Malware detection

Wazuh detects malware using the threat detection ruleset and rootkit detection, and displays results on the Malware Detection dashboard.

These malware detection components help meet the following PCI DSS requirement:

  • Requirement 5 - Protect All Systems and Networks from Malicious Software: Malicious software can infiltrate or damage systems and compromise the confidentiality, integrity, or availability of data. The goal of this requirement is to protect systems from current and evolving malware threats.

To help meet the above PCI DSS requirement, Wazuh uses a combination of out-of-the-box rules, threat intelligence enrichments, and KVDB lists to detect malicious files.

Use case

Below is a PCI DSS requirement that the Wazuh malware detection capability supports.

PCI DSS requirement 5.2.2

PCI DSS requirement 5.2.2 mandates that the deployed anti-malware solution(s):

  • Detects all known types of malware

  • Removes, blocks, or contains all known malware types

In the following example, the Rootcheck module on the Ubuntu endpoint detects a hidden process, a potential indicator of a kernel-level rootkit. Attackers can use rootkits to conceal malicious processes from standard system utilities, such as ps, allowing them to maintain persistence and evade detection.

Diamorphine is a kernel-mode rootkit that can hide processes from the ps command. After installing and activating the rootkit, the Wazuh Rootcheck module compares process information from system calls such as getsid and getpgid and detects the discrepancy. It triggers a finding indicating that a process is hidden from the system process list. Hidden process detection supports PCI DSS requirement 5.2.2 by detecting potentially malicious software designed to evade security controls on monitored endpoints. See detecting hidden processes for more information. You can configure the Wazuh Active Response module to perform automated remediation actions, such as removing malicious files, based on your organization's requirements.