Wazuh gives visibility to EVERYTHING

Summary

John Hammond reviews Wazuh 4.14.1, an open-source security platform that combines endpoint detection and response (EDR) with SIEM capabilities. He demonstrates its updated IT Hygiene features, which provide both fleet-wide visibility and the ability to inspect individual endpoints. Wazuh agents can run on Windows, Linux, and macOS, and Hammond describes agent setup as straightforward.

The IT Hygiene dashboard inventories:

• Operating systems and hardware, including CPU and memory
• Installed software and packages, including Windows updates and patches
• Running processes, network addresses, interfaces, protocols, and listening ports
• Users, groups, services, and browser extensions

Users can filter results, customize displayed fields, and move between an overview of all connected agents and the details for a single host. Hammond also highlights report generation and Wazuh’s Microsoft Graph API integration for monitoring activity and audit events from Microsoft cloud services.

Demonstration and investigation

To show how the inventory can support triage, Hammond simulates a compromised Windows 11 host. He uses Wazuh to identify suspicious PowerShell activity and an unexpected TCP port 8080 listener, then correlates those clues with the host’s services. The investigation uncovers a simulated web shell running as a Windows service. Stopping the service stops the PowerShell process and removes the listener.

Hammond explains that his proof of concept uses a PowerShell script to host an HTTP server and NSSM (“Non-Sucking Service Manager”) to run it as a service. He notes that Chocolatey, a Windows package manager, was used to install NSSM. Tools like NSSM may also appear in malware setups because they make it easy to create services.

Review points

• Review: Hammond praises the fleet-wide IT Hygiene dashboard and its filtering and drill-down options, while noting that the video only samples Wazuh’s broader features.
• Demonstration: A simulated compromise shows how process, network, and service inventories can be combined during an investigation.
• Tools discussed: Chocolatey, NSSM, PowerShell HTTP hosting, and Microsoft Graph API integration.

Main speaker/source: John Hammond.