gensecaihq/wazuh-autopilot/wazuh-malware-detection

Wazuh Malware Detection

Wazuh has no single malware engine; it aggregates several sources. Know which one fired, because their reliability differs.

Sources (stock ruleset)

YARA is not in the stock ruleset — it requires a custom active-response/integration script plus custom rules (e.g. custom rule 100300 for a YARA match). Don't claim YARA coverage unless you see such alerts.

Procedure

1. Identify the source and the object: file path (syscheck.path, virustotal.source.file,

data.win.eventdata.targetFilename), hash (virustotal.source.sha1, syscheck.sha256_after), process image (data.win.eventdata.image), parent process.

1. Corroborate across sources in the same window on the same agent:

get_wazuh_alerts agent_id="<id>" rule_groups=["virustotal","rootcheck","virus","sysmon","syscheck"] timestamp_start="now-24h". One engine alone is weak; FIM add + VirusTotal hit + outbound connection is strong.

1. Linux heuristics: executables in /tmp, /var/tmp, /dev/shm, hidden dot-directories, names

mimicking kernel threads (kworkerd, kdevtmpfsi), high CPU with outbound connections to mining pools. Windows: executables in AppData, ProgramData, Temp; rundll32/regsvr32 loading user-writable DLLs; unsigned binaries in System32.

1. Process and network context: running processes and listening ports come from syscollector — if

you are investigation, check them with your inventory tools; otherwise hand off to investigation.

1. Reputation: hashes, domains and IPs go to threat-intel. If you are threat-intel, run

check_ioc_reputation; everyone else hands off to threat-intel.

1. Spread: search the same hash or file name across the fleet with search_security_events

(query = the hash or filename) before concluding it's a single host.

1. Containment: never act yourself. Hand off to response-planner with the evidence — typical options

are quarantine_file (needs agent_id + file_path), kill_process (agent_id + process_id) and, for confirmed compromise, isolate_host.

False positives

Security tools themselves (EDR, backup agents, scanners), admin tooling (PsExec, Sysinternals), developer build output in temp directories, and rootcheck on hardened/containerized kernels. Record why you judged a hit benign.

Output

• add_entities: file (path), hash, process, and any remote IP/domain — role attacker only with

evidence.

• link_mitre: e.g. T1204 (User Execution), T1496 (Resource Hijacking), T1055 (Process Injection),

T1003.001 (LSASS Memory) — only what the evidence supports.

• update_case severity when multiple sources corroborate.
• add_finding: source(s), object, corroboration, spread, verdict and recommended containment.