Full Report
Wiz extends its risk assessment to support host and application level misconfigurations, enabling customers to ensure security and compliance posture for applications.
Analysis Summary
This article primarily discusses a feature enhancement by Wiz—extending their security posture management capabilities to assess host-level configurations, rather than detailing a specific piece of malware or an adversary's TTPs. Therefore, the summary will focus on the **Wiz Host Configuration Assessment Capability** as the "tool" or feature being described.
# Tool/Technique: Wiz Host Configuration Assessment Feature
## Overview
This feature extends Wiz's existing agentless Cloud Security Posture Management (CSPM) platform to assess security posture and compliance directly at the host operating system and application configuration level, addressing a historical blind spot compared to cloud-level configuration analysis. It allows users to define and apply rules for host security assessments using a flexible, agentless query-based engine or the OVAL engine schema.
## Technical Details
- Type: Security Tool/Platform Feature (Host Configuration Assessment)
- Platform: Cloud Workloads (VMs running OS like Red Hat Enterprise Linux, Ubuntu Linux, Microsoft Windows Server) and Applications (e.g., NGINX).
- Capabilities: Agentless deployment, custom rule creation via query-based engine or OVAL schema, assessment against established benchmarks (CIS), generating host configuration findings.
- First Seen: Not explicitly mentioned, but announced as generally available/released in the context of the article ("Starting today...").
## MITRE ATT&CK Mapping
Since this is a defensive security tool, standard offensive TTP mappings are less direct. However, the capability facilitates the detection of techniques related to configuration weaknesses.
- **[T1580 - Develop Infrastructure or Capabilities]** (Applicable if adversaries exploit the misconfigurations this tool looks for)
- **[T1580.002 - Web Servers]** (If assessing web application configuration)
- *Note: The primary mapping revolves around the controls and compliance frameworks being enforced.*
## Functionality
### Core Capabilities
- **Agentless Assessment:** Provides host configuration assessment without requiring the deployment of endpoint agents, ensuring wider coverage (unlike traditional agent-based tools).
- **Built-in Rules:** Leverages Wiz’s existing rule set, including over 7,000 rules against frameworks like the CIS Benchmark for various OSs (RHEL, Ubuntu, Windows Server) and NGINX.
- **Configuration Finding Generation:** Generates host configuration findings when a host resource fails a check against a defined rule.
### Advanced Features
- **Custom Rule Development:** Allows users to create custom security rules using a flexible query-based engine for detecting specific files, patterns, or content.
- **OVAL Engine Support:** Supports defining custom rules using the official Open Vulnerability and Assessment Language (OVAL) engine schema for standardized configuration checking.
- **Integrated Compliance Scoring:** Integrates host configuration findings into the overall compliance posture score and compliance heatmap.
## Indicators of Compromise
*This section is not applicable as the article describes a security assessment capability, not malware or an attack tool, thus no network or malicious file IOCs are provided.*
- File Hashes: N/A
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: N/A
- Behavioral Indicators: N/A
## Associated Threat Actors
Agents/tools themselves are generally not associated with specific threat actors; however, the *misconfigurations* this tool detects are often exploited by various threat actors seeking initial access or persistence.
## Detection Methods
The feature itself *is* a detection mechanism.
- Signature-based detection: Rule matching using query engine or OVAL definitions.
- Behavioral detection: Detecting deviations from expected secure configurations.
- YARA rules if available: Not specified, but custom rules are supported via the query engine.
## Mitigation Strategies
This capability directly supports mitigation through identification and remediation guidance.
- Prevention measures: Prioritizing remediation of host configuration findings identified by the tool.
- Hardening recommendations: Using CIS Benchmarks and custom rules to proactively enforce secure configuration standards across the entire host fleet.
## Related Tools/Techniques
- CSPM Tools (Cloud Security Posture Management)
- Traditional Agent-based Endpoint Protection Platforms (EPPs)
- OVAL (Open Vulnerability and Assessment Language)