impossible to get visibility into any of my embedded devices. Is this something anyone here has worked with/has experience with? Thanks

# /var/ossec/bin/wazuh-modulesd start Non-standard uts for running kernel: release 5.13.x=5.13.0 gives version code 331008