Blog / Engineering / Detecting njRAT malware with Wazuh
...'C:\Program Files (x86)\ossec-agent\active-response\bin\yara\rules\' 4. Edit the C:\Program Files e(x86)\ossec-agent\active-response\bin\yara\rules\yara_rules.yar file and add the following njRAT YARA rules: rule njRAT { meta: author = "Adedamola Okelola" date = "2023-08-10" description =...
Blog / Engineering / Chaos malware: Detecting using Wazuh
Chaos is a fast-spreading malware written in Go. It infects Windows and Linux systems across multiple architectures, including ARM, Intel i386, MIPS, and PowerPC. The malware can enumerate the infected...
Blog / Engineering / How to detect RedLine Infostealer with Wazuh
RedLine Infostealer is a malware designed to steal sensitive information from infected Windows endpoints. It targets a variety of sources, including web browsers, cryptocurrency wallets, and applications like FileZilla, Discord,...
Blog / Engineering / Adversary emulation on GCP with Stratus Red Team and Wazuh
Google Cloud Platform (GCP) is a highly scalable cloud computing platform offered by Google. It provides organizations with several cloud-based services, including computing, storage, machine learning, and data analytics. GCP...
Blog / Engineering / Cloud Security Posture Management on Google Cloud Platform with Wazuh
Cloud Security Posture Management (CSPM) is important in ensuring the security and compliance of cloud environments. In cloud computing where organizations can quickly and easily provision, configure, and modify cloud...
Blog / Engineering / Cloud Security Posture Management on Microsoft Azure with Wazuh
Cloud Security Posture Management (CSPM) is essential to ensuring the security and compliance of cloud environments. In cloud computing, the potential for security misconfigurations is significantly high due to mismanagement...
Blog / Engineering / Detecting and responding to Phobos ransomware using Wazuh
Phobos ransomware has become a growing concern due to its tactics in targeting state and territorial governments. The ransomware group compromises Windows endpoints using phishing as the primary method to...
Blog / Engineering / CHAVECLOAK malware detection and response with Wazuh
CHAVECLOAK malware is a Windows-based banking trojan that targets South American financial sector individuals to steal sensitive financial information. The malware is distributed through phishing emails with embedded malicious PDF...