All results for 'Ujunwa Lucia Okonkwo'

Showing 7 of 7 results

How to detect MeshAgent with Wazuh

This blog post describes how to detect MeshAgent activities using Wazuh. MeshAgent is not inherently malicious but can be abused.

Detecting AsyncRAT with Wazuh

AsyncRAT is an open source remote access tool that is commonly used by threat actors for file exfiltration and remote desktop control. Threat actors use script injectors and phishing attachments to deliver AsyncRAT to victim endpoints across numerous campaigns. AsyncRAT has consistently ranked among the top 10 malware trends on Any.run for several months. BleepingComputer […]

Introducing Wazuh 4.9.0

We are excited to announce the release of Wazuh 4.9.0. This update introduced support for journald log collection, integration with AWS Security Hub and improved compatibility with OpenSearch 2.13.0. Additionally, there are improvements to WPK packages and enhancements to the Endpoint Summary section in the Wazuh dashboard. Key highlights Wazuh integration with AWS Security Hub […]

Detecting and responding to Lumma Stealer with Wazuh

Lumma Stealer, also known as LummaC2 Stealer, is a customizable malware written in C/C++ that allows for efficient and low-level access to system resources. It uses extensive obfuscation and anti-analysis features, making it highly effective and hard to detect. It is distributed as a Malware-as-a-Service (MaaS) model, with several plans available on underground forums and […]

Introducing Wazuh 4.10.0

We are excited to announce the release of Wazuh 4.10.0. This release introduces integration with Microsoft Intune, enhanced logging for cloud integration modules, and debug symbol generation for macOS, Linux, and Windows. It includes a new vulnerability evaluation status field and major updates to SCA policies for improved security compliance on monitored endpoints. We also […]

Introducing Wazuh 4.11.0

We are excited to announce the release of Wazuh 4.11.0. This release introduces a modified vulnerability detection process for CVE Numbering Authority (CNA) and updates to the Wazuh AMI and OVA base operating system. It also introduces an enhanced Wazuh Syscollector module for more accurate system inventory reports. Additionally, this release includes enhancements to FIM […]

Detecting Impacket with Wazuh

Impacket is a collection of Python-based scripts designed for manipulating network protocols and exploiting Windows services. It contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks. Although Red teamers use Impacket for authorized testing, threat actors frequently misuse it for lateral movement, privilege escalation, and data exfiltration […]