Malware detection using FIM

When a system gets compromised by malware, it may create new files or modify existing files, such as the following file types:

• Executable files (.exe, .dll, .bat, and .vbs)
• Configuration files (.cfg and .ini)
• Temporary files (.tmp)
• Registry entries
• Log files (.log)
• Payload files
• Hidden files and directories
• Batch scripts (.bat)
• PowerShell (.ps1)
• Specially crafted documents with a malicious payload (.doc, .xls, and .pdf)

Using this information, we can create an FIM rule in Wazuh to detect any file changes. However, we will get a high number of false positive alerts, too. To solve this problem, we can focus on a specific directory or folder. We will learn more in this section.

In this section, we’ll learn how to create Wazuh rules to detect some of the common malware patterns.

We’ll cover the following use cases:

• Configuring and testing FIM on an Ubuntu machine
• Detecting suspicious...