Malware Detection

Detect indicators of compromise triggered by malware infections and cyberattacks across your infrastructure

Overview

The Malware Detection module provides comprehensive capabilities for identifying and responding to malware infections and cyberattacks. It checks for indicators of compromise (IOCs) and generates alerts when malicious activity is detected, helping you protect your infrastructure from malware threats.

Key Features

Indicator of Compromise Detection

The module monitors for various types of malware indicators:

• Rootkit Detection: Identify rootkit signatures and behaviors
• Trojan Detection: Detect trojan horse malware
• File-based Malware: Identify malicious files through signature matching
• Behavioral Analysis: Detect suspicious behavior patterns
• Command & Control Communication: Identify C2 server communications

Multi-Layer Detection

Malware detection operates at multiple levels:

• File System Scanning: Regular scans of file systems for malware signatures
• Process Monitoring: Detect malicious process execution
• Network Activity: Identify suspicious network connections
• Registry Monitoring: Track malicious registry modifications (Windows)
• Memory Analysis: Detect in-memory malware execution

Interactive Dashboards

Dedicated dashboards for malware analysis and investigation:

• Overview Dashboard: System-wide malware detection overview (Dashboard ID: malware-detection-overview-dashboard)
• Agent Dashboard: Malware detections for specific agents (Dashboard ID: malware-detection-pinned-agent-dashboard)
• Trend Analysis: Visual representation of malware detection trends

Event Data Structure

Malware detection events include comprehensive alert information:

Field	Description
timestamp	When the malware was detected
wazuh.agent.name	Name of the agent that detected the malware
data.title	Title/name of the detected malware or threat
rule.description	Detailed description of the detection rule
rule.level	Severity level of the alert
rule.id	Unique identifier of the detection rule

Data Sources

The Malware Detection module utilizes:

• Events Pattern: wazuh-events*
• Repository: EventsDataSourceRepository
• Sample Data Category: Auditing and Policy Monitoring

Detection Methods

Signature-based Detection

Identify known malware through signature databases:

• Updated Signatures: Regular updates to malware signature databases
• Hash Matching: Compare file hashes against known malware databases
• Pattern Recognition: Identify malware patterns in files and memory

Behavioral Detection

Detect malware through suspicious behavior:

• Anomaly Detection: Identify unusual system behavior
• Process Analysis: Monitor suspicious process execution patterns
• File Operations: Track suspicious file creation and modification
• Network Behavior: Identify unusual network connections

Rootkit Detection

Specialized detection for rootkits:

• System Call Monitoring: Detect hooked system calls
• Hidden File Detection: Identify hidden files and directories
• Hidden Process Detection: Find concealed processes
• Kernel Module Analysis: Examine loaded kernel modules

Use Cases

Real-time Malware Response

Respond to malware infections as they occur:

1. Receive immediate alerts when malware is detected
2. View detailed information about the threat
3. Identify affected systems and files
4. Initiate incident response procedures
5. Track remediation progress

Threat Hunting

Proactively search for malware in your environment:

1. Review malware detection dashboards regularly
2. Investigate suspicious alerts and patterns
3. Correlate malware detections across agents
4. Identify patient zero and infection vectors
5. Document findings for future reference

Compliance Requirements

Meet regulatory requirements for malware protection:

• PCI DSS 5.1: Deploy anti-malware solutions
• HIPAA: Protect systems from malicious software
• ISO 27001: Implement malware detection controls
• NIST: Follow malware prevention guidelines

Forensic Investigation

Conduct malware forensic analysis:

• Analyze malware infection timeline
• Identify malware families and variants
• Determine attack vectors and entry points
• Assess scope and impact of infections
• Support legal and compliance investigations

Integration with Other Modules

Malware Detection works seamlessly with:

• File Integrity Monitoring: Detect malware-related file modifications
• Threat Hunting: Investigate malware-related security events
• Vulnerability Detection: Link malware to exploited vulnerabilities
• System Auditing: Track malware-related system activities
• MITRE ATT&CK: Map malware tactics and techniques

Alert Types

The module generates various types of malware alerts:

Critical Alerts

• Active malware infection detected
• Rootkit presence confirmed
• Command and control communication
• Ransomware encryption activity

High Severity Alerts

• Suspicious file signatures
• Trojan horse detection
• Backdoor installation attempts
• Keylogger activity

Medium Severity Alerts

• Potentially unwanted programs (PUPs)
• Adware detection
• Suspicious process behavior
• Unusual network connections

Configuration

Scan Settings

Configure malware scanning behavior:

<rootcheck>
  <frequency>43200</frequency>
  <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
</rootcheck>

Detection Tuning

Customize detection parameters:

• Scan Frequency: How often to perform malware scans
• Scan Depth: Directories and files to include in scans
• Sensitivity Levels: Balance between detection and false positives
• Exclusions: Files or directories to exclude from scanning

Response Actions

When malware is detected:

1. Alert Generation: Immediate alert to security team
2. Agent Isolation: Option to isolate infected agents
3. File Quarantine: Quarantine malicious files
4. Active Response: Execute automated response scripts
5. Incident Creation: Create incident tickets automatically

Best Practices

1. Regular Updates: Keep malware signatures and detection rules updated
2. Layered Defense: Combine with other security modules for comprehensive protection
3. Quick Response: Establish procedures for rapid malware response
4. Regular Scans: Schedule periodic full system scans
5. Baseline Behavior: Establish normal behavior baselines for better detection
6. Alert Review: Regularly review and tune malware alerts
7. Incident Documentation: Document all malware incidents and responses
8. User Education: Train users on malware prevention

Performance Optimization

• Scheduled Scans: Run intensive scans during off-peak hours
• Incremental Scanning: Focus on changed files for faster scans
• Resource Management: Configure scan resource limits
• Smart Scanning: Prioritize high-risk areas

Component Architecture

The Malware Detection module architecture:

// Main dashboard component
DashboardMalwareDetection
  DataSource: MalwareDetectionDataSource
  Repository: EventsDataSourceRepository
  Dashboard ID: malware-detection-overview-dashboard
  Agent Dashboard ID: malware-detection-pinned-agent-dashboard

Location in codebase: /plugins/main/public/components/overview/malware-detection/

Reporting

Generate comprehensive malware reports:

• Detection Summary: Overview of all malware detections
• Trend Analysis: Malware detection trends over time
• Agent Status: Malware status per agent
• Remediation Tracking: Status of malware remediation efforts
• Compliance Reports: Malware protection compliance status

Related Resources

• File Integrity Monitoring
• Threat Hunting
• Vulnerability Detection
• [Active Response(/modules/threat-hunting)